Distributed equipment information collection system and method

Abstract

The invention provides a distributed equipment information collection system and method. A collection task is obtained by user interaction, the collection task is segmented to obtain collection subtasks, the collection subtasks are distributed to detection nodes, and equipment information collecting results uploaded by the detection nodes are received; and the collection subtasks are received, equipment information collection is executed, and an equipment information collection result is obtained and uploaded to a management node. The detection nodes obtains an open port by port scanning filtering, a detection request is formed, a returned response message is analyzed, equipment information is obtained and returned to a management node, and the collected equipment information is stored andmanaged by the management node in a unified way. Information of network equipment within a large-scale network address scope is collected rapidly, the IP is banned when abnormal flow is determined, and the equipment information is collected efficiently and accurately; and the management and detection nodes are scheduled in a distributed way and work in a coordinated way, and the equipment information is collected dispersely and stored and managed in the unified way.

Description

technical field [0001] The present invention relates to the field of network security, in particular to a distributed device information collection system and method. Background technique [0002] Collecting information on networked devices on a large-scale network or even the entire Internet helps to grasp the overall security situation of the Internet space, and provides information support for protecting important networked systems, so as to detect problematic devices in time before network attacks occur, or Determine the scope of a cyber attack and respond quickly when it occurs. At present, information collection on large-scale networks usually adopts a distributed organizational structure to avoid the network bandwidth limitation of single-point detection, and at the same time, it can easily expand the information collection capability of the entire system. [0003] However, the problem existing in the existing information collection method is that the IP address dete...

AI Technical Summary

Problems solved by technology

[0003] However, the problem existing in the existing information collection method is that the IP address detected by each detection node basically belongs to the same subnet segment or an adjacent subnet segment. The behavior of frequently sending network data packets, these traffic may be judged as abnormal traffic by the target network segment, resulting in the IP address of the detection node being blocked by the target network segment, and further causing the amount of collected device information to be far lower than the actual situation

Images