# US 12,216,768 B2 · Asset scoring method and apparatus, computer device, and storage medium

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,216,768 B2
- Document ID: US12216768B2
- Status: Granted
- Kind: B2
- Application number: 18/020,086
- Filed: 2021-04-28
- Published: 2023-10-05
- Granted: 2025-02-04
- Earliest claimed: 2020-08-07
- Assignees: Dbappsecurity Co., Ltd
- Applicants: Dbappsecurity Co., Ltd
- Inventors: Wei Wang; Yuan Fan
- Web page: https://patentgrep.com/patent/US12216768B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An asset scoring method and apparatus, a computer device, and a storage medium are provided. The method includes: obtaining multi-dimensional threat information data of assets to be assessed; obtaining sub-scores of dimensions according to the multi-dimensional threat information data and a preset security scoring model; according to the sub-scores of the dimensions, determining a security scoring result of the corresponding assets to be assessed; and according to the security scoring result and a preset level division rule, determining security levels of the corresponding assets to be assessed.

## Claims

### Claim 1

An asset scoring method, comprising:
obtaining multi-dimensional threat information data of assets to be assessed;
obtaining sub-scores of dimensions according to the multi-dimensional threat information data and a preset security scoring model;
determining a security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions; and
determining security levels of the corresponding assets to be assessed according to the security scoring result and a preset level division rule.

### Claim 2 (depends on 1)

The asset scoring method of claim 1, wherein the dimensions comprise an incident status, a vulnerability status, and a failure status.

### Claim 3 (depends on 1)

The asset scoring method of claim 1, wherein the obtaining sub-scores of dimensions according to the multi-dimensional threat information data and the preset security scoring model further comprises:
obtaining a total amount of threat data in each dimension and an amount of threat data in each dimension level corresponding to each dimension, wherein each dimension comprises at least two dimension levels;
calculating, based on the amount of threat data in each dimension level and the total amount of threat data in a corresponding dimension, a threat probability corresponding to each dimension level in each dimension; and
taking the threat probability corresponding to each dimension level in the same dimension and the total amount of threat data in the corresponding dimension as input to the security scoring module, and obtaining the sub-score of the corresponding dimension.

### Claim 4 (depends on 1)

The asset scoring method of claim 1, wherein the determining the security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions further comprises:
when all the sub-scores are greater than zero, summing the sub-scores of all dimensions to obtain the security scoring result of the corresponding assets to be assessed.

### Claim 5 (depends on 1)

The asset scoring method of claim 1, wherein the determining the security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions further comprises:
when the sub-scores are less than zero, resetting the corresponding sub-scores to zero; and
summing the sub-scores of all dimensions to obtain the security scoring result of the corresponding assets to be assessed.

### Claim 6 (depends on 3)

The asset scoring method of claim 3, wherein a formula for calculating, based on the amount of threat data in each dimension level and the total amount of threat data in the corresponding dimension, the threat probability corresponding to each dimension level in each dimension is as follows:
Di=Ni/sum*λ
wherein the threat probability corresponding to a dimension level i in a dimension D is denoted as Di, the amount of threat data corresponding to the dimension level i in the dimension D is denoted as Ni, the total amount of threat data in the dimension D is denoted as sum, and a threat coefficient corresponding to the dimension level i is denoted as λ.

### Claim 7 (depends on 3)

The asset scoring method of claim 3, wherein a formula for taking the threat probability corresponding to each dimension level in the same dimension and the total amount of threat data in the corresponding dimension as input to the security scoring module, and obtaining the sub-score of the corresponding dimension is as follows:
SD=W1−W1(D1+D2+ . . . D)−sum*W2
wherein the sub-score of a dimension D is denoted as SD, a weight of the dimension D is denoted as W1, the threat probability corresponding to a dimension level i in the dimension D is denoted as Di, the total amount of threat data in the dimension D is denoted as sum, and a weight of the total amount of threat data in the dimension D is denoted as W2.

### Claim 8 (depends on 1)

A computer device, comprising a processor and a memory that stores a computer program running on the processor, wherein the computer program is executed by the processor to implement the steps of the asset scoring method of claim 1.

### Claim 9 (depends on 8)

The computer device of claim 8, wherein the dimensions comprise an incident status, a vulnerability status, and a failure status.

### Claim 10 (depends on 8)

The computer device of claim 8, wherein the obtaining sub-scores of dimensions according to the multi-dimensional threat information data and the preset security scoring model further comprises:
obtaining a total amount of threat data in each dimension and an amount of threat data in each dimension level corresponding to each dimension, wherein each dimension comprises at least two dimension levels;
calculating, based on the amount of threat data in each dimension level and the total amount of threat data in a corresponding dimension, a threat probability corresponding to each dimension level in each dimension; and
taking the threat probability corresponding to each dimension level in the same dimension and the total amount of threat data in the corresponding dimension as input to the security scoring module, and obtaining the sub-score of the corresponding dimension.

### Claim 11 (depends on 8)

The computer device of claim 8, wherein the determining the security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions further comprises:
when all the sub-scores are greater than zero, summing the sub-scores of all dimensions to obtain the security scoring result of the corresponding assets to be assessed.

### Claim 12 (depends on 8)

The computer device of claim 8, wherein the determining the security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions further comprises:
when the sub-scores are less than zero, resetting the corresponding sub-scores to zero; and
summing the sub-scores of all dimensions to obtain the security scoring result of the corresponding assets to be assessed.

### Claim 13 (depends on 10)

The computer device of claim 10, wherein a formula for calculating, based on the amount of threat data in each dimension level and the total amount of threat data in the corresponding dimension, the threat probability corresponding to each dimension level in each dimension is as follows:
Di=Ni/sum*λ
wherein the threat probability corresponding to a dimension level i in a dimension D is denoted as Di, the amount of threat data corresponding to the dimension level i in the dimension D is denoted as Ni, the total amount of threat data in the dimension D is denoted as sum, and a threat coefficient corresponding to the dimension level i is denoted as λ.

### Claim 14 (depends on 10)

The computer device of claim 10, wherein a formula for taking the threat probability corresponding to each dimension level in the same dimension and the total amount of threat data in the corresponding dimension as input to the security scoring module, and obtaining the sub-score of the corresponding dimension is as follows:
SD=W1−W1(D1+D2+ . . . D)−sum*W2
wherein the sub-score of a dimension D is denoted as SD, a weight of the dimension D is denoted as W1, the threat probability corresponding to a dimension level i in the dimension D is denoted as Di, the total amount of threat data in the dimension D is denoted as sum, and a weight of the total amount of threat data in the dimension D is denoted as W2.

### Claim 15 (depends on 1)

A storage medium having stored a computer program, wherein the computer program is executed by a processor to implement the steps of the asset scoring method of claim 1.

### Claim 16 (depends on 15)

The storage medium of claim 15, wherein the dimensions comprise an incident status, a vulnerability status, and a failure status.

### Claim 17 (depends on 15)

The storage medium of claim 15, wherein the obtaining sub-scores of dimensions according to the multi-dimensional threat information data and the preset security scoring model further comprises:
obtaining a total amount of threat data in each dimension and an amount of threat data in each dimension level corresponding to each dimension, wherein each dimension comprises at least two dimension levels;
calculating, based on the amount of threat data in each dimension level and the total amount of threat data in a corresponding dimension, a threat probability corresponding to each dimension level in each dimension; and
taking the threat probability corresponding to each dimension level in the same dimension and the total amount of threat data in the corresponding dimension as input to the security scoring module, and obtaining the sub-score of the corresponding dimension.

### Claim 18 (depends on 15)

The storage medium of claim 15, wherein the determining the security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions further comprises:
when all the sub-scores are greater than zero, summing the sub-scores of all dimensions to obtain the security scoring result of the corresponding assets to be assessed.

### Claim 19 (depends on 15)

The storage medium of claim 15, wherein the determining the security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions further comprises:
when the sub-scores are less than zero, resetting the corresponding sub-scores to zero; and
summing the sub-scores of all dimensions to obtain the security scoring result of the corresponding assets to be assessed.

### Claim 20

An asset scoring apparatus, comprising:
a threat information data obtaining unit, configured for obtaining multi-dimensional threat information data of assets to be assessed;
a sub-score obtaining unit, configured for obtaining sub-scores of dimensions according to the multi-dimensional threat information data and a preset security scoring model;
a security scoring result determining unit, configured for determining a security scoring result of the corresponding assets to be assessed according to the sub-scores of the dimensions; and
a security level determining unit, configured for determining security levels of the corresponding assets to be assessed according to the security scoring result and a preset level division rule.