Network asset attribute information identification method and device

Abstract

The invention aims to provide the method and the device for automatically and accurately identifying the type and the attribute information of the network assets. Firstly, the asset type is identified through active detection, then the flow data of the asset is obtained, the flow feature corresponding to the asset type is extracted, the flow feature is matched with the preset attribute identification rule, and finally the attribute identification result is output, so that the pertinence of identifying attribute information through flow feature matching can be improved; all flows of the assets do not need to be matched; the attribute recognition rule can be added in a self-defined mode, and a condition group formed by multiple conditions and multi-layer condition nesting are allowed to be created, so that the method can be suitable for complex logic judgment; and the identification conditions with different priorities can also be suitable for different identification scenes. The asset information is obtained by analyzing the collected network traffic, so that the influence on the operation of the target network is small, and no additional network traffic is inserted; the network assets protected by the safety equipment can be detected; and long-term historical data accumulation is facilitated, so that the network asset development and change process can be mastered.

Description

Technical Field

[0001] The present invention belongs to the technical field of network equipment information identification, and in particular, relates to a method for identifying network asset attribute information and a device applying the method. Background Art

[0002] With the development of communication and network technology, computer hosts and network equipment have gradually become important information carriers and transmission channels for enterprises, governments and various organizations. However, while enjoying the convenience brought by computers and networks, increasingly serious security issues have become an urgent problem facing every unit and enterprise.

[0003] Many security risks actually come from within the organization. Especially for some units with high security and confidentiality requirements, such as government departments, military units, scientific research institutes, financial institutions, etc., how to timely discover users' arbitrary modification of internal computers, unauthorized access, information leakage and other illegal behaviors, as well as tracking and collecting evidence of related events, is an important means to solve the computer and network security within the organization.

[0004] Therefore, enhancing product asset exposure detection and automatic identification of asset attributes, and accurately and comprehensively identifying network assets are the prerequisites for effective monitoring and management of network assets, and are also the basis for further threat analysis. Summary of the invention

[0005] In view of the above background, the present invention aims to provide a method and apparatus for automatically and accurately identifying network asset types and attribute information.

[0006] In a first aspect, a method for identifying network asset attribute information is proposed, comprising: Extract the target type information from the asset's response data to the detection package, and match it with the asset type reference library. If the match is successful, output the identification result, otherwise add the asset to the unidentified list; Collect the traffic information of the identified type of assets, extract the attribute traffic characteristics, match them with the attribute rules corresponding to the type of assets, and output the identification results according to the rule definition.

[0007] Preferably, the above-mentioned attribute rules include built-in rules and custom rules, and the rule content includes outputting attribute judgment results according to preset logical judgment conditions, and the logical judgment conditions include if the preset traffic characteristics are met, the attribute judgment results include the attributes of the asset.

[0008] Furthermore, the above custom rules include: Create identification conditions. If you need to configure at least two layers of logical judgment, you can first create a condition group and then add identification conditions to the newly added condition group. Configure identification conditions, including configuring identification objects, the value of current identification conditions, and the priority of current identification conditions; Configuring the judgment logic includes configuring the and / or relationship between multiple identification conditions.

[0009] Preferably, the above-mentioned attribute rules include: according to each attribute dimension of the asset type, when the traffic characteristics meet the preset conditions, it is considered to meet the corresponding attributes. Further, the attribute rules of the server include that when the number of IPs accessed using the corresponding protocol is greater than a preset threshold, the server is considered to have the protocol attribute.

[0010] Furthermore, if at least two levels of logical judgment are configured, the deepest level of conditional group is first logically judged, and then nested upwards in sequence.

[0011] Also, when an asset meets at least two asset attribute judgment conditions at the same time, the custom judgment condition takes precedence over the built-in judgment condition, and the high-priority condition in the custom condition takes precedence over the low-priority condition.

[0012] Preferably, the traffic of assets in the unidentified list is collected. If the asset type can be identified through the matching results of the asset attribute traffic characteristics and the attribute rules, the asset is removed from the unidentified list, and the asset type information is extracted and added to the asset type benchmark library.

[0013] In a second aspect, a device for identifying network asset attribute information is provided, the device comprising: The type recognition module is used to extract the target type information from the asset's response data to the detection package and match it with the asset type reference library. If the match is successful, the recognition result is output, otherwise the asset is added to the unrecognized list; The attribute recognition module is used to collect the flow information of the identified type of assets, extract the attribute flow characteristics, match them with the attribute rules corresponding to the type of assets, and output the recognition results according to the rule definition.

[0014] Preferably, the above-mentioned attribute recognition module, the custom attribute rule includes: creating recognition conditions, if at least two layers of logical judgment need to be configured, a condition group can be created first, and then the recognition conditions can be added to the newly added condition group; configuring the recognition conditions, including configuring the recognition object, the value of the current recognition condition and the priority of the current recognition condition; configuring the judgment logic, including configuring the and / or relationship between multiple recognition conditions; Also, if the custom rule is configured with at least two levels of logical judgment, the deepest level of condition group is first logically judged, and then nested upwards in sequence.

[0015] Furthermore, when an asset meets at least two asset attribute judgment conditions at the same time, the custom judgment condition takes precedence over the built-in judgment condition, and the high-priority condition in the custom condition takes precedence over the low-priority condition.

[0016] The present invention adopting the above technical solution has at least the following beneficial effects: first, the asset type is identified through active detection, and then the flow data of the asset is obtained and the flow characteristics corresponding to the asset type are extracted, which are matched with the preset attribute identification rules, and finally the attribute identification results are output, which can improve the pertinence of identifying attribute information through flow characteristic matching, without matching all flows of the asset; and the attribute identification rules can be added in a customized way, and allow the creation of multiple conditions to form condition groups and multi-layer condition nesting, which can be applied to complex logical judgments; identification conditions of different priorities can also be applied to different identification scenarios. Asset information is obtained by analyzing the collected network traffic, which has little impact on the operation of the target network and no additional network traffic is inserted; and it also has the ability to detect network assets protected by security equipment; it is convenient to accumulate long-term historical data, so as to grasp the process of development and change of network assets. Implementation

[0017] The present application is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the present application.

[0018] First, some of the technical terms involved are explained.

[0019] The definition of asset fingerprint is a collection of attribute information describing an asset, including but not limited to device type, device manufacturer, system information (such as operating system version information, device type information, system name, manufacturer information, etc.), port information (remote port information opened by the system), service information (services running in real time in the system, such as rsync, DHCP service, etc.), middleware information (application middleware, such as Tomcat, Apache ActiveMQ, MySQL, etc.), program application framework information (framework used for program development or application, such as Apache Struts, Spring Framework, etc.), application software information (application software currently running in the system, such as Web application WordPress, system application OpenSSH, etc.), etc.

[0020] Nmap detection is a typical representative of network asset detection tools based on response protocol stack fingerprints. This tool sends SYN packets and constructed packets of other layers of protocols (IP, UDP, ICMP) to the target assets, and performs host discovery and identification of ports, services, operating systems, etc. based on the characteristics of the response packets.

[0021] In practice, type-related information can usually be identified more accurately using active detection, but for other attribute information besides type, active detection is difficult to achieve target asset information identification through customized methods, is not targeted, and has low efficiency.

[0022] The inventors have found in practice that assets of the same type often have similar or related attribute information, and the recognition efficiency can be improved by rule matching. Therefore, an embodiment of a method for identifying network asset attribute information is proposed below, including: Extract the target type information from the asset's response data to the detection package, and match it with the asset type reference library. If the match is successful, output the identification result, otherwise add the asset to the unidentified list; Collect the traffic information of the identified type of assets, extract the attribute traffic characteristics, match them with the attribute rules corresponding to the type of assets, and output the identification results according to the rule definition.

[0023] Preferably, the above-mentioned attribute rules include built-in rules and custom rules, and the rule content includes outputting attribute judgment results according to preset logical judgment conditions, and the logical judgment conditions include if the preset traffic characteristics are met, the attribute judgment results include the attributes of the asset.

[0024] Furthermore, the above custom rules include: Create identification conditions. If you need to configure at least two layers of logical judgment, you can first create a condition group and then add identification conditions to the newly added condition group. Configure identification conditions, including configuring identification objects, the value of current identification conditions, and the priority of current identification conditions; Configuring the judgment logic includes configuring the and / or relationship between multiple identification conditions.

[0025] Preferably, the above-mentioned attribute rules include: according to each attribute dimension of the asset type, when the traffic characteristics meet the preset conditions, it is considered to meet the corresponding attributes. Further, the attribute rules of the server include that when the number of IPs accessed using the corresponding protocol is greater than a preset threshold, the server is considered to have the protocol attribute.

[0026] Furthermore, if at least two levels of logical judgment are configured, the deepest level of conditional group is first logically judged, and then nested upwards in sequence.

[0027] Also, when an asset meets at least two asset attribute judgment conditions at the same time, the custom judgment condition takes precedence over the built-in judgment condition, and the high-priority condition in the custom condition takes precedence over the low-priority condition.

[0028] Preferably, the traffic of assets in the unidentified list is collected. If the asset type can be identified through the matching results of the asset attribute traffic characteristics and the attribute rules, the asset is removed from the unidentified list, and the asset type information is extracted and added to the asset type benchmark library.

[0029] On the other hand, an embodiment of a network asset attribute information identification device is also proposed, which specifically includes: The type recognition module is used to extract the target type information from the asset's response data to the detection package and match it with the asset type reference library. If the match is successful, the recognition result is output, otherwise the asset is added to the unrecognized list; The attribute recognition module is used to collect the flow information of the identified type of assets, extract the attribute flow characteristics, match them with the attribute rules corresponding to the type of assets, and output the recognition results according to the rule definition.

[0030] Preferably, the above-mentioned attribute recognition module, the custom attribute rule includes: creating recognition conditions, if at least two layers of logical judgment need to be configured, a condition group can be created first, and then the recognition conditions can be added to the newly added condition group; configuring the recognition conditions, including configuring the recognition object, the value of the current recognition condition and the priority of the current recognition condition; configuring the judgment logic, including configuring the and / or relationship between multiple recognition conditions; Also, if the custom rule is configured with at least two levels of logical judgment, the deepest level of condition group is first logically judged, and then nested upwards in sequence.

[0031] Furthermore, when an asset meets at least two asset attribute judgment conditions at the same time, the custom judgment condition takes precedence over the built-in judgment condition, and the high-priority condition in the custom condition takes precedence over the low-priority condition.

[0032] The embodiment of the present invention adopting the above technical solution first identifies the asset type through active detection, and then obtains the flow data of the asset and extracts the flow characteristics corresponding to the asset type, matches it with the preset attribute identification rules, and finally outputs the attribute identification result, which can improve the pertinence of identifying attribute information through flow characteristic matching, without matching all the flow of the asset; and the attribute identification rules can be added in a customized way, and allow the creation of multiple conditions to form condition groups and multi-layer condition nesting, which can be applied to complex logical judgments; identification conditions of different priorities can also be applied to different identification scenarios. Asset information is obtained by analyzing the collected network traffic, which has little impact on the operation of the target network and no additional network traffic is inserted; and it also has the ability to detect network assets protected by security equipment; it is convenient to accumulate long-term historical data, so as to grasp the process of network asset development and change.

[0033] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0034] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for identifying network asset attribute information, characterized in that: include: Extract the target type information from the asset's response data to the detection package, and match it with the asset type reference library. If the match is successful, output the identification result, otherwise add the asset to the unidentified list; Collect the traffic information of the identified type of assets, extract the attribute traffic characteristics, match them with the attribute rules corresponding to this type of assets, and output the identification results according to the rule definition.

2. The asset attribute identification method according to claim 1, characterized in that: The attribute rules include built-in rules and custom rules. The rule content includes outputting attribute judgment results according to preset logical judgment conditions. The logical judgment conditions include if the preset traffic characteristics are met, the attribute judgment results include the attributes of the asset.

3. The asset attribute identification method according to claim 2, characterized in that: The custom rules include: Create identification conditions. If you need to configure at least two layers of logical judgment, you can first create a condition group and then add identification conditions to the newly added condition group. Configure identification conditions, including configuring identification objects, the value of current identification conditions, and the priority of current identification conditions; Configuring the judgment logic includes configuring the and / or relationship between multiple identification conditions.

4. The asset attribute identification method according to claim 3, characterized in that: The attribute rules include: according to each attribute dimension of the asset type, when the traffic characteristics meet the preset conditions, it is considered to meet the corresponding attributes.

5. The asset attribute identification method according to claim 4, characterized in that: The attribute rule of the server includes that when the number of IPs accessed using the corresponding protocol is greater than a preset threshold, the server is considered to have the protocol attribute.

6. The asset attribute identification method according to claim 3, characterized in that: If at least two levels of logical judgment are configured, the deepest level of conditional group will be logically judged first, and then nested upwards in sequence.

7. The asset attribute identification method according to claim 5, characterized in that: When an asset meets at least two asset attribute judgment conditions at the same time, the custom judgment condition takes precedence over the built-in judgment condition, and the high-priority condition in the custom condition takes precedence over the low-priority condition.

8. The asset attribute identification method according to claim 1, characterized in that: Collect the traffic of assets in the unidentified list. If the asset type can be identified through the matching results of the asset attribute traffic characteristics and attribute rules, the asset will be removed from the unidentified list, and the asset type information will be extracted and added to the asset type benchmark library.

9. A device for identifying network asset attribute information, characterized in that: The device comprises: The type recognition module is used to extract the target type information from the asset's response data to the detection package and match it with the asset type reference library. If the match is successful, the recognition result is output, otherwise the asset is added to the unrecognized list; The attribute recognition module is used to collect the flow information of the identified type of assets, extract the attribute flow characteristics, match them with the attribute rules corresponding to the type of assets, and output the recognition results according to the rule definition.

10. The device for identifying network asset attribute information according to claim 9, characterized in that: The attribute recognition module and the custom attribute rules include: creating recognition conditions. If at least two layers of logical judgment need to be configured, a condition group can be created first, and then the recognition conditions can be added to the newly added condition group; configuring recognition conditions, including configuring the recognition object, the value of the current recognition condition, and the priority of the current recognition condition; configuring judgment logic, including configuring the AND / OR relationship between multiple recognition conditions; If the custom rule configuration has at least two layers of logical judgment, the deepest condition group is first logically judged, and then nested upwards in sequence; Furthermore, when an asset meets at least two asset attribute judgment conditions at the same time, the custom judgment condition takes precedence over the built-in judgment condition, and the high-priority condition in the custom condition takes precedence over the low-priority condition.