Method and system for processing fingerprints of intranet equipment

Abstract

The invention discloses an intranet equipment fingerprint processing method and system. The method comprises the following steps: acquiring service response data, equipment fingerprint data, a response data sequence, scanning data and picture information of target equipment from a pre-established communication link; analyzing and processing the data by using a large model, namely identifying service response data, and acquiring target identification information of the equipment; generating a prediction analysis list through vulnerability risk analysis of the equipment fingerprint data; performing configuration analysis on the equipment response data sequence to obtain configuration information; comparing the picture information to determine fingerprint information of the equipment; identifying an abnormal mode according to the scanning data; and inputting the identification information, the prediction analysis list, the fingerprint data and the abnormal mode into the large model, predicting an attack path, and integrating all data to generate a security assessment report. Through cooperation of a cloud server technology and a large model, the problems of complex deployment, inaccurate identification, lack of vulnerability prediction and the like are solved, and the overall security protection efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and system for processing fingerprints of intranet devices. Background Art

[0002] Network device fingerprinting is the process of identifying and distinguishing different devices by analyzing their characteristics (such as operating system, hardware model, service ports, and application programs). As networks continue to expand and the number of device types and varieties continues to increase, manual identification and management of these devices has become extremely difficult. Therefore, leveraging new technologies to improve the accuracy and efficiency of device identification is a hot topic in current network security research.

[0003] Traditional fingerprinting methods rely on scanning and analyzing device response data on the network, but this approach often suffers from poor accuracy, low efficiency, and susceptibility to attacks and interference. Furthermore, traditional methods fail to automatically generate actionable security reinforcement recommendations based on specific vulnerabilities and security threats. Further manual analysis and remediation solutions are still required, reducing the efficiency of the overall security protection process. Summary of the Invention

[0004] Based on the above-mentioned deficiencies of the prior art, the present application provides a method and system for processing fingerprints of intranet devices to solve the problem that the prior art reduces the efficiency of the overall security protection process.

[0005] In order to achieve the above objectives, this application provides the following technical solutions:

[0006] The first aspect of the present application provides a method for processing an intranet device fingerprint, comprising:

[0007] Obtaining target information of a target device from a pre-established communication link; wherein the target information includes at least service response data, device fingerprint data, device response data sequence, scan data, and image information;

[0008] Identifying the service response data using a large model to obtain target identification information of the target device;

[0009] Performing vulnerability risk analysis on the device fingerprint data using the large model to obtain a prediction analysis list;

[0010] Performing configuration analysis on the device response data sequence using the large model to obtain configuration information of the target device;

[0011] Comparing the image information with the large model to obtain fingerprint confirmation information of the target device;

[0012] Determining an abnormal pattern of the target device based on the scan data, and inputting the identification information, the prediction analysis list, the fingerprint determination information, and the abnormal pattern into the large model to predict an attack path;

[0013] The identification information, the prediction analysis list, the abnormal pattern, the configuration information and the attack path are integrated using the large model to obtain a security assessment report.

[0014] Optionally, in the above-mentioned method for processing the fingerprint of an intranet device, the method for establishing the communication link includes:

[0015] Obtaining a secure remote connection command and executing the secure remote connection command on the intranet client to establish a reverse tunnel between the intranet client and the cloud server;

[0016] Configuring traffic forwarding rules on the cloud server according to the reverse tunnel;

[0017] Building a communication link based on the reverse tunnel and the traffic forwarding rule;

[0018] or,

[0019] Obtaining a first target secure remote connection command and a second target secure remote connection command, and executing the first target secure remote connection command on the intranet client to map the connection service port of the intranet client to the cloud server;

[0020] After the mapping is completed, executing the second target secure remote connection command on the cloud server to establish a proxy server and configure target traffic forwarding rules;

[0021] A communication link is established based on the proxy server and the target traffic forwarding rule.

[0022] Optionally, in the above-mentioned method for processing the fingerprint of an intranet device, the step of using a large model to identify the service response data to obtain target identification information of the target device includes:

[0023] Calling the Internet mapping platform through the big model to identify the target device according to the service response data to obtain identification information;

[0024] Searching the database for a device that is consistent with or similar to the identification information;

[0025] If there is a device in the database that is consistent with or similar to the identification information, obtain the fingerprint information of the device;

[0026] matching the identification information with the fingerprint information using the large model;

[0027] If the identification information and the fingerprint information match successfully, the identification information and the fingerprint information are fused using the large model to obtain target identification information of the target device;

[0028] If there is no device consistent with or similar to the identification information in the database, or the identification information and the fingerprint information fail to match, the identification information is used as the target identification information of the target device.

[0029] Optionally, in the above-mentioned method for processing intranet device fingerprints, the step of performing vulnerability risk analysis on the device fingerprint data using the large model to obtain a prediction analysis list includes:

[0030] Using the large model to search for historical vulnerabilities of the target device from a vulnerability database based on the device fingerprint data;

[0031] Analyzing the historical vulnerabilities using the large model to obtain vulnerability risks of the target device;

[0032] Based on the vulnerability risks, a predictive analysis list is generated.

[0033] Optionally, in the above-mentioned method for processing the fingerprint of an intranet device, the comparing the image information with the large model to obtain the fingerprint determination information of the target device includes:

[0034] Extracting the configuration interface image of the target device from the image information, and searching for the configuration image of the target device on the Internet;

[0035] Comparing the configuration interface image with the configuration image to see if they are consistent;

[0036] If the configuration interface image is consistent with the configuration image, the image information of the target device is used as fingerprint determination information.

[0037] Optionally, in the above-mentioned method for processing the fingerprint of an intranet device, determining the abnormal pattern of the target device based on the scanning data includes:

[0038] Obtaining baseline data of the target device from a baseline library;

[0039] Comparing the scan data with the baseline data to determine whether there is inconsistent target data;

[0040] If there is inconsistent target data between the scan data and the baseline data, identifying abnormal information of the target device based on the target data;

[0041] An abnormality pattern of the target device is determined according to the abnormality information.

[0042] Optionally, the above-mentioned method for processing the fingerprint of an intranet device further includes:

[0043] Obtaining the prediction analysis list and the abnormal pattern;

[0044] The prediction analysis list and the abnormal pattern are input into the large model to obtain the security policy of the target device.

[0045] A second aspect of the present application provides a system for processing intranet device fingerprints, including:

[0046] An information acquisition unit, configured to acquire target information of a target device from a pre-established communication link; wherein the target information includes at least service response data, device fingerprint data, device response data sequence, scan data, and image information;

[0047] an identification unit, configured to identify the service response data using a large model to obtain target identification information of the target device;

[0048] a vulnerability analysis unit, configured to perform vulnerability risk analysis on the device fingerprint data using the large model to obtain a prediction analysis list;

[0049] a configuration analysis unit, configured to perform configuration analysis on the device response data sequence using the large model to obtain configuration information of the target device;

[0050] a comparison unit, configured to compare the image information with the large model to obtain fingerprint confirmation information of the target device;

[0051] a pattern determination unit, configured to determine an abnormal pattern of the target device based on the scan data, and input the identification information, the prediction analysis list, the fingerprint determination information, and the abnormal pattern into the large model to predict an attack path;

[0052] An integration unit is used to integrate the identification information, the prediction analysis list, the abnormal pattern, the configuration information and the attack path using the large model to obtain a security assessment report.

[0053] Optionally, the above-mentioned intranet device fingerprint processing system further includes:

[0054] a first command acquisition unit, configured to acquire a secure remote connection command and execute the secure remote connection command on the intranet client to establish a reverse tunnel between the intranet client and the cloud server;

[0055] a rule configuration unit, configured to configure traffic forwarding rules on the cloud server according to the reverse tunnel;

[0056] A first construction unit is configured to construct a communication link based on the reverse tunnel and the traffic forwarding rule;

[0057] or,

[0058] a second command acquisition unit, configured to acquire a first target secure remote connection command and a second target secure remote connection command, and execute the first target secure remote connection command on the intranet client to map the connection service port of the intranet client to the cloud server;

[0059] an execution unit, configured to execute the second target secure remote connection command on the cloud server after the mapping is completed, so as to establish a proxy server and configure target traffic forwarding rules;

[0060] The second construction unit is configured to construct a communication link based on the proxy server and the target traffic forwarding rule.

[0061] Optionally, in the above-mentioned intranet device fingerprint processing system, the identification unit includes:

[0062] An identification subunit is configured to call an Internet mapping platform through a large model to identify the target device according to the service response data and obtain identification information;

[0063] A first search unit is used to search a database for a device that is consistent with or similar to the identification information;

[0064] a fingerprint obtaining unit, configured to obtain fingerprint information of a device if a device that is consistent with or similar to the identification information exists in the database;

[0065] a matching unit, configured to match the identification information with the fingerprint information using the large model;

[0066] a fusion unit, configured to fuse the identification information and the fingerprint information using the large model if the identification information and the fingerprint information match successfully, to obtain target identification information of the target device;

[0067] The first unit is configured to use the identification information as target identification information of the target device if there is no device consistent with or similar to the identification information in the database, or if the identification information and the fingerprint information fail to match.

[0068] Optionally, in the above-mentioned intranet device fingerprint processing system, the vulnerability analysis unit includes:

[0069] A second search unit is configured to use the large model to search for historical vulnerabilities of the target device from a vulnerability database according to the device fingerprint data;

[0070] an analyzing unit, configured to analyze the historical vulnerabilities using the large model to obtain vulnerability risks of the target device;

[0071] A list generating unit is used to generate a prediction analysis list based on the vulnerability risk.

[0072] Optionally, in the above-mentioned intranet device fingerprint processing system, the comparison unit includes:

[0073] an extraction unit, configured to extract the configuration interface image of the target device from the image information, and search for the configuration image of the target device on the Internet;

[0074] An image comparison unit, configured to compare the configuration interface image with the configuration image to determine whether they are consistent;

[0075] The second serving unit is configured to use the image information of the target device as fingerprint determination information if the configuration interface image is consistent with the configuration image.

[0076] Optionally, in the above-mentioned intranet device fingerprint processing system, the pattern determination unit includes:

[0077] A data acquisition unit, configured to acquire the baseline data of the target device from a baseline library;

[0078] a data comparison unit, configured to compare the scan data with the baseline data to determine whether there is inconsistent target data;

[0079] an information identification unit, configured to identify abnormal information of the target device based on the target data if there is inconsistent target data between the scan data and the baseline data;

[0080] A determining unit is configured to determine an abnormality pattern of the target device according to the abnormality information.

[0081] Optionally, the above-mentioned intranet device fingerprint processing system further includes:

[0082] an acquiring unit, configured to acquire the prediction analysis list and the abnormal pattern;

[0083] An input unit is used to input the prediction analysis list and the abnormal pattern into the large model to obtain the security policy of the target device.

[0084] The present application provides a method for processing intranet device fingerprints, which obtains target information of a target device from a pre-established communication link, wherein the target information includes at least service response data, device fingerprint data, a device response data sequence, scan data, and image information. Secondly, a large model is used to identify the service response data to obtain target identification information of the target device. Then, the large model is used to perform vulnerability risk analysis on the device fingerprint data to obtain a prediction analysis list. Then, the large model is used to perform configuration analysis on the device response data sequence to obtain configuration information of the target device. Subsequently, the large model is used to compare the image information to obtain fingerprint determination information of the target device. Then, based on the scan data, the abnormal pattern of the target device is determined, and the identification information, prediction analysis list, fingerprint determination information, and abnormal pattern are input into the large model to predict the attack path. Finally, the large model is used to integrate the identification information, prediction analysis list, abnormal pattern, configuration information, and attack path to obtain a security assessment report. Through the synergistic integration of cloud server technology and large-scale model intelligent analysis capabilities, an overall technical architecture for intranet device fingerprint recognition and security assessment has been constructed. This can effectively solve problems such as complex deployment, low recognition accuracy, and lack of vulnerability prediction and analysis capabilities in existing technical solutions, thereby improving the efficiency of the overall security protection process. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0086] Figure 1 A schematic diagram of the structure of a security assessment system for an intranet device fingerprint recognition machine that integrates a cloud server and a large model is provided for an embodiment of the present application;

[0087] Figure 2 A flowchart of a method for processing intranet device fingerprints provided in another embodiment of the present application;

[0088] Figure 3 A flowchart of a method for acquiring target identification information provided in another embodiment of the present application;

[0089] Figure 4 A schematic diagram of a process for generating a prediction analysis list provided in another embodiment of the present application;

[0090] Figure 5 A flowchart of a method for determining fingerprint information provided in another embodiment of the present application;

[0091] Figure 6 A flowchart of a method for determining an abnormality mode provided in another embodiment of the present application;

[0092] Figure 7 A flowchart of a method for obtaining a security policy provided in another embodiment of the present application;

[0093] Figure 8 A schematic diagram of an execution flow provided in another embodiment of the present application;

[0094] Figure 9 A schematic diagram of the structure of a system for processing intranet device fingerprints provided in another embodiment of the present application. DETAILED DESCRIPTION

[0095] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0096] In this application, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0097] An embodiment of the present application provides a method for processing intranet device fingerprints, which is applied to an intranet device fingerprint recognition machine security assessment system that integrates a cloud server and a large model, that is, a system for processing intranet device fingerprints to solve the problem that the existing technology reduces the efficiency of the overall security protection process.

[0098] Alternatively, as Figure 1 As shown, an embodiment of the present application provides an intranet device fingerprint recognition machine security assessment system that integrates a cloud server and a large model, including a public network area, an intranet area, and an analysis layer domain.

[0099] Among them, the public network area includes the cloud server (hostA): it has a public network IP, provides data forwarding, communication channel establishment and large model interface calling.

[0100] The intranet zone includes the intranet client (hostB) and the target device (hostC).

[0101] Intranet client (hostB): An intranet terminal device with basic permissions, used to proxy intranet traffic.

[0102] Target device (hostC): Other intranet devices to be scanned and analyzed. No special configuration is required.

[0103] The analysis layer domain includes a large model server (hostD, which can be deployed together with hostA): it runs large language models (such as the GPT series) and multimodal analysis models, and is responsible for in-depth data analysis, fusion, and report generation.

[0104] The large model server includes a large language model analysis module, a reference module for the data platform, an attack path and evaluation generation module, and a report and suggestion generation module.

[0105] Based on the above-mentioned cloud server and large model integrated intranet device fingerprint recognition machine security assessment system, the embodiment of the present application provides a method for processing intranet device fingerprints, such as Figure 2 As shown, the specific steps include:

[0106] S201: Acquire target information of a target device from a pre-established communication link.

[0107] Specifically, first, ensure that the communication link is successfully established and stable. Once the communication link is established, the public network and the intranet send information requests to the target device. These requests typically follow specific communication protocols, such as HTTP, Modbus, and MQTT. After receiving the request, the target device returns the target information according to predefined protocol rules. This target information can include service response data, device fingerprint data, device response data sequence, scan data, and image information.

[0108] Optionally, before obtaining the target information of the target device from the pre-established communication link, it is necessary to establish a communication link. Therefore, in an embodiment of the present application, a method for establishing a communication link is also provided, which specifically includes the following steps:

[0109] Obtain a secure remote connection command and execute it on the intranet client to establish a reverse tunnel between the intranet client and the cloud server.

[0110] Specifically, first obtain the SSH command (secure remote connection command) on the intranet client (hostB), and execute the SSH command on the intranet client to establish a reverse tunnel, which is suitable for fixed-point scanning of the service port of a fixed target device.

[0111] The specific SSH command is:

[0112] ssh -R portA:hostC:portC root@hostA-N where:

[0113] portA is the mapping port on the cloud server;

[0114] hostC is the intranet IP address of the target device;

[0115] portC is the service port of the target device to be scanned;

[0116] root@hostA is the login credential for the cloud server;

[0117] The -N parameter indicates that the remote command is not executed.

[0118] Configure traffic forwarding rules on the cloud server based on the reverse tunnel.

[0119] As you can understand, after establishing a reverse tunnel, you need to configure iptables (a Linux firewall) or firewalld (on newer Linux systems) on the cloud server, specifically traffic forwarding rules, to forward external access requests to the mapped port, port A. Assume that an external request accesses host A through port A and is then forwarded to port C on the target device (host C) through the SSH tunnel.

[0120] Specifically, when setting up iptables rules, you need to forward traffic from portA, which is accessed externally, to the local port on hostA, and then forward it to the port on the target device (hostC) on hostB through the reverse tunnel.

[0121] Build communication links based on reverse tunneling and traffic forwarding rules.

[0122] It is understandable that after the reverse tunnel is established and the traffic forwarding rules are configured, the traffic forwarding rules are placed in the reverse tunnel for use, and a communication link can be obtained.

[0123] It should be noted that when the target device or port needs to be changed, it can be achieved by modifying the parameters in the SSH command: ssh -R portB:hostC:portC root@hostA -N, where hostC is the new target address.

[0124] or,

[0125] Obtain a first target secure remote connection command and a second target secure remote connection command, and execute the first target secure remote connection command on the intranet client to map the connection service port of the intranet client to the cloud server.

[0126] It can be understood that in the embodiment of the present application, in addition to constructing a communication link by establishing a reverse tunnel, a SOCKS5 proxy service can also be established using an SSH tunnel to achieve more flexible intranet access control and thus obtain a communication link.

[0127] Specifically, you need to first obtain the first target secure remote connection command (SSH command) and the second target secure remote connection command, and execute the SSH command on the intranet client (hostB) to map the local SSH service port to the cloud server: ssh -R portA:localhost:22 root@hostA -N Where:

[0128] portA is the mapping port on the cloud server;

[0129] localhost:22 represents the SSH service that maps the intranet client;

[0130] The -N parameter indicates that the remote command is not executed.

[0131] When the mapping is completed, the second target secure remote connection command is executed on the cloud server to establish a proxy server and configure target traffic forwarding rules.

[0132] It is understandable that after executing the first target secure remote connection command (SSH command), it is necessary to execute the SSH command (second target secure remote connection command) on the cloud server (hostA) to establish a SOCKS5 proxy. The specific second target secure remote connection command is: ssh-D1080root@localhost-p portA -N, where: -D 1080 means to establish a SOCKS proxy on the local port 1080, -p portA specifies the port for connecting to the intranet client, and the -N parameter means not to execute the remote command.

[0133] After executing the second target secure remote connection command, you need to configure the traffic forwarding tool on the cloud server (hostA) to forward the network request to the target device through the SOCKS5 proxy.

[0134] Specifically, to forward traffic from the SOCKS5 proxy port of cloud server hostA to the target device (hostC), you need to configure iptables forwarding rules to ensure that traffic forwarded from the outside through the SOCKS5 proxy can correctly reach the target device.

[0135] Finally connect to the target device using SOCKS5 proxy.

[0136] On the client or other machine, you can set up a SOCKS5 proxy to forward traffic to the target device hostC through the proxy port of hostA.

[0137] For example, when using a browser, you can fill in the proxy settings:

[0138] SOCKS5 proxy address: hostA, port: portA.

[0139] Alternatively, if you use curl from the command line, you can use a SOCKS5 proxy with the following command:

[0140] curl --socks5 hostA:portA http: / / hostC:portC.

[0141] Build a communication link based on the proxy server and target traffic forwarding rules.

[0142] Specifically, after completing the configuration, you can test whether the proxy is successfully connected to hostC by accessing hostA:portA to know whether the communication link is successfully established. Use a browser or other client application to connect using the SOCKS5 proxy and check whether you can normally access the services on the target device.

[0143] In addition, when the target device is changed, only the destination address in the traffic forwarding rule needs to be adjusted.

[0144] S202: Use the large model to identify the service response data and obtain target identification information of the target device.

[0145] Specifically, the service response data is input into the big model, and the system and fingerprint version information of the target device is identified through the big model, and an online search is conducted for devices with similar fingerprint characteristics. Finally, the system and fingerprint version information of the target device and devices with similar fingerprint characteristics are integrated to obtain the target identification information of the target device.

[0146] Optionally, in another embodiment of the present application, a specific implementation of step S202 is as follows: Figure 3 As shown, the specific steps include:

[0147] S301. Call the Internet mapping platform through the large model to identify the target device according to the service response data to obtain identification information.

[0148] Specifically, the large model calls the APIs of Internet mapping platforms such as Shodan, FOFA, and ZoomEye. Generally, through the APIs of these platforms, requests can be sent and response data can be obtained.

[0149] 3. Device Identification

[0150] Based on the data provided by the surveying and mapping platform, the large model can identify the location, type, status and other information of the target device. After successfully identifying the response data, it can parse the data to extract identification information related to the target device, such as system and fingerprint version information.

[0151] S302: Search the database to see whether there is a device that is consistent with or similar to the identification information.

[0152] It should be noted that in order to improve the accuracy of device identification and resolve the problem of single fingerprint library recognition errors, it is necessary to search the Internet database to see whether there is a device that is consistent or similar to the identification information. If there is a device that is consistent or similar to the identification information in the database, step S303 is executed. If there is no device that is consistent or similar to the identification information in the database, step S307 is executed.

[0153] S303: Obtain fingerprint information of the device.

[0154] Specifically, when there is a device in the database that is consistent or similar to the identification information, it is necessary to use the relevant information of the device to match and integrate the target device for analysis in order to improve the accuracy of device identification. Therefore, it is necessary to obtain the fingerprint information of the device from the Internet database.

[0155] S304: Use the large model to match the identification information and fingerprint information.

[0156] Specifically, identification information and fingerprint information can be pre-processed to remove redundancy, format, and standardize them into an analyzable form to improve matching accuracy. Then, a machine learning model is used to predict or identify the match between the target device and the fingerprint information.

[0157] Optionally, to improve the accuracy and intelligence of matching, you can also: extract more meaningful features from identification information and fingerprint information, such as considering factors such as time and environment, or use deep neural networks (such as convolutional neural networks or recurrent neural networks) to learn more complex data patterns, or continuously optimize the model based on new data and feedback to improve the accuracy of real-time matching.

[0158] S305: Determine whether the identification information and the fingerprint information match successfully.

[0159] It is understood that if the identification information and the fingerprint information match successfully, step S306 is executed. If the identification information and the fingerprint information do not match successfully, step S307 is executed.

[0160] S306: Use the large model to fuse the identification information and the fingerprint information to obtain target identification information of the target device.

[0161] Specifically, when the identification information and the fingerprint information match successfully, it means that the identification information and the fingerprint information can be fused. Therefore, optionally, weighted fusion can be performed: different weights are assigned to the identification information and the fingerprint information respectively, and weighted according to the reliability and importance of the data.

[0162] Or through multimodal fusion: Multimodal fusion technology can be used to merge different data sources into a unified representation, so as to obtain target recognition information of the target device with higher accuracy.

[0163] S307: Use the identification information as target identification information of the target device.

[0164] It is understandable that when there is no device in the database that is consistent or similar to the identification information, or the identification information and fingerprint information do not match successfully, it means that there is no device on the Internet with the same or similar fingerprint characteristics. Therefore, the identification information can only be used as the target identification information of the target device for subsequent processing.

[0165] S203: Use the large model to perform vulnerability risk analysis on the device fingerprint data to obtain a prediction analysis list.

[0166] It is understandable that in order to identify potential vulnerability risks and enhance the foresight of security assessments, in an embodiment of the present application, a large model is used to analyze the correlation between device fingerprint data and historical vulnerability data, thereby realizing risk prediction of vulnerabilities.

[0167] Optionally, in another embodiment of the present application, a specific implementation of step S203 is as follows: Figure 4 As shown, the specific steps include:

[0168] S401. Use the large model to search for historical vulnerabilities of the target device from the vulnerability library based on the device fingerprint data.

[0169] It's understandable that the large model can use device fingerprint data to search for historical vulnerabilities corresponding to the target device from public vulnerability databases such as CVE and CNNVD, and can also search GitHub, exploit-db, and other vulnerability exploitation tools. CVE (Common Vulnerabilities and Exposures) is the world's most widely used public vulnerability database, providing information on known vulnerabilities in software and hardware.

[0170] CNNVD (China National Vulnerability Database): A vulnerability database specifically for China's network security, providing vulnerability information specific to the Chinese market.

[0171] Among them, device fingerprint data generally includes the device's hardware information (such as manufacturer, model, operating system version, etc.), the device's network characteristics (such as MAC address, IP address, protocol type), etc.

[0172] Specifically, you can query through the API interface provided by CVE and CNNVD.

[0173] S402: Analyze historical vulnerabilities using a large model to obtain vulnerability risks of target devices.

[0174] Specifically, historical vulnerabilities are fed into a large model. Using machine learning or deep learning algorithms, the large model is trained on these historical vulnerabilities to automatically identify potential vulnerability patterns. Based on the device's characteristics and environment, the large model can predict potential vulnerability risks. For example, based on historical data, the large model can determine whether the operating system or firmware version currently used by a device is vulnerable to a specific attack vector, thereby determining the vulnerability risk of the target device.

[0175] S403. Generate a prediction analysis list based on vulnerability risks.

[0176] It is understandable that vulnerability risk is used to generate a vulnerability risk prediction analysis list to help security teams or operation and maintenance personnel understand the current vulnerability risks of the device. This list usually includes the following information:

[0177] Vulnerability type: The possible vulnerability type (such as buffer overflow, privilege escalation, etc.).

[0178] Risk Level: Assess the risk level (high, medium, or low) based on the vulnerability's CVSS score and impact scope.

[0179] Vulnerability ID: corresponds to the CVE number or other vulnerability identifier.

[0180] Vulnerability Description: A brief description of each vulnerability.

[0181] Patch status: Is there a patch available and are there mitigations?

[0182] Recommended Action: For each vulnerability, provide a possible fix or mitigation.

[0183] S204: Use the large model to perform configuration analysis on the device response data sequence to obtain configuration information of the target device.

[0184] The response data sequence of the target device may come from a log, a monitoring system, etc. of the target device, and may include the operating status of the device.

[0185] Specifically, the device response data sequence can be preprocessed first, including data cleaning: removing noise, missing values and outliers, normalization / standardization: normalizing or standardizing data of different dimensions so that large models can better handle it, and time series processing: converting data into time series format to ensure the continuity and consistency of the time sequence.

[0186] To better predict the specific device configuration, features must be extracted from the processed device response data series, such as historical data trends, periodicity, and interaction effects. Finally, these extracted features are fed into a large model for configuration analysis. This large model can analyze the device's hardware configuration, such as CPU model, memory size, and hard disk configuration, as well as the device's software version, including operating system version, firmware version, and installed software packages. This data can then be integrated to obtain the target device's configuration information.

[0187] S205: Use the large model to compare the image information to obtain fingerprint confirmation information of the target device.

[0188] It is understandable that in order to improve the accuracy of fingerprint classification, a large model will be used to automatically identify the features of image information to obtain accurate fingerprint identification information.

[0189] Optionally, in another embodiment of the present application, a specific implementation of step S205 is as follows: Figure 5 As shown, the specific steps include:

[0190] S501: Extract a configuration interface image of a target device from the image information, and search for the configuration image of the target device on the Internet.

[0191] Specifically, the configuration interface image or device management page screenshot of the target device and the device log text are extracted from the image information and compared with the image information of the target device on the Internet to determine whether the target device being accessed is correct.

[0192] S502: Compare the configuration interface image and the configuration image to see if they are consistent.

[0193] Specifically, it is completed using the deep learning model contained in the large model, especially the visual Transformer or convolutional neural network. The model can efficiently extract the spatial features of the image and judge the similarity between the configuration interface image and the configuration image. Therefore, if the configuration interface image is consistent with the configuration image, it means that the similarity between the configuration interface image and the configuration image is high, so step S503 is executed.

[0194] Optionally, if the configuration interface image is inconsistent with the configuration image, it means that the similarity between the configuration interface image and the configuration image is low, that is, the accessed target device may be incorrect. At this time, the possibly incorrect information of the accessed target device needs to be used as fingerprint determination information.

[0195] S503: Use the image information of the target device as fingerprint determination information.

[0196] Specifically, when the configuration interface image is consistent with the configuration image, it indicates that the accessed target device is correct, and thus step S206 can be continued.

[0197] S206. Determine the abnormal pattern of the target device based on the scan data, and input the identification information, prediction analysis list, fingerprint determination information and abnormal pattern into the large model to predict the attack path.

[0198] It is understood that before identifying abnormal patterns in the target device, the scan data can be processed to remove irrelevant information or noise. Data cleaning methods (such as filling missing values and standardization) can be used to ensure data quality. By analyzing the processed scan data, normal and abnormal operating patterns can be identified. Specifically, by analyzing the behavior and status of the target device and combining it with the scan data, abnormal behavior that deviates from normal patterns can be identified. Anomalies may include unauthorized access, abnormal network traffic, device configuration changes, etc. Finally, the identification information, predictive analysis list, fingerprint determination information, and abnormal patterns are fed into a large model (such as a deep neural network or graph neural network). This input data can be analyzed and combined with a cybersecurity knowledge base to predict potential attack paths. The large model predicts potential attack paths based on the data analysis results and provides possible attack methods or security vulnerabilities.

[0199] Optionally, in another embodiment of the present application, a specific implementation method of determining the abnormal mode of the target device according to the scan data in step S206 is as follows: Figure 6 As shown, the specific steps include:

[0200] S601: Obtain baseline data of a target device from a baseline library.

[0201] Specifically, we first need to establish a baseline database of devices with normal behavior. The data stored in this database represents the data of devices without abnormalities, including the device's network behavior, system configuration, resource usage, port open status, service operation status, etc. By collecting data from devices under normal operating conditions, we can establish a reference standard for normal behavior.

[0202] Collect baseline data: Collect data from different devices and over different time periods about normal operations, including:

[0203] System logs: such as operating system logs, application logs, network traffic logs, etc.

[0204] Device configuration data: including network configuration, service settings, port status, etc.

[0205] Port scan data: scan open ports, service status and other information.

[0206] Therefore, in the implementation of this application, it is necessary to obtain the baseline data of the target device from the baseline library in advance to determine whether the target device has any abnormal situation.

[0207] S602: Compare the scan data with the baseline data to see if there is any inconsistent target data.

[0208] It is understandable that the configuration and status of devices are scanned regularly or in real time to obtain data such as port openness, service versions, network traffic, etc., and the current scan data is compared with the data in the baseline library to identify inconsistencies. For example: abnormal settings are found in the device configuration file, or the service port is not configured correctly, or the target device has an uncommon or high-risk port open, or sensitive information (such as passwords, keys, etc.) is leaked in places where it should not be exposed during the comparison process. In other words, the scan data is compared with the baseline data of normal behavior to determine whether there are any anomalies.

[0209] If there is inconsistent target data between the scan data and the baseline data, it indicates that the target device has an abnormality, so step S603 is executed.

[0210] Optionally, if the scan data and the baseline data have consistent target data, indicating that the target device has no abnormalities, the large model can be used to integrate the identification information, predictive analysis list and configuration information to obtain a security assessment report for the target device.

[0211] S603: Identify abnormal information of the target device according to the target data.

[0212] Specifically, when there is inconsistent target data between the scan data and the baseline data, it is necessary to conduct a comprehensive analysis combining multiple indicators, such as system resources, service status, network traffic, file changes, etc., so as to identify the target data and then identify abnormalities in the target device.

[0213] S604: Determine the abnormality pattern of the target device according to the abnormality information.

[0214] It is understandable that by integrating the identified anomaly information, the target's abnormal pattern can be determined. For example, performance anomalies: a sudden surge in CPU or memory usage may indicate that malware is running or the device is under attack; port anomalies: if the device opens an uncommon port, or a port that should not be open is accidentally enabled, it may mean a security vulnerability or attack; service anomalies: the sudden appearance of a new service or the abnormal termination of an existing service may be due to an attacker's intrusion or system misconfiguration; network anomalies: including traffic anomalies, packet loss, IP address changes, etc., may indicate that the device is remotely controlled or is under a DDoS attack; log anomalies: a large number of errors, failed login attempts, or other abnormal activities in the log usually indicate a security incident; abnormal configuration changes: unauthorized changes have occurred to the device configuration file, which may be caused by attackers exploiting vulnerabilities to change the configuration for further attacks.

[0215] S207. Use the big model to integrate the identification information, prediction analysis list, abnormal patterns, configuration information, and attack paths to obtain a security assessment report.

[0216] Specifically, the large language model has the characteristics of automatically integrating information and analyzing data, and can generate easy-to-understand and specific security assessment reports. The security assessment report is interactive, can personalize the analysis details online, and automatically generates authoritative and user-readable features. Therefore, in the embodiment of the present application, the large language model will be used to integrate and analyze the above-mentioned identification information, predictive analysis list, abnormal pattern, configuration information and attack path to obtain a security assessment report.

[0217] Optionally, in another embodiment of the present application, after obtaining the prediction analysis list and abnormal pattern, a security prompt strategy and preventive measures can be generated in a targeted manner. Therefore, another embodiment of the present application provides a method for generating a security strategy, such as Figure 7 As shown, the specific steps include:

[0218] S701. Obtain a prediction analysis list and abnormal patterns.

[0219] S702: Input the prediction analysis list and abnormal pattern into the large model to obtain the security policy of the target device.

[0220] Specifically, before inputting predictive analysis lists and anomaly patterns into the large model, they can be converted into a format that the machine learning model can process, typically as numerical and structured data. For example, a predictive analysis list might include historical device trend data (such as CPU usage, memory leaks, and network traffic anomalies), as well as the system's risk level.

[0221] Abnormal patterns: abnormal network traffic, high CPU usage, memory leaks, and other characteristics related to potential attack behaviors.

[0222] The converted predictive analysis list and abnormal patterns are then input into a large model (such as a deep learning model, machine learning classifier, or predictive model) for analysis. The large model processes the input data and generates a security policy suitable for the target device. This security policy typically includes the following:

[0223] Patch management: Provides patch and update recommendations for known vulnerabilities.

[0224] Security configuration: such as closing unnecessary ports, strengthening access control, and enhancing authentication mechanisms.

[0225] Network monitoring: It is recommended to enable stricter network traffic monitoring, especially alerts and response measures for abnormal traffic.

[0226] Anomaly detection: Set up more automated security alerts and protection policies to detect potential attack patterns, such as memory leaks and abnormal CPU usage.

[0227] Intrusion detection and prevention: Strengthen intrusion detection system (IDS) and firewall configuration to prevent malicious traffic.

[0228] For ease of understanding, the following describes the processing of intranet device fingerprints in this application using an execution flow. Figure 8 .

[0229] The present application provides a method for processing intranet device fingerprints, which obtains target information of a target device from a pre-established communication link, wherein the target information includes at least service response data, device fingerprint data, a device response data sequence, scan data, and image information. Secondly, a large model is used to identify the service response data to obtain target identification information of the target device. Then, the large model is used to perform vulnerability risk analysis on the device fingerprint data to obtain a prediction analysis list. Then, the large model is used to perform configuration analysis on the device response data sequence to obtain configuration information of the target device. Subsequently, the large model is used to compare the image information to obtain fingerprint determination information of the target device. Then, based on the scan data, the abnormal pattern of the target device is determined, and the identification information, prediction analysis list, fingerprint determination information, and abnormal pattern are input into the large model to predict the attack path. Finally, the large model is used to integrate the identification information, prediction analysis list, abnormal pattern, configuration information, and attack path to obtain a security assessment report. Through the synergistic integration of cloud server technology and large-scale model intelligent analysis capabilities, an overall technical architecture for intranet device fingerprint recognition and security assessment has been constructed. This can effectively solve problems such as complex deployment, low recognition accuracy, and lack of vulnerability prediction and analysis capabilities in existing technical solutions, thereby improving the efficiency of the overall security protection process.

[0230] Another embodiment of the present application provides a system for processing fingerprints of intranet devices, such as Figure 9 As shown, it includes the following units:

[0231] The information acquisition unit 901 is configured to acquire target information of a target device from a pre-established communication link, wherein the target information includes at least service response data, device fingerprint data, device response data sequence, scan data, and image information.

[0232] The identification unit 902 is used to identify the service response data using the large model to obtain target identification information of the target device.

[0233] The vulnerability analysis unit 903 is used to perform vulnerability risk analysis on the device fingerprint data using a large model to obtain a prediction analysis list.

[0234] The configuration analysis unit 904 is used to perform configuration analysis on the device response data sequence using the large model to obtain configuration information of the target device.

[0235] The comparison unit 905 is used to compare the image information using the large model to obtain fingerprint confirmation information of the target device.

[0236] The pattern determination unit 906 is used to determine the abnormal pattern of the target device based on the scan data, and input the identification information, prediction analysis list, fingerprint determination information and abnormal pattern into the large model to predict the attack path.

[0237] The integration unit 907 is used to integrate the identification information, the prediction analysis list, the abnormal pattern, the configuration information and the attack path using the large model to obtain a security assessment report.

[0238] It should be noted that the specific working process of the above modules in the embodiment of the present application can refer to steps S101 to S107 in the above method embodiment, and will not be repeated here.

[0239] Optionally, another embodiment of the present application provides a system for processing an intranet device fingerprint, further comprising:

[0240] The first command acquisition unit is used to acquire a secure remote connection command and execute the secure remote connection command on the intranet client to establish a reverse tunnel between the intranet client and the cloud server.

[0241] The rule configuration unit is used to configure traffic forwarding rules on the cloud server based on the reverse tunnel.

[0242] The first construction unit is configured to construct a communication link based on a reverse tunnel and traffic forwarding rules.

[0243] or,

[0244] The second command acquisition unit is used to acquire the first target secure remote connection command and the second target secure remote connection command, and execute the first target secure remote connection command on the intranet client to map the connection service port of the intranet client to the cloud server.

[0245] The execution unit is used to execute the second target secure remote connection command on the cloud server after the mapping is completed to establish a proxy server and configure target traffic forwarding rules.

[0246] The second construction unit is used to construct a communication link based on the proxy server and the target traffic forwarding rule.

[0247] Optionally, in another embodiment of the present application, in a system for processing an intranet device fingerprint, the identification unit 902 includes:

[0248] The identification subunit is used to call the Internet mapping platform through the large model to identify the target device according to the service response data and obtain identification information.

[0249] The first search unit is configured to search a database for a device that is consistent with or similar to the identification information.

[0250] The fingerprint acquisition unit is used to acquire the fingerprint information of the device if there is a device in the database that is consistent with or similar to the identification information.

[0251] The matching unit is used to match the identification information and the fingerprint information using the large model.

[0252] The fusion unit is used to fuse the identification information and the fingerprint information using the large model if the identification information and the fingerprint information match successfully, so as to obtain the target identification information of the target device.

[0253] The first unit is used to use the identification information as target identification information of the target device if there is no device consistent with or similar to the identification information in the database, or the identification information and the fingerprint information are not matched successfully.

[0254] Optionally, in another embodiment of the present application, in a system for processing an intranet device fingerprint, the vulnerability analysis unit 903 includes:

[0255] The second search unit is used to use the large model to search for historical vulnerabilities of the target device from the vulnerability library according to the device fingerprint data.

[0256] The analysis unit is used to analyze historical vulnerabilities using a large model to obtain the vulnerability risks of the target device.

[0257] The list generation unit is used to generate a prediction analysis list based on vulnerability risks.

[0258] Optionally, in another embodiment of the present application, in a system for processing an intranet device fingerprint, the comparison unit 905 includes:

[0259] The extraction unit is used to extract the configuration interface image of the target device from the image information and search for the configuration image of the target device from the Internet.

[0260] The image comparison unit is used to compare whether the configuration interface image is consistent with the configuration image.

[0261] The second serving unit is configured to use the image information of the target device as fingerprint determination information if the configuration interface image is consistent with the configuration image.

[0262] Optionally, in another embodiment of the present application, in a system for processing an intranet device fingerprint, the pattern determination unit 906 includes:

[0263] The data acquisition unit is used to obtain the baseline data of the target device from the baseline library.

[0264] The data comparison unit is used to compare the scan data with the baseline data to see if there is any inconsistent target data.

[0265] The information identification unit is used to identify abnormal information of the target device based on the target data if there is inconsistent target data between the scan data and the baseline data.

[0266] The determination unit is configured to determine an abnormality pattern of the target device according to the abnormality information.

[0267] Optionally, another embodiment of the present application provides a system for processing an intranet device fingerprint, further comprising:

[0268] The acquisition unit is used to obtain the prediction analysis list and abnormal patterns.

[0269] The input unit is used to input the prediction analysis list and abnormal pattern into the large model to obtain the security policy of the target device.

[0270] It should be noted that the specific working processes of the various modules provided in the above embodiments of the present application can refer to the corresponding steps in the above method embodiments, and will not be repeated here.

[0271] It should also be noted that the intranet device fingerprint processing system provided in the embodiment of the present application has the technical effects of any of the above embodiments, and the embodiment of the present application will not be described in detail here.

[0272] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0273] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing intranet device fingerprints, characterized in that: include: Obtaining target information of a target device from a pre-established communication link; wherein the target information includes at least service response data, device fingerprint data, device response data sequence, scan data, and image information; Identifying the service response data using a large model to obtain target identification information of the target device; Performing vulnerability risk analysis on the device fingerprint data using the large model to obtain a prediction analysis list; Performing configuration analysis on the device response data sequence using the large model to obtain configuration information of the target device; Comparing the image information with the large model to obtain fingerprint confirmation information of the target device; Determining an abnormal pattern of the target device based on the scan data, and inputting the identification information, the prediction analysis list, the fingerprint determination information, and the abnormal pattern into the large model to predict an attack path; The identification information, the prediction analysis list, the abnormal pattern, the configuration information and the attack path are integrated using the large model to obtain a security assessment report.

2. The method according to claim 1, characterized in that The method for establishing the communication link comprises: Obtaining a secure remote connection command and executing the secure remote connection command on the intranet client to establish a reverse tunnel between the intranet client and the cloud server; Configuring traffic forwarding rules on the cloud server according to the reverse tunnel; Building a communication link based on the reverse tunnel and the traffic forwarding rule; or, Obtaining a first target secure remote connection command and a second target secure remote connection command, and executing the first target secure remote connection command on the intranet client to map the connection service port of the intranet client to the cloud server; After the mapping is completed, executing the second target secure remote connection command on the cloud server to establish a proxy server and configure target traffic forwarding rules; A communication link is established based on the proxy server and the target traffic forwarding rule.

3. The method according to claim 1, characterized in that The using of the large model to identify the service response data to obtain target identification information of the target device includes: Calling the Internet mapping platform through the big model to identify the target device according to the service response data to obtain identification information; Searching the database for a device that is consistent with or similar to the identification information; If there is a device in the database that is consistent with or similar to the identification information, obtain the fingerprint information of the device; matching the identification information with the fingerprint information using the large model; If the identification information and the fingerprint information match successfully, the identification information and the fingerprint information are fused using the large model to obtain target identification information of the target device; If there is no device consistent with or similar to the identification information in the database, or the identification information and the fingerprint information fail to match, the identification information is used as the target identification information of the target device.

4. The method according to claim 1, wherein The method of performing vulnerability risk analysis on the device fingerprint data using the large model to obtain a prediction analysis list includes: Using the large model to search for historical vulnerabilities of the target device from a vulnerability database based on the device fingerprint data; Analyzing the historical vulnerabilities using the large model to obtain vulnerability risks of the target device; Based on the vulnerability risks, a predictive analysis list is generated.

5. The method according to claim 1, wherein The using the large model to compare the image information to obtain fingerprint determination information of the target device includes: Extracting the configuration interface image of the target device from the image information, and searching for the configuration image of the target device on the Internet; Comparing the configuration interface image with the configuration image to see if they are consistent; If the configuration interface image is consistent with the configuration image, the image information of the target device is used as fingerprint determination information.

6. The method according to claim 1, characterized in that Determining an abnormal pattern of the target device according to the scan data includes: Obtaining baseline data of the target device from a baseline library; Comparing the scan data with the baseline data to determine whether there is inconsistent target data; If there is inconsistent target data between the scan data and the baseline data, identifying abnormal information of the target device based on the target data; An abnormality pattern of the target device is determined according to the abnormality information.

7. The method according to claim 1, characterized in that Also includes: Obtaining the prediction analysis list and the abnormal pattern; The prediction analysis list and the abnormal pattern are input into the large model to obtain the security policy of the target device.

8. A system for processing fingerprints of intranet devices, characterized in that: include: An information acquisition unit, configured to acquire target information of a target device from a pre-established communication link; wherein the target information includes at least service response data, device fingerprint data, device response data sequence, scan data, and image information; an identification unit, configured to identify the service response data using a large model to obtain target identification information of the target device; a vulnerability analysis unit, configured to perform vulnerability risk analysis on the device fingerprint data using the large model to obtain a prediction analysis list; a configuration analysis unit, configured to perform configuration analysis on the device response data sequence using the large model to obtain configuration information of the target device; a comparison unit, configured to compare the image information with the large model to obtain fingerprint confirmation information of the target device; a pattern determination unit, configured to determine an abnormal pattern of the target device based on the scan data, and input the identification information, the prediction analysis list, the fingerprint determination information, and the abnormal pattern into the large model to predict an attack path; An integration unit is used to integrate the identification information, the prediction analysis list, the abnormal pattern, the configuration information and the attack path using the large model to obtain a security assessment report.

9. The system according to claim 8, characterized in that Also includes: a first command acquisition unit, configured to acquire a secure remote connection command and execute the secure remote connection command on the intranet client to establish a reverse tunnel between the intranet client and the cloud server; a rule configuration unit, configured to configure traffic forwarding rules on the cloud server according to the reverse tunnel; A first construction unit is configured to construct a communication link based on the reverse tunnel and the traffic forwarding rule; or, a second command acquisition unit, configured to acquire a first target secure remote connection command and a second target secure remote connection command, and execute the first target secure remote connection command on the intranet client to map the connection service port of the intranet client to the cloud server; an execution unit, configured to execute the second target secure remote connection command on the cloud server after the mapping is completed, so as to establish a proxy server and configure target traffic forwarding rules; The second construction unit is configured to construct a communication link based on the proxy server and the target traffic forwarding rule.

10. The system according to claim 8, wherein: The identification unit includes: An identification subunit is configured to call an Internet mapping platform through a large model to identify the target device according to the service response data and obtain identification information; A first search unit is used to search a database for a device that is consistent with or similar to the identification information; a fingerprint obtaining unit, configured to obtain fingerprint information of a device if a device that is consistent with or similar to the identification information exists in the database; a matching unit, configured to match the identification information with the fingerprint information using the large model; a fusion unit, configured to fuse the identification information and the fingerprint information using the large model if the identification information and the fingerprint information match successfully, to obtain target identification information of the target device; The first unit is configured to use the identification information as target identification information of the target device if there is no device consistent with or similar to the identification information in the database, or if the identification information and the fingerprint information fail to match.

Images