Network asset topology identification method based on flow perception

Abstract

The invention discloses a network asset topology identification method based on flow perception. The method comprises active flow detection and passive flow detection. The active flow detection comprises the following steps: S1, collecting the survival condition of a port; S2, sending a protocol detection packet; S3, acquiring port response information; S4, extracting equipment proprietary information, and matching the equipment proprietary information with the manufacturer information; S5, establishing an equipment fingerprint library; S6, establishing a network asset topological graph, wherein the passive flow detection comprises the following steps: S1, deploying a bypass flow mirror image; S2, collecting two-layer broadcast communication and three-layer IP communication messages; S3, loading a filtering rule, and extracting a network asset fingerprint; S4, establishing a network asset fingerprint database; and S5, supplementing the topological graph. According to the invention, active flow detection and passive flow detection are combined, so that a network asset detection result is more accurate and comprehensive; meanwhile, network asset change warning is set, so that the accuracy of the network asset fingerprint database is ensured, and the use safety of network assets is improved.

Description

technical field [0001] The invention relates to the technical field of network asset identification, in particular to a network asset topology identification method based on flow perception. Background technique [0002] Network assets are mainly various devices used in computer (or communication) networks. It mainly includes network equipment (routing, switching, etc.) and security equipment (firewall, etc.). At present, a large number of devices exposed on the Internet have become the first choice for attackers to launch large-scale DDoS attacks. If we capture the maliciously used IoT devices, And have accurately identified these devices, then you can search for all devices of this type exposed on the Internet through fingerprints, list these devices as key observation objects, and reduce the impact of future attacks through pre-prevention strategies influences. Network security risk assessment begins with the identification of network assets, so the ability to accuratel...

AI Technical Summary

Problems solved by technology

However, the active scanning method is used to detect surviving port records, and the identification method is relatively simple, and this method has some defects and deficiencies, such as the problem of identification of cross-network devices, the impact of link protection devices, etc., and the possibility of under-reporting of network assets , while active scanning takes up network resources, causing a large burden on the use of the network

Images