WO2017152742A1

WO2017152742A1 - Risk assessment method and apparatus for network security device

Info

Publication number: WO2017152742A1
Application number: PCT/CN2017/073933
Authority: WO
Inventors: 章倩; 滕志猛; 周娜; 霍玉臻
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-03-08
Filing date: 2017-02-17
Publication date: 2017-09-14
Also published as: CN107172004A

Abstract

A risk assessment method and apparatus for a network security device, the method comprising: extracting effective configuration information related to the risk segment in a device to be assessed by determining a predetermined risk repository, and acquiring, according to a risk analysis result of the effective configuration information, a risk segment triggering the device to be assessed, analysing risk segments in the predetermined risk repository and a risk segment triggered by the device to be assessed, and adopting the corresponding calculation method to obtain a security state value of the device to be assessed. The above-mentioned technical solution performs the corresponding calculation by analysing a risk value of a risk segment, the correlation between risk segments and the number of triggers of each risk segment triggered by a risk segment of the device to be assessed so as to obtain a security state value of the device to be assessed, thereby demonstrating a current security state of a device more intuitively, accurately and effectively.

Description

Method and device for risk assessment of network security equipment

Technical field

This document relates to, but is not limited to, the field of network security technologies, and relates to a method and device for risk assessment of network security devices.

Background technique

At present, with the continuous development of Internet technology, network security issues are becoming more and more prominent. Security products such as firewalls, intrusion prevention systems, and anti-virus are deployed in multiple locations in enterprise networks, among which enterprises and external networks and business partners Business needs will change at any time, and authorities such as Common Vulnerabilities & Exposures (CVE) and China National Vulnerability Database (CNVD) will release newly discovered vulnerabilities. Enterprise network administrators are required to change the configuration of network security devices to ensure the security of the enterprise network.

In related technologies, enterprise network administrators can open firewall ports to communicate with business partners, or close ports to avoid the use of exploits to change the configuration of network security devices, and to network through specific products. The configuration of the security device is checked to detect vulnerabilities in the configuration in a timely manner.

However, the related technologies do not comprehensively analyze the configuration results of network security devices through specific products, so that the results of the final evaluation cannot accurately, effectively and comprehensively reflect the security status of network security devices.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The embodiment of the invention provides a risk assessment method and device for a network security device, which can more clearly, accurately and effectively indicate the current device security state.

The embodiment of the invention provides a risk assessment method for a network security device, the method comprising:

Determining a predetermined risk pool, the risk pool including a plurality of risk items;

Extracting the valid configuration information related to the risk item in the device to be evaluated, and acquiring the risk item triggered by the device to be evaluated according to the risk analysis result of the effective configuration information;

The risk items in the predetermined risk database and the risk items triggered by the device to be evaluated are separately analyzed, and a corresponding calculation method is adopted to obtain a security status value of the device to be evaluated.

Compared with the related art, the embodiment of the present invention provides a risk assessment method for a network security device, by determining a predetermined risk database, extracting valid configuration information related to the risk item in the device to be evaluated, and according to effective configuration. The risk analysis result of the information obtains the risk item that triggers the device to be evaluated, separately analyzes the risk item in the predetermined risk pool and the risk item triggered by the device to be evaluated, and adopts a corresponding calculation method to obtain the device to be evaluated. Security status value. The above technical solution calculates the security state of the device to be evaluated by analyzing the risk value of the risk item, the relationship between the risk items, and the number of triggers of each risk item that the risk item of the device to be evaluated has triggered. The value can be more intuitive, accurate and effective to indicate the current device security status.

The embodiment of the invention further provides a risk assessment device for a network security device, the device comprising: a determining module, an extracting module and an evaluating module;

The determining module is configured to determine a predetermined risk database, where the risk database includes configuration information of multiple risk items, where the configuration information includes an identification code and a description content of the risk item;

The extraction module is configured to extract the valid configuration information related to the risk item in the device to be evaluated, and obtain the risk item triggered by the device to be evaluated according to the risk analysis result of the effective configuration information;

The evaluation module is configured to separately analyze the risk item in the predetermined risk pool and the risk item triggered by the device to be evaluated, and adopt a corresponding calculation method to obtain a security status value of the device to be evaluated.

Compared with the related art, the embodiment of the present invention provides a risk assessment apparatus for a network security device. The determining module determines a predetermined risk database, and the extraction module extracts valid configuration information related to the risk item in the device to be evaluated. And obtaining, according to the risk analysis result of the effective configuration information, a risk item that triggers the device to be evaluated, and the evaluation module separately analyzes the risk item in the predetermined risk database and the risk item triggered by the device to be evaluated, and adopts a corresponding calculation method to obtain The security status value of the device to be evaluated. The technical solution described above analyzes the risk value of the risk item, the relationship between the risk items, and the number of triggers of each risk item that the risk item of the device to be evaluated has triggered. The safety status value of the equipment to be evaluated is calculated locally, which can indicate the current equipment safety status more intuitively, accurately and effectively.

The embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and when the computer executable instructions are executed, implements a risk assessment method of the network security device.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

DRAWINGS

The drawings are used to provide a further understanding of the technical solutions of the present application, and constitute a part of the specification, which is used together with the embodiments of the present application to explain the technical solutions of the present application, and does not constitute a limitation of the technical solutions of the present application.

1 is a schematic flowchart of a method for risk assessment of a network security device according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a network security device risk assessment apparatus according to an embodiment of the present invention.

detailed description

Embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

The steps illustrated in the flowchart of the figures may be executed in a computer system such as a set of computer executable instructions. Also, although logical sequences are shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.

The method according to the embodiment of the present invention may be applied to a single device in a network security system, and the network security device may be a device such as a router, a firewall, a behavior manager, and a core switch, but is not limited thereto.

The method according to the embodiment of the present invention solves the problem that the analysis of the configuration result of the network security device by using a specific product in the related art is not comprehensive, so that the result of the final evaluation cannot accurately, effectively, and comprehensively reflect the security of the network security device. The technical problem of the state.

The technical solutions of the present application are described in detail below with specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in other embodiments.

FIG. 1 is a schematic flowchart of Embodiment 1 of a method for risk assessment of a network security device according to an embodiment of the present disclosure. This embodiment relates to a specific process for implementing a risk assessment method for a network security device. As shown in Figure 1, the method includes:

Step S101: Determine a predetermined risk pool, where the risk database includes multiple risk items;

In this embodiment, the user may customize the risk pool according to the business risk requirements according to the standard risk database provided by the unified security policy management system, wherein the risk database includes all vulnerability information of the device, where Each vulnerability is defined as a risk item. For example, the administrator password of the device is the default value, the device is open to the Telnet service, etc., but is not limited thereto.

In this embodiment, each risk item has an identification code and a description content of the risk item, and each risk item (also referred to as a vulnerability) is analyzed in detail, and is represented by a corresponding field, where each risk item is present. The included fields include, but are not limited to, the risk item identifier, the description content, the risk value caused by the risk item, the relationship between the risk item and the risk item, and the like.

In step S102, the valid configuration information related to the risk item in the device to be evaluated is extracted, and the risk item triggered by the device to be evaluated is obtained according to the risk analysis result of the effective configuration information.

In this embodiment, the unified security policy management system can be remotely connected to the device to be evaluated through SSH (Secure Shell), and the original configuration information of the device to be evaluated is extracted according to the configuration information of the risk items in the risk database. Extracting valid information related to the risk item in the device to be evaluated, that is, extracting all relevant valid configuration information that may have a vulnerability, forming normalized data, performing risk analysis according to a predetermined risk database, and obtaining the to-be-evaluated The risk item that the device has triggered. For example, if there is a risk item in the risk database regarding the validity period of the administrator password, the valid data in the original configuration information of the device to be evaluated, that is, the information of the validity period of the password, and the field in which the password validity period is set in the normalized format are extracted. And the value of the field is the value of the valid period of the collected password, but not limited to this.

In step S103, the risk item in the predetermined risk pool and the risk item triggered by the device to be evaluated are respectively analyzed, and a corresponding calculation method is adopted to obtain a security status value of the device to be evaluated.

In this embodiment, the risk item in the selected risk database may be analyzed according to the risk database selected by the user, and the risk item triggered by the device to be evaluated may be analyzed, and the risk value and the risk item of the risk item may be analyzed. The relationship between the risk value of the triggering risk item and the triggering risk item may be analyzed, and the corresponding analysis method is adopted to obtain the safety state value of the device to be evaluated.

A method for risk assessment of a network security device according to an embodiment of the present invention, by determining a predetermined risk database, extracting valid configuration information related to the risk item in the device to be evaluated, and obtaining the risk analysis result according to the effective configuration information The risk item of the device to be evaluated is triggered, the risk item in the predetermined risk pool and the risk item triggered by the device to be evaluated are analyzed, and a corresponding calculation method is adopted to obtain a safety state value risk value of the device to be evaluated. The foregoing technical solution calculates the security status value of the device to be evaluated by analyzing the risk value of the risk item, the relationship between the risk items, and the number of triggers of each risk item triggered by the risk item of the device to be evaluated. It can indicate the current device security status more intuitively, accurately and effectively.

Optionally, on the basis of the foregoing embodiment, before the step 101 determines the predetermined risk pool, the method further includes:

A risk type of a configuration type is collected in advance, and the configuration type includes a baseline library and/or an ACL (Access Control List) library.

In an embodiment, the risk assessment of the embodiment of the present invention is triggered from the perspective of the risk item, and the predetermined analysis method is used to determine whether the configuration of the device to be evaluated has a risk item, and the risk value existing in the risk item is used to determine the to-be-evaluated. The security status value of the device. Therefore, the pre-processing needs to collect and describe the configuration information of the device to be evaluated, and form a risk database required for configuration types such as baseline analysis and/or ACL risk analysis. The formation of the risk library refers to the current related vulnerability library, such as CVE. (Common Vulnerabilities & Exposures, public vulnerabilities and exposures); also refer to equipment configuration specification requirements, such as NIST (National Institute of Standards and Technology) on firewall configuration specifications, can also refer to some common standards Such as, but not limited to, baseline standards, compliance standards, PCI (Peripheral Component Interconnect) standards, and the like.

In this embodiment, the pre-collected risk pools may be classified according to the configuration type, and the risk pool is specifically divided into a baseline module baseline pool and an ACL risk pool, so that they can be separately used for baseline analysis. And ACL risk analysis.

Optionally, on the basis of the foregoing embodiment, analyzing the risk items in the predetermined risk pool, including:

Count the total number of risk items in the predetermined risk pool;

The CVSS 3.0 (Common Vulnerability Scoring System) scoring method is used to analyze the risk value of the risk item in the predetermined risk database; for example, in this embodiment, the CVSS v3.0 scoring method can be used to analyze the acquisition schedule. The risk value of the risk item in the risk library.

Determining whether there is an association relationship between any two risk items in the predetermined risk pool; if the first risk item is triggered, the second risk item is triggered, and triggering the second risk item does not trigger the first item For the risk item, there is an association between the first risk item and the second risk item.

In this embodiment, the risk database used for analysis may be a standard library or a risk total library provided by the unified security policy management system, or may be a user-customized customization according to the needs of the user. Risk library.

In this embodiment, the total number of risk items in the predetermined risk database is counted, and the risk value of the risk item in the predetermined risk database is analyzed by using the CVSS3.0 scoring method. The unified security policy control system adopts the latest official CVSS3. The 0-scoring method considers the vulnerability path, attack complexity, privilege, user interaction, confidentiality, integrity, availability, etc., and uses the CVSS3.0 scoring formula to evaluate the risk value of the current vulnerability and conduct the vulnerability score. Qualitative analysis, divided into five levels of serious, high, medium, low and slight, to visually judge the severity of the current vulnerability, using the recognized CVSS3.0 scoring method, making the risk value of the vulnerability more accurate, reliable and credible .

The relationship between the risk item and the risk item is mainly used to analyze the relationship between different risk items (ie, loopholes) in the predetermined risk pool, where the relationship may be defined as: Any two risk items (ie, loopholes) A, B, if all risk pool rules that trigger risk item A must trigger risk item B, and the risk pool rule that triggers risk item B does not necessarily trigger risk item A, then the risk is considered A has a relationship with risk item B, where risk item B contains risk item A. As can be seen from the definition, if the inclusion relationship is not considered, when the security score of the device is calculated, the ACL rule that triggers the included risk item (ie, the vulnerability) is calculated multiple times, resulting in the device's risk score. Going higher, the safety score is lower. In practice, based on the definition of the above relationship, the relationship between the risk items in the risk database is analyzed. The analysis steps are as follows:

(1) Analyze whether there is any relationship between the two risk items according to the definition of the relationship between the two risk items A and B in the predetermined risk database;

(2) If the risk items A and B in (1) have an association relationship, and B contains A, the vulnerability ID of risk item A is added in the “vulnerability association relationship” field of risk item B.

For example, if the risk item R1 checks whether the external network to the internal network is open for the ANY type of the rule, the risk item R2 checks whether the external network to the internal network is open for the Telnet service, and the risk item R3 checks whether the external network to the internal network is open to the X11 service. Analysis of the relationship between R1, R2, and R3 can lead to the conclusion that the ACL rule that triggers the risk item R1 will inevitably trigger the risk items R2 and R3. Therefore, the value R1 needs to be added in the "Vulnerability Relationship" field of risk items R2 and R3. If the relationship between them is not considered here, the ACL rule that triggers the risk item R1 is calculated multiple times (in the example, each ACL rule that triggers R1 is calculated 3 times). This inclusion relationship is taken into account, and the repeated calculation of the ACL rule is removed, and the accuracy of the system security ACL module and the comprehensive security state analysis result of the device is improved.

Optionally, on the basis of the foregoing embodiment, analyzing the risk items triggered by the device to be evaluated, including:

If the predetermined risk database includes an access control list ACL library, analyze one or more of the trigger number of each risk item triggered by the device to be evaluated, the risk value of the risk item, and the relationship between the risk items. One.

In this embodiment, if the predetermined risk database is a plurality of types of ACL risk pools, the user may trigger the trigger number of each risk item of the device to be evaluated and the risk value of the risk item according to the selected ACL risk database. And one or more of the three relationships between the risk items. It should be noted that different risk databases are used for analysis, and the detected vulnerability information is also different. The following will be explained in detail by way of example, as follows:

Step 11: Perform risk analysis on the normalized ACL policy data according to the risk database selected by the user, and collect an identification code number of an ACL policy that triggers each risk item (ie, a vulnerability);

Step 12: The result of step 11 is processed according to the association between the risk item and the risk item, and the ID number of the repeatedly calculated ACL policy is removed, and the ID number of the ACL policy that triggers each risk item is obtained after being processed;

Step 13. Count the number of times each risk item is triggered according to the processing result in step 12. One of the ACL policy ID numbers represents a trigger. For example, for a risk item with a lower risk value, it is triggered once and triggered 100 times. The risk impact of the risk item is different. The risk item with more triggers indicates that the risk item is used. The number of times is higher, and the more times it is used, the more malicious usage is relatively, which increases the risk value of the device to be evaluated.

Step 14: Obtain an ACL security state value of the device to be evaluated according to the analysis result of steps 11, 12, and 13.

For step 14 above, the analysis can be performed according to the following calculation process, including:

The total number of risk items in the predetermined risk pool and the total number of ACL rules triggering each risk item x _i (i = 1, 2, ..., n) can be calculated according to the calculation formula (1):

Obtaining a security status value, wherein the S _n is a triggered risk item total score, and the S _t is an untriggered risk item total score,

Said

The weight value R _i is a risk value of the risk item, i=1, 2, 3, ..., n is a trigger risk item, n is less than or equal to M, M is a positive integer, i=n+1, ..., M is an untriggered risk term, and x _i is a positive integer greater than or equal to 1.

In the above process, by analyzing the triggered risk items (ie, vulnerability) detected by ACL risk analysis, the risk value of the risk item, and the number of times the risk item is triggered, the security status of the system equipment ACL module is analyzed, and corresponding Security status value.

The above analysis method considers the relationship between the risk items and the number of times the risk items are triggered, so the analysis is more comprehensive. The risk value is calculated by CVSS3.0 scoring technology, which is more reliable and credible than the empirical value method. In addition, the calculated system security status value is more intuitive, accurate, and effective to indicate the current device security status.

If the predetermined risk database includes a baseline library, the risk value of the risk item triggered by the device to be evaluated is analyzed.

In this embodiment, if it is determined that the predetermined risk database is a plurality of types of baseline risk pools, the user may analyze the risk value of each risk item according to the selected baseline risk database, and perform according to the data of the normalized baseline module. Risk analysis of the baseline module. The baseline library used for analysis here may be a baseline library provided by the unified security policy management system, or a baseline library customized by the user according to his own business needs, and the selected baseline library is different, and the final evaluation result is also different. The following is a detailed description by way of example, as follows: Step 21: Select all baseline libraries related to the baseline from the risk database, and the user bases the normalized baseline data of the device to be evaluated according to the selected baseline library. Analysis; step 22, according to the triggered risk item (ie, vulnerability) detected in 21, the risk value of the risk item, the calculation of the security status value;

In this embodiment, for the above step 22, the analysis can be performed according to the following calculation process:

The total number of risk items M in the predetermined risk database can be calculated according to the calculation formula (2):

Obtaining a security status value, wherein the S′ _n is a triggered risk item total score, and the S′ _t is an untriggered risk item total score,

Said

The weight value R _i is a risk value of the risk item, i=1, 2, 3, . . . , n is a trigger risk item, n is less than or equal to M, i=n+1, . . . , M Is an untriggered risk item.

In the above process, the triggered risk item (ie, vulnerability) detected by the baseline analysis, the risk value of the risk item, the security status of the system equipment baseline module are analyzed, and the corresponding security status value is obtained.

The above analysis method uses the CVSS3.0 scoring technique for the calculation of the risk value of the risk item (ie, the vulnerability), and the method is more reliable and credible than the empirical value method. In addition, the calculated system security status value is more intuitive, accurate, and effective to indicate the current device security status.

Optionally, on the basis of the foregoing embodiment, if it is determined that the predetermined risk database includes a baseline library and an access control list ACL library, respectively analyzing the risk item in the predetermined risk database and the risk item triggered by the device to be evaluated, Taking the corresponding calculation method, the security state value of the device to be evaluated is obtained, which will be described in detail by way of example, as follows:

Step 31: Determine whether the device to be evaluated supports ACL risk analysis. If supported, perform the security state analysis of the ACL module. The specific execution method is the same as the ACL risk database in the above embodiment. Hold, do not execute;

Step 32: Perform security state analysis of the baseline module on the device to be analyzed, and execute the method in the same manner as the baseline library in the embodiment;

Step 33: Analyze the comprehensive security status of the device according to the analysis results of step 31 and step 32.

For the above step 33, the calculation can be performed according to the calculation formula (3):

The S _n is a total score of risk items triggered when the ACL library is accessed, and the S _t is a total score of risk items that are not triggered when the ACL library is accessed, and the S′ _n is an access baseline database. risk score item triggered when the S _'t risk score item is accessed baseline library is not triggered.

Through the analysis of the comprehensive safety status of the equipment to be evaluated, the information of the triggered risk items (ie, the vulnerability) detected by the baseline analysis and the ACL analysis, the risk value of the risk item, the number of times the risk item is triggered, and the comprehensive safety status of the system equipment are analyzed. And get the corresponding security status value.

The above analysis method considers the relationship between the risk items and the number of times the risk items are triggered, and the analysis is more comprehensive. The risk value is calculated using the CVSS3.0 scoring technique, which is more reliable and reliable than the empirical method in the related art. In addition, the calculated system security status value is more intuitive, accurate, and effective to indicate the current device security status.

FIG. 2 is a schematic structural diagram of a network security device risk assessment apparatus according to an embodiment of the present invention. As shown in FIG. 2, a network security device risk assessment apparatus includes a determination module 10, an extraction module 20, and an evaluation module 30. ;

The determining module 10 is configured to determine a predetermined risk database, where the risk database includes configuration information of multiple risk items, where the configuration information includes an identification code and a description content of the risk item;

The extraction module 20 is configured to extract the valid configuration information related to the risk item in the device to be evaluated, and obtain the risk item triggered by the device to be evaluated according to the risk analysis result of the effective configuration information;

The evaluation module 30 is configured to separately analyze the risk item in the predetermined risk pool and the risk item triggered by the device to be evaluated, and adopt a corresponding calculation method to obtain a security status value of the device to be evaluated.

A risk assessment apparatus for a network security device according to an embodiment of the present invention includes: determining a mode The block, the extraction module, and the evaluation module determine the predetermined risk database by the determining module, and the extraction module extracts valid configuration information related to the risk item in the device to be evaluated, and obtains the trigger according to the risk analysis result of the effective configuration information. The risk item of the device is evaluated, and the evaluation module separately analyzes the risk item in the predetermined risk database and the risk item triggered by the device to be evaluated, and adopts a corresponding calculation method to obtain the safety state value of the device to be evaluated. The foregoing technical solution calculates the security status value of the device to be evaluated by analyzing the risk value of the risk item, the relationship between the risk items, and the number of triggers of each risk item triggered by the risk item of the device to be evaluated. This makes the current device security status more intuitive, accurate and effective.

Optionally, based on the foregoing embodiment, the device further includes: a pre-processing module 40;

The pre-processing module 40 is configured to pre-collect a risk database of a configuration type, including a baseline library and/or an access control list ACL library, before determining a predetermined risk pool.

The device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.

Optionally, on the basis of the foregoing embodiment, the evaluating module 30 implements analyzing the risk items in the predetermined risk pool by:

Count the total number of risk items in the predetermined risk pool;

Using the CVSS3.0 scoring method to analyze the risk value of the risk item in the predetermined risk database;

Determining whether there is any relationship between any two risk items in the predetermined risk database. If the first risk item is triggered, the second risk item must be triggered, and triggering the second risk item does not trigger the first item. For the risk item, there is an association between the first risk item and the second risk item.

Optionally, on the basis of the foregoing embodiment, the evaluating module 30 implements analyzing, by using the following manner, a risk item that has been triggered by the device to be evaluated:

If the predetermined risk database includes an access control list ACL library, analyzing one of the triggering times of each risk item triggered by the device to be evaluated, the risk value of the risk item, and the relationship between the risk items or Multiple.

Optionally, on the basis of the foregoing embodiment, the evaluation module 30 implements the following manner. Analysis of the risk item triggered by the device to be evaluated:

The embodiments disclosed in the present application are as described above, but the description is only for the purpose of understanding the present application, and is not intended to limit the present application. Any modifications and changes in the form and details of the embodiments may be made by those skilled in the art without departing from the spirit and scope of the disclosure. The scope defined by the appended claims shall prevail.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function. This application is not limited to any specific combination of hardware and software. A person skilled in the art should understand that the technical solutions of the present application can be modified or equivalent, without departing from the spirit and scope of the technical solutions of the present application, and should be included in the scope of the claims of the present application.

Industrial applicability

The above technical solution can more clearly, accurately and effectively indicate the security status of the current device.

Claims

A method for risk assessment of a network security device, the method comprising:

Determining a predetermined risk pool, the risk pool including a plurality of risk items;

Extracting the valid configuration information related to the risk item in the device to be evaluated, and acquiring the risk item triggered by the device to be evaluated according to the risk analysis result of the effective configuration information;

The risk items in the predetermined risk database and the risk items triggered by the device to be evaluated are separately analyzed, and a corresponding calculation method is adopted to obtain a security status value of the device to be evaluated.
The method of claim 1 further comprising: prior to determining the predetermined risk pool:

A risk type of a configuration type is collected in advance, and the configuration type includes a baseline library and/or an access control list ACL library.
The method of claim 2 wherein said analyzing the risk items in the predetermined risk pool comprises:

Count the total number of risk items in the predetermined risk pool;

Using the general vulnerability scoring system CVSS3.0 scoring method to analyze the risk value of the risk item in the predetermined risk database;

Determining whether there is an association relationship between any two risk items in the predetermined risk pool; if the first risk item is triggered, the second risk item is triggered, and triggering the second risk item does not trigger the first For the risk item, there is an association between the first risk item and the second risk item.
The method according to claim 3, wherein the analyzing the risk items triggered by the device to be evaluated comprises:

If the predetermined risk database includes an access control list ACL library, analyze one or more of the trigger number of each risk item triggered by the device to be evaluated, the risk value of the risk item, and the relationship between the risk items. One.
The method according to claim 3, wherein analyzing the risk item triggered by the device to be evaluated comprises:

If the predetermined risk database includes a baseline library, the risk value of the risk item triggered by the device to be evaluated is analyzed.
A risk assessment device for a network security device, the device comprising: a determination module, an extraction module, and an evaluation module;

The determining module is configured to determine a predetermined risk database, where the risk database includes configuration information of multiple risk items, where the configuration information includes an identification code and a description content of the risk item;

The extraction module is configured to extract the valid configuration information related to the risk item in the device to be evaluated, and obtain the risk item triggered by the device to be evaluated according to the risk analysis result of the effective configuration information;

The evaluation module is configured to separately analyze the risk item in the predetermined risk pool and the risk item triggered by the device to be evaluated, and adopt a corresponding calculation method to obtain a security status value of the device to be evaluated.
The apparatus of claim 6 further comprising: a pre-processing module;

The pre-processing module is configured to pre-collect a risk database of a configuration type, including a baseline library and/or an access control list ACL library, before determining a predetermined risk pool.
The apparatus of claim 7, wherein the evaluation module implements analyzing the risk items in the predetermined risk pool by:

Count the total number of risk items in the predetermined risk pool;

Using the general vulnerability scoring system CVSS3.0 scoring method to analyze the risk value of the risk item in the predetermined risk database;

Determining whether there is an association relationship between any two risk items in the predetermined risk pool, if the first risk item is triggered, the second risk item is triggered, and triggering the second risk item does not trigger the first For a risk item, there is an association between the first risk item and the second risk item.
The apparatus according to claim 8, wherein the evaluation module implements analyzing the risk item triggered by the device to be evaluated by:

If the predetermined risk database includes an access control list ACL library, analyzing one of the trigger number of each risk item triggered by the device to be evaluated, the risk value of the risk item, and the relationship between the risk item and the risk item or Multiple.
The apparatus according to claim 8, wherein the evaluation module implements analyzing the risk item triggered by the device to be evaluated by:

If the predetermined risk database includes a baseline library, the risk value of the risk item triggered by the device to be evaluated is analyzed.