Fast scanning method of network ports based on self-adaptation

Abstract

The invention discloses a self-adapting-based network port fast scanning method. According to the method, through mutual self-adaptive learning of IP addresses and ports, newly found IP addresses or newly found ports are updated and scanned, and repeated scanning is avoided. On the one hand, the number of detected messages can be reduced greatly, meanwhile, the conditions of the IPs and the ports opened in the network can be found to the maximum extent, and the subnet scanning speed is greatly increased. Once it is found that a loophole port happens to a certain host, it is likely that the host has other loophole ports under general conditions, under the condition that one loophole is found, self-adaptive learning can be performed, all the ports where the loopholes may exist of the host IPs which can be attacked easily can be found in time, all the other loopholes of the IPs of the whole network can be detected by just finding any one IP loophole, and threatening loopholes probably existing in the network can be scanned in time.

Description

Technical field [0001] The technology relates to the field of network measurement technology, in particular to a fast scanning method for network ports based on self-adaptation. Background technique [0002] Each operating system has different ports open for communication between systems. If an intruder wants to detect which ports the target computer opens and which services are provided, he needs to establish a TCP connection with the target port first. Try to establish a connection with some ports of the target host. If the target host responds to the port, the port is open. [0003] There are many port scanning techniques, such as: (1) Full TCP connection: A three-way handshake is used to establish a standard TCP connection with the target computer, but it is easily recorded by the target host. (2) Half-open scanning (SYN scanning): a. If the target computer responds with SYN=1 and ACK=1 in the TCP message, it means that the port is active, and then the scanning host sends a RS...

AI Technical Summary

Problems solved by technology

(2) Semi-open scanning (SYN scanning): a. If the target computer responds with SYN=1 and ACK=1 in the TCP message, it means that the port is active, and then the scanning host sends an RST to the target host to refuse to establish a TCP connection , resulting in the failure of the three-way handshake process

[0005] The main problem of the current port scanning is that a host has 65536 ports, and the number of ports opened by the IP in the subnet is very small. If you want to be able to scan the vulnerabilities in the subnet, you need to scan all the hosts in the subnet All the ports are scanned, resulting in a huge number of scanned traffic. On the one hand, the scanning traffic affects the normal operation of the network, and at the same time, it takes a lot of time to scan

Images