Internet host scanning method and system based on host relationship

Abstract

The invention discloses an Internet host scanning method and an Internet host scanning system based on the host relationship. The method comprises the steps: obtaining the network information of all target hosts, enabling the network information to comprise network topology information and historical ports, and constructing feature vectors in one-to-one correspondence with all target hosts according to the network information; clustering all the feature vectors by using an unsupervised clustering algorithm, and obtaining clustering relationships in one-to-one correspondence with all the targethosts through clustering, the clustering relationships including network topology relationship information and application cluster information; and determining a scanning sequence and a scanning interval of all the target hosts by utilizing the grouping relationship, and executing network scanning to obtain port information and / or vulnerability information corresponding to all the target hosts. Compared with a traditional scanning mode, the scanning mode provided by the internet scanning method and system is more targeted. The homologous scanning interval of the network cluster obtained through clustering within the same scanning time is larger. Therefore, the influence degree of internet scanning on host work is reduced.

Description

technical field [0001] The invention belongs to the field of network host scanning, and in particular relates to a method and system for scanning Internet hosts based on host relationships. Background technique [0002] The development of network information technology has brought great convenience to human life and changed the way of life of human beings. The concept of smart home, smart transportation, and smart city promotes the interconnection of Internet of Things devices, and jointly provides services in the form of clusters or service platforms. At the same time, the continuous integration of industrialization and informatization also promotes the use of standard and general communication protocols and software and hardware systems for industrial control systems to connect to the Internet. These host devices connected to the Internet inevitably have loopholes, and there is a risk of being attacked by hackers. [0003] Network host scanning includes IP scanning, port...

AI Technical Summary

Problems solved by technology

Although many network scanning methods and open source scanning tools have been proposed, there is almost no scanning method that can efficiently collect target information while reducing the impact of network scanning on scanning targets.

Improper scanning operations not only affect the load of the target network, but also affect the IP reputation of the scanning source IP, so that the scanning source IP is blocked by some scanning targets for network requests, thereby reducing the accuracy of network scanning results

Images