Network space surveying and mapping method based on service verification

Abstract

The invention belongs to a network space surveying and mapping method based on service verification, and belongs to the technical field of network security. The method comprises the following steps of: A, analyzing a flow log, mirror flow and offline data in sequence to obtain an analysis result; b, verifying the analysis result through a script to obtain a verification result; and C, perfecting the space surveying and mapping information through a verification result. The space surveying and mapping efficiency is improved by utilizing server IP, port and protocol information acquired by dataacquisition, dimensions of space surveying and mapping asset description are enriched, and validity of verification numbers is actively detected, so that reliability of whole space surveying and mapping data is improved, and huge burden on a network caused by an active scanning mode is avoided.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network space surveying and mapping method based on service verification. Background technique [0002] Cyberspace mapping refers to the use of specific technologies to detect cyberspace, identify assets in the network (such as servers, routing equipment, industrial control equipment, firewalls, gateways, etc.), service applications (webserver, ftp, ssh, mysql, etc.) Combining with other basic data to realize the portrait of assets in cyberspace. The existing surveying and mapping methods are mainly realized by active scanning. Active scanning is to use the detection server to initiate a connection request to the specified port of the target device to judge the characteristic information of the target device according to the returned situation. [0003] For the detection server, the target device is an unknown situation, it does not know the server IP add...

AI Technical Summary

Problems solved by technology

[0004] When the detection server conducts active detection, it often needs to retry a port multiple times before it can return the fingerprint (banner) data expected by the detection server. Therefore, we can calculate the number of detections initiated by a network-wide active detection: total detection Number of times = IP*port*number of detections on a single port. It can be seen that the cost of performing an active detection is very high, but high-frequency network detections often cause network congestion and affect normal network use. In actual use A target may only have a small number of ports open, and even the target IP is unreachable

Therefore, the success rate of active detection is low

Images