Network space topology surveying and mapping method, device and equipment based on distributed lightweight detection, medium and program product

Abstract

The invention relates to the technical field of cyberspace surveying and mapping, in particular to a cyberspace topology surveying and mapping method, device and equipment based on distributed lightweight detection, a medium and a program product. The method comprises the following steps: in response to a surveying and mapping request for a target network space, carrying out distributed detection node deployment on the target network space to obtain a lightweight detection node set; determining a detection network area in the target network space based on the surveying and mapping request and generating a detection task set; the detection task set is allocated based on the lightweight detection node set, detection data of each node in the lightweight detection node set is collected, a detection data set is obtained, and the detection data set comprises node information, equipment types and link information; and based on the detection data set, constructing through a preset graph theory algorithm to obtain a network topology structure, wherein the network topology structure comprises a target node and a connection edge. By adopting the method, the management efficiency of network topology surveying and mapping and the network security can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network space mapping, and in particular to a network space topology mapping method and device based on distributed lightweight probing, a computer device, a storage medium, and a computer program product. BACKGROUND

[0002] With the rapid development of information technology, network space has become a digital environment parallel to the physical world. Network space refers to a virtual space composed of the Internet, communication systems, computer systems, various terminals, and the data transmitted, stored, and processed therein. It not only includes tangible network equipment and infrastructure, but also covers intangible logical connections, services, and applications, and is an important support for the operation of modern society.

[0003] In recent years, with the widespread application of technologies such as cloud computing, containerization, and microservice architecture, the concept of “cloud native” has gradually become an important direction for the evolution of network space. Cloud native network space refers to a network environment built and run based on cloud native technology, and its core features include elasticity, dynamic orchestration, high availability, and high automation. In cloud native network space, resources are dynamically allocated and managed in the form of services, and applications are usually deployed in containers with a microservice architecture, and efficient communication and governance are achieved through technologies such as service mesh. This environment greatly improves resource utilization efficiency and business deployment flexibility, but also makes the form and behavior of network space more complex and difficult to grasp due to its dynamic, distributed, and heterogeneous characteristics.

[0004] In order to effectively understand, manage, and defend network space, especially cloud native network space, network space mapping technology has emerged. Network space mapping refers to the process of identifying, modeling, and visually presenting entities (such as IP addresses, domain names, network devices, services, applications, etc.), topology relationships, resource states, and security attributes in network space through active or passive probing, data collection, and analysis. Its purpose is to build an accurate, real-time, multi-dimensional, and understandable network space map.

[0005] In related technologies, network space mapping is usually achieved through a combination of a series of basic technologies. One of the more basic and widely used methods is active probing technology. Its core is to send specific probing packets to the target network range and infer the existence and attributes of network entities based on the response. Another common method is passive traffic analysis technology. This method does not actively inject traffic into the network, but listens to the traffic of key nodes (such as gateways, mirror ports) in the network, analyzes the source / destination IP, port, protocol type, DNS query record, TLS certificate, etc. in the communication packets, to infer the active hosts, services in the network, and their communication relationships.

[0006] However, the current network space exploration method has the following technical problems:

[0007] The existing network topology mapping technology is difficult to reflect the dynamic changes of the network in real time, resulting in poor timeliness of the mapping results, which needs to be optimized. SUMMARY

[0008] Therefore, it is necessary to provide a network space topology mapping method based on distributed lightweight exploration to improve the management efficiency and network security of network topology mapping.

[0009] In a first aspect, the present application provides a network space topology mapping method based on distributed lightweight exploration. The method comprises:

[0010] In response to a mapping request for a target network space, deploying distributed exploration nodes in the target network space to obtain a set of lightweight exploration nodes;

[0011] Based on the mapping request, determining the exploration network region in the target network space and generating a set of exploration tasks;

[0012] Based on the set of lightweight exploration nodes, distributing the set of exploration tasks, collecting exploration data of each node in the set of lightweight exploration nodes to obtain a set of exploration data, the set of exploration data including node information, device type and link information;

[0013] Based on the set of exploration data, constructing a network topology structure by a preset graph theory algorithm, the network topology structure including target nodes and connection edges.

[0014] In one embodiment, the method comprises:

[0015] Determining the size and node distribution density of the target network space;

[0016] Deploying a preset number of nodes at preset key nodes and link interaction positions to form the set of lightweight exploration nodes.

[0017] In one embodiment, the method comprises:

[0018] Analyzing the mapping request and extracting demand features in the mapping request, the demand features including exploration frequency, key node requirements, and task scheduling rules;

[0019] generate the set of detection tasks based on the demand features and the detected network region.

[0020] In one of the embodiments, the set of detection tasks is assigned based on the set of lightweight detection nodes, and the detection data set is obtained by collecting detection data of each node in the set of lightweight detection nodes.

[0021] The load indicators of each node in the set of lightweight detection nodes are determined based on the set of lightweight detection nodes.

[0022] The set of detection tasks is assigned to each node based on the load indicators and a preset load balancing strategy.

[0023] In one of the embodiments, the set of detection tasks is assigned based on the set of lightweight detection nodes, and the detection data set is obtained by collecting detection data of each node in the set of lightweight detection nodes.

[0024] The detection data set is cleaned based on a preset target format, and redundant error data in the detection data set is removed.

[0025] The cleaned detection data set is integrated by calling a preset feature fusion algorithm to obtain a fusion data set.

[0026] In one of the embodiments, the network topology structure is constructed based on the detection data set by a preset graph theory algorithm, and the network topology structure includes target nodes and connection edges, and further includes:

[0027] The target nodes in the network topology structure are monitored, and in response to the detection data collected in the target nodes exceeding a preset standard detection data interval, an abnormal node is marked;

[0028] Based on the abnormal node, an associated abnormal connection edge is marked, and an abnormal connection edge set is formed by summarizing;

[0029] The abnormal connection edge set is processed for deduplication, and the deduplicated abnormal connection edge set is repaired;

[0030] The network topology structure is updated based on the repaired abnormal connection edge set to obtain an optimized network topology structure.

[0031] In a second aspect, the application further provides a network space topology mapping device based on distributed lightweight detection, and the device comprises:

[0032] A node deployment module is configured to respond to a mapping request for a target network space, to perform distributed detection node deployment on the target network space to obtain a set of lightweight detection nodes.

[0033] The probe task set module is configured to determine a probe network region in the target network space based on the mapping request and generate a probe task set;

[0034] The data collection module is configured to allocate the probe task set based on the lightweight probe node set, collect probe data of each node in the lightweight probe node set, and obtain a probe data set, wherein the probe data set includes node information, device type, and link information.

[0035] The topology module is configured to construct a network topology based on the probe data set by using a preset graph theory algorithm, wherein the network topology includes target nodes and connection edges.

[0036] In one embodiment, the node deployment module includes:

[0037] The deployment information module is configured to determine the scale of the target network space and the node distribution density.

[0038] The distributed deployment module is configured to deploy a preset number of nodes at preset key nodes and link interaction positions to form the lightweight probe node set.

[0039] In one embodiment, the probe task set module includes:

[0040] The requirement feature module is configured to analyze the mapping request and extract requirement features in the mapping request, wherein the requirement features include probe frequency, key node requirement, and task scheduling rule.

[0041] The generation module is configured to generate the probe task set based on the requirement features and the probe network region.

[0042] In one embodiment, the data collection module includes:

[0043] The load index module is configured to determine load indexes of each node in the lightweight probe node set based on the lightweight probe node set.

[0044] The task allocation module is configured to allocate the probe task set to each node based on the load indexes and a preset load balancing strategy.

[0045] In one embodiment, the data collection module includes:

[0046] The data cleaning module is configured to clean the probe data set based on a preset target format and remove redundant error data in the probe data set.

[0047] The feature fusion module is configured to call a preset feature fusion algorithm to integrate the cleaned probe data set and obtain a fusion data set.

[0048] In one embodiment, the topology module is further followed by:

[0049] an anomaly marking module configured to monitor the target node in the network topology, and mark an anomaly node in response to the probe data collected in the target node exceeding a preset standard detection data range;

[0050] an anomaly connection edge module configured to associate an anomaly connection edge based on the anomaly node marking, and aggregate to form an anomaly connection edge set;

[0051] an anomaly repair module configured to perform deduplication processing on the anomaly connection edge set, and repair the deduplicated anomaly connection edge set;

[0052] a topology optimization module configured to update the network topology based on the repaired anomaly connection edge set, and obtain an optimized network topology.

[0053] In a third aspect, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the network space topology mapping method based on distributed lightweight probing according to any one of the embodiments of the first aspect when executing the computer program.

[0054] In a fourth aspect, the present application also provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the network space topology mapping method based on distributed lightweight probing according to any one of the embodiments of the first aspect.

[0055] In a fifth aspect, the present application also provides a computer program product. The computer program product includes a computer program, and the computer program is executed by a processor to implement the steps of the network space topology mapping method based on distributed lightweight probing according to any one of the embodiments of the first aspect.

[0056] The above-mentioned network space topology mapping method based on distributed lightweight probing, device, computer device, storage medium and computer program product can achieve the following beneficial effects on the technical problems in the corresponding background art through the technical features in the embodiments:

[0057] The application provides a network space topology mapping method based on distributed lightweight detection, comprising: in response to a mapping request of a target network space, deploying distributed detection nodes in the target network space to obtain a set of lightweight detection nodes; determining a detection network region in the target network space based on the mapping request and generating a set of detection tasks; distributing the set of detection tasks based on the set of lightweight detection nodes, collecting detection data of each node in the set of lightweight detection nodes to obtain a set of detection data, the set of detection data comprising node information, device type and link information; and constructing a network topology structure based on the set of detection data through a preset graph theory algorithm, the network topology structure comprising target nodes and connection edges. In implementation, the core design of distributed lightweight detection helps to solve the defects of poor timeliness and large interference to the target network in traditional topology mapping. First, the set of lightweight detection nodes is accurately deployed in response to the mapping request, and the lightweight characteristics of the nodes help to reduce resource consumption in the detection process and avoid interference of a large number of detection messages to the normal operation of the target network. At the same time, the distributed deployment mode realizes multi-position synchronous detection, breaks through the limitation of single node detection, and improves the comprehensiveness and efficiency of detection coverage. Second, the detection network region is determined based on the mapping request and the set of tasks is generated, which realizes accurate focusing of the detection task and helps to reduce resource waste caused by blind detection. The tasks are allocated in combination with the real-time state of the nodes to ensure load balancing and further optimize the detection execution efficiency. Third, the set of detection data containing node information, device type and link information is collected to provide comprehensive and accurate data support for topology construction. Then, the preset graph theory algorithm is used to quickly convert the network topology structure containing target nodes and connection edges, which ensures that the topology structure can truly reflect the network connection relationship. The network space topology mapping with low interference, high efficiency and high accuracy is realized from the overall process of the scheme, which helps network management personnel to quickly master the network architecture and lays a solid foundation for subsequent network management, fault troubleshooting and security protection. BRIEF DESCRIPTION OF DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the application or the related art, the drawings needed to be used in the description of the embodiments of the application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other related drawings can be obtained by those skilled in the art without creating any inventive labor.

[0059] Figure 1 FIG. 1 is a first flowchart of a network space topology mapping method based on distributed lightweight detection in an embodiment;

[0060] Figure 2 FIG. 2 is a second flowchart of a network space topology mapping method based on distributed lightweight detection in another embodiment;

[0061] Figure 3 This is a schematic diagram of the third process of a network space topology mapping method based on distributed lightweight probing in another embodiment;

[0062] Figure 4 This is a schematic diagram of the fourth process of a network space topology mapping method based on distributed lightweight probing in another embodiment;

[0063] Figure 5 This is a schematic diagram of the fifth process of a network space topology mapping method based on distributed lightweight probing in another embodiment;

[0064] Figure 6 This is a schematic diagram of the sixth process of a network space topology mapping method based on distributed lightweight probing in another embodiment;

[0065] Figure 7 This is a structural block diagram of a network space topology mapping device based on distributed lightweight detection in one embodiment.

[0066] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0068] In one embodiment, such as Figure 1 As shown, a network space topology mapping method based on distributed lightweight probing is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, and can also be applied to a system including both a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0069] Step 102: In response to the mapping request for the target network space, a distributed probe node is deployed in the target network space to obtain a lightweight probe node set.

[0070] Step 104: Based on the mapping request, determine the detection network region in the target cyberspace and generate a detection task set.

[0071] Step 106: Assign the detection task set based on the lightweight detection node set, collect the detection data of each node in the lightweight detection node set, and obtain the detection dataset, which includes node information, device type and link information.

[0072] Step 108: constructing a network topology structure based on the detection data set by a preset graph theory algorithm, the network topology structure comprising target nodes and connecting edges.

[0073] In the network space topology mapping method based on distributed lightweight detection, the technical features in the embodiments are reasonably deduced to achieve the beneficial effects of solving the technical problems proposed in the background art.

[0074] The present application provides a network space topology mapping method based on distributed lightweight detection, comprising: in response to a mapping request for a target network space, deploying distributed lightweight detection nodes in the target network space to obtain a set of lightweight detection nodes; determining a detection network area in the target network space based on the mapping request and generating a set of detection tasks; distributing the set of detection tasks based on the set of lightweight detection nodes, collecting detection data of each node in the set of lightweight detection nodes to obtain a set of detection data, the set of detection data comprising node information, device type and link information; and constructing a network topology structure based on the set of detection data by a preset graph theory algorithm, the network topology structure comprising target nodes and connecting edges. In implementation, the core design of distributed lightweight detection helps to solve the defects of poor timeliness and large interference to the target network in traditional topology mapping. First, the set of lightweight detection nodes is accurately deployed in response to the mapping request, and the lightweight characteristics of the nodes help to reduce resource consumption in the detection process and avoid interference of a large number of detection packets on the normal operation of the target network. At the same time, the distributed deployment mode realizes multi-position synchronous detection, breaks through the limitations of single-node detection, and improves the comprehensiveness and efficiency of detection coverage. Second, the detection network area is determined based on the mapping request and the set of tasks is generated, which realizes accurate focusing of the detection tasks and helps to reduce resource waste caused by blind detection. The tasks are allocated in combination with the real-time state of the nodes to ensure load balancing and further optimize the detection execution efficiency. Third, the set of detection data containing node information, device type and link information provides comprehensive and accurate data support for topology construction, and then the preset graph theory algorithm is used to quickly convert it into a network topology structure containing target nodes and connecting edges, ensuring that the topology structure can truly reflect the network connection relationship. From the overall process of the scheme, low-interference, high-efficiency and high-precision network space topology mapping is realized, which helps network management personnel to quickly master the network architecture and lays a solid foundation for subsequent network management, fault troubleshooting and security protection.

[0075] In one embodiment, as shown in Figure 2 Step 102 comprises:

[0076] Step 202: determining the size and node distribution density of the target network space.

[0077] Step 204: Deploy a preset number of nodes at preset key nodes and link interaction positions to form the set of lightweight detection nodes.

[0078] In this embodiment, based on the accurate planning of the target network space scale and node distribution density, the lightweight nodes are directionally deployed at the key nodes and link interaction positions, which helps to ensure the detection coverage of the core area and avoid node redundancy and waste. The characteristics of the lightweight nodes help to reduce network resource occupation and running interference, and the distributed layout realizes multi-dimensional synchronous detection, greatly improves the detection efficiency and the comprehensiveness of data collection, and provides high-quality data support for subsequent topology construction.

[0079] In one of the embodiments, as shown in Figure 3 the step 104 includes:

[0080] Step 302: Analyzing the mapping request, extracting the demand characteristics in the mapping request, including detection frequency, key node requirement, task scheduling rule.

[0081] Step 304: Generating the set of detection tasks based on the demand characteristics and the detection network area.

[0082] In this embodiment, by accurately extracting the demand characteristics such as detection frequency and key node requirement through analyzing the mapping request, and directionally generating the task set in combination with the detection network area, it helps to realize the accurate focus of the detection task. On the one hand, it helps to avoid resource waste caused by blind detection, and on the other hand, it helps to ensure that the task is highly matched with the actual demand of the user, and at the same time, the task allocation logic is optimized according to the task scheduling rule, which provides clear guidance for the subsequent efficient execution of detection by the distributed nodes, and improves the pertinence and execution efficiency of the overall mapping process.

[0083] In one of the embodiments, as shown in Figure 4 the step 106 includes:

[0084] Step 402: Determining the load index of each node in the set of lightweight detection nodes based on the set of lightweight detection nodes.

[0085] Step 404: Distributing the set of detection tasks to each node based on the load index and the preset load balancing strategy.

[0086] In this embodiment, by accurately obtaining the load index of each lightweight detection node, and distributing the detection task in combination with the load balancing strategy, the detection delay or resource waste caused by uneven node load is avoided. Not only does it ensure the efficient and stable operation of each node, fully utilizes the advantages of distributed deployment, but also enables the orderly progress of the detection task, improves the data collection efficiency and integrity, guarantees the data quality of subsequent topology construction, and further optimizes the smoothness and reliability of the overall mapping process.

[0087] In one embodiment, as shown in Figure 5 The step 106 includes:

[0088] Step 502: Clean the probe data set based on the preset target format, and remove redundant error data in the probe data set.

[0089] Step 504: Call the preset feature fusion algorithm to integrate the cleaned probe data set to obtain a fusion data set.

[0090] In this embodiment, the probe data set is first cleaned according to the preset target format, and redundant error data is accurately removed to ensure data purity and standardization. Then, the data is integrated through the preset feature fusion algorithm to realize complementary association of node information, device type and link information, and form a complete and high-quality fusion data set. This not only avoids invalid data interference on the accuracy of topology construction, but also improves data utilization, lays a solid data foundation for subsequent rapid generation of accurate and real network topology structure based on graph theory algorithm, and further enhances the reliability and practicality of the overall mapping method.

[0091] In one embodiment, as shown in Figure 6 The step 108 further includes:

[0092] Step 602: Monitor the target node in the network topology structure, and in response to the probe data collected in the target node exceeding the preset standard detection data interval, mark the abnormal node.

[0093] Step 604: Based on the abnormal node marking, associate the abnormal connection edge to form an abnormal connection edge set.

[0094] Step 606: De-duplicate the abnormal connection edge set, and repair the de-duplicated abnormal connection edge set.

[0095] Step 608: Update the network topology structure based on the repaired abnormal connection edge set to obtain an optimized network topology structure.

[0096] In this embodiment, by monitoring the state of the target node in real time, the abnormal node and the associated abnormal connection edge whose probe data exceeds the preset standard interval are accurately identified, and the topology structure is updated through de-duplication and repair processing. This not only realizes rapid positioning of network faults and avoids abnormal diffusion affecting network operation, but also optimizes the topology structure to reflect the real state of the network in real time, greatly improves the timeliness and accuracy of topology mapping, provides strong support for network management personnel to timely troubleshoot problems and ensure stable and reliable network operation, and further enhances the practicality and security of the overall mapping method.

[0097] It should be understood that although the steps in the flowcharts involved in the embodiments described above are shown in sequence according to the arrows, the steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of the steps is not strictly limited in sequence, and the steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the embodiments described above can include multiple steps or multiple stages, which are not necessarily executed at the same time but can be executed at different times, and the execution order of the steps or stages is not necessarily sequential but can be round-robin or alternating with at least some of the other steps or the steps or stages in the other steps.

[0098] Based on the same inventive concept, the embodiments of the present application also provide a distributed lightweight probing-based network space topology mapping device for implementing the above-mentioned distributed lightweight probing-based network space topology mapping method. The problem-solving implementation scheme provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more distributed lightweight probing-based network space topology mapping device embodiments provided below can be referred to the limitations of the distributed lightweight probing-based network space topology mapping method described above, which will not be repeated here.

[0099] In one embodiment, as shown in Figure 7 A distributed lightweight probing-based network space topology mapping device is provided, comprising a node deployment module, a probing task set module, a data acquisition module, and a topology structure module, wherein:

[0100] The node deployment module is configured to perform distributed lightweight probing node deployment on a target network space in response to a mapping request for the target network space, to obtain a set of lightweight probing nodes.

[0101] The probing task set module is configured to determine a probing network region in the target network space based on the mapping request and generate a set of probing tasks.

[0102] The data acquisition module is configured to distribute the set of probing tasks based on the set of lightweight probing nodes, acquire probing data of each node in the set of lightweight probing nodes, and obtain a set of probing data, wherein the set of probing data includes node information, device type, and link information.

[0103] The topology structure module is configured to construct a network topology structure based on the set of probing data by using a preset graph theory algorithm, wherein the network topology structure includes target nodes and connection edges.

[0104] In one embodiment, the node deployment module comprises:

[0105] a deployment information module configured to determine a scale and a node distribution density of the target network space;

[0106] a distribution deployment module configured to deploy a preset number of nodes at preset key nodes and link interaction positions to form the set of lightweight probe nodes.

[0107] In one embodiment, the set of probe tasks module comprises:

[0108] a requirement feature module configured to parse the mapping request and extract requirement features in the mapping request, the requirement features including a probe frequency, key node requirements, and task scheduling rules;

[0109] a generation module configured to generate the set of probe tasks based on the requirement features and the probe network region.

[0110] In one embodiment, the data collection module comprises:

[0111] a load index module configured to determine load indexes of nodes in the set of lightweight probe nodes based on the set of lightweight probe nodes;

[0112] a task allocation module configured to allocate the set of probe tasks to the nodes based on the load indexes and a preset load balancing strategy.

[0113] In one embodiment, the data collection module comprises:

[0114] a data cleaning module configured to clean the set of probe data based on a preset target format and remove redundant error data in the set of probe data;

[0115] a feature fusion module configured to call a preset feature fusion algorithm to integrate the cleaned set of probe data to obtain a fused data set.

[0116] In one embodiment, the topology structure module further comprises:

[0117] an abnormal marker module configured to monitor the target nodes in the network topology structure, and in response to the probe data collected in the target nodes exceeding a preset standard detection data interval, mark abnormal nodes;

[0118] an abnormal connection edge module configured to associate abnormal connection edges based on the abnormal node marking, and aggregate to form a set of abnormal connection edges;

[0119] an abnormal repair module configured to perform a deduplication process on the set of abnormal connection edges, and repair the deduplicated set of abnormal connection edges;

[0120] A topology optimization module is configured to update the network topology based on the repaired abnormal connection edge set, and obtain an optimized network topology.

[0121] The modules in the network space topology mapping device based on distributed lightweight detection can be implemented by software, hardware, or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so as to be called and executed by the processor to perform operations corresponding to the modules.

[0122] In one embodiment, a computer device, which can be a server, has an internal structure as shown in Figure 8 The computer device includes a processor, a memory, an input / output interface, and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store data. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement a network space topology mapping method based on distributed lightweight detection.

[0123] Those skilled in the art can understand that Figure 8 The structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not limit the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0124] In one embodiment, a computer device is also provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0125] In one embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0126] In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of any of the above method embodiments.

[0127] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0128] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0129] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, as long as the combinations do not conflict with each other, they should be construed to be within the scope of the present disclosure.

[0130] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A network space topology mapping method based on distributed lightweight probing, characterized in that, The method includes: In response to a mapping request for the target cyberspace, distributed probe nodes are deployed in the target cyberspace to obtain a lightweight probe node set; Based on the mapping request, determine the detection network region in the target cyberspace and generate a set of detection tasks; The detection task set is allocated based on the lightweight detection node set, and the detection data of each node in the lightweight detection node set is collected to obtain the detection dataset, which includes node information, device type and link information; A network topology is constructed based on the probe dataset using a preset graph theory algorithm. The network topology includes target nodes and connecting edges.

2. The method according to claim 1, characterized in that, In response to a mapping request for the target cyberspace, the distributed deployment of probe nodes in the target cyberspace to obtain a lightweight probe node set includes: Determine the size and node distribution density of the target network space; A predetermined number of nodes are deployed at key nodes and link interaction locations to form the lightweight detection node set.

3. The method according to claim 1, characterized in that, The step of determining the probe network region in the target cyberspace based on the mapping request and generating a probe task set includes: The mapping request is parsed, and the requirement features in the mapping request are extracted. The requirement features include the detection frequency, key node requirements, and task scheduling rules. The detection task set is generated based on the aforementioned requirements and the aforementioned detection network region.

4. The method according to claim 1, characterized in that, The process of allocating the detection task set based on the lightweight detection node set, collecting detection data from each node in the lightweight detection node set, and obtaining the detection dataset includes: The load index of each node in the lightweight probe node set is determined based on the lightweight probe node set. Based on the load metrics and the preset load balancing strategy, the detection task set is distributed to each node.

5. The method according to any one of claims 1 to 4, characterized in that, The process of allocating the detection task set based on the lightweight detection node set, collecting detection data from each node in the lightweight detection node set, and obtaining the detection dataset includes: The probe dataset is cleaned based on a preset target format, and redundant and erroneous data in the probe dataset is removed. The cleaned detection dataset is integrated by calling a preset feature fusion algorithm to obtain a fused dataset.

6. The method according to claim 1, characterized in that, The network topology structure is constructed based on the probe dataset using a preset graph theory algorithm. After including the target nodes and connecting edges, the network topology structure also includes: Monitor the target node in the network topology, and mark the abnormal node in response to the detection data collected from the target node exceeding the preset standard detection data range; Based on the abnormal node markers and associated abnormal connection edges, an abnormal connection edge set is formed. The abnormal connection edge set is deduplicated, and the deduplicated abnormal connection edge set is repaired. The network topology is updated based on the repaired set of abnormal connections to obtain an optimized network topology.

7. A network space topology mapping device based on distributed lightweight probing, characterized in that, The device includes: The node deployment module is used to respond to a mapping request for the target network space, and to deploy distributed probe nodes in the target network space to obtain a lightweight probe node set. The detection task set module is used to determine the detection network region in the target cyberspace based on the mapping request and generate a detection task set. The data acquisition module is used to allocate the detection task set based on the lightweight detection node set, collect the detection data of each node in the lightweight detection node set, and obtain the detection dataset, which includes node information, device type and link information. The topology module is used to construct a network topology based on the probe dataset using a preset graph theory algorithm. The network topology includes target nodes and connecting edges.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images