Dual-stack network asset discovery method based on multi-protocol cooperative detection and intelligent fingerprint analysis

Abstract

The invention relates to a dual-stack network asset discovery method based on multi-protocol cooperative detection and intelligent fingerprint analysis. Comprising the following steps: multi-source parallel acquisition: acquiring network layer information of each terminal device in an intranet through a command line interface or an application programming interface; data cleaning and standardization: after acquisition is completed, cleaning and standardization operation is performed on the original data; target equipment identification and detection strategy generation: according to the cleaned address list, in combination with equipment information, identifying the type of target equipment, and automatically generating corresponding detection parameters; sending a multi-protocol asset detection message: sending the detection message to the target IPv4 and IPv6 addresses according to the configuration parameters; response data analysis and fingerprint identification: carrying out structured analysis and multi-dimensional identification on the received response data; and dual-stack network data fusion and statistical analysis: after fingerprint identification is completed, carrying out fusion analysis on IPv4 and IPv6 detection results, and constructing a unified asset database.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network and information security, and particularly relates to a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis. BACKGROUND

[0002] With the acceleration of the large-scale deployment of IPv6, the enterprise intranet generally presents an IPv4 / IPv6 dual-stack coexistence situation. However, the existing asset discovery technology is mostly designed based on a single protocol stack environment, and its core relies on ARP broadcast and IPv4 port scanning, which has serious limitations in the face of dual-stack hybrid networks. For example, open source tools such as Nmap and Zmap have basic IPv6 support capabilities, but their scanning strategies cannot model the association between IPv4 and IPv6 addresses jointly, resulting in a gap in asset identification and insufficient portrait integrity. Although some commercial tools such as Nessus and Qualys provide IPv6 scanning capabilities, they still rely on static IP segment configuration and are difficult to cover cloud-edge dynamic scenarios.

[0003] The heterogeneity of network devices further exacerbates the complexity of dual-stack mapping. Internet of Things terminals generally use lightweight protocol stacks, and some industrial control devices use closed TCP / IP implementations, which reduces the matching accuracy of standard fingerprint libraries to about 60%, which is much lower than the identification level of traditional terminals. At the same time, the single-point detection method can only capture the network state at a specific time point, and lacks the ability to continuously track the binding relationship between IPv4 / IPv6 addresses and the service chain path of the device. Especially in virtualized environments, the missed detection rate caused by asset dynamic drift exceeds 30%.

[0004] The current industry mainstream solutions also have obvious defects: passive flow analysis technology is limited by the coverage range of mirror ports and cannot detect silent or intermittent online terminals; active detection solutions lack protocol collaboration mechanisms and frequently trigger device protection strategies when dealing with ICMPv6 rate limiting, TCPIPv6 extension headers, etc., resulting in a large number of false positives. In addition, for new network architectures such as SRv6 service chains, existing technologies cannot accurately identify logical assets through Overlay structures.

[0005] With the widespread application of containerized deployment, edge computing, and software-defined networks, intranet assets exhibit strong dynamic and unstructured characteristics, further amplifying the challenges of asset identification and management in a dual-stack environment. Therefore, the existing asset discovery methods cannot meet the needs of high-precision, low-missed-report, and sustainable identification of asset status in multi-protocol stack, multi-device type, and multi-network environment.

[0006] Therefore, the present application proposes a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis. SUMMARY

[0007] The present application aims at the technical problems existing in the prior art, and provides a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis.

[0008] The technical scheme for solving the above technical problems is as follows: a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, comprising the following steps: S1: Multi-source parallel collection: collecting network layer information of each terminal device in the intranet through a command line interface or an application programming interface; S2: Data cleaning and standardization: cleaning and standardizing the collected original data; S3: Target device identification and detection strategy generation: identifying the target device type according to the cleaned address list and combining device information, and automatically generating corresponding detection parameters; S4: Multi-protocol asset detection packet sending: sending detection packets to target IPv4 and IPv6 addresses according to configuration parameters; S5: Response data analysis and fingerprint identification: structurally analyzing and multi-dimensionally identifying the received response data; S6: Dual-stack network data fusion and statistical analysis: after fingerprint identification, fusing and analyzing IPv4 and IPv6 detection results, and constructing a unified asset database.

[0009] Further, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, the S1 step further comprises: S11: Network device information collection: reading an address resolution protocol table and a neighbor discovery cache of a network device through a simple network management protocol, and acquiring an IPv4 address, an IPv6 address, a MAC address and interface information; S12: Host system information collection: remotely executing a command line tool through a Windows management specification or a secure shell protocol; S13: Cloud environment information collection: calling an application programming interface provided by a cloud vendor; S14: Passive listening information collection: listening to a network traffic mirror port, analyzing dynamic host configuration protocol and domain name system packets, and extracting an IPv4 address, an IPv6 address, a host name and a MAC address of a client.

[0010] Further, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, the S3 step further comprises: S31: Target device identification and detection strategy generation: identifying the target device type according to the cleaned address list and combining device information, and automatically generating corresponding detection parameters; S32: Detection Protocol Selection: Select the appropriate detection protocol based on the device type; S33: Port list generation: Generates the corresponding port list based on the device type; S34: Message parameter configuration: Configure the corresponding message parameters according to the probe protocol; S35: Retry Mechanism Configuration: Configure the number of retries and timeout for probe messages to improve the reliability of probes.

[0011] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, step S4 includes: S41: IPv4 Priority Probe: Send probe packets to the target IPv4 address first; S411: TCP SYN probe: Sends TCP SYN packets to ports 80 and 443 of the target IPv4 address to detect whether the web service is available; S412: ICMP Echo Probe: If the TCP SYN probe does not respond, an ICMP Echo request message is sent to the target IPv4 address to check if the target device is alive; S42: IPv6 Supplemental Probe: Perform supplemental probing on the target IPv6 address to discover services on the IPv6 address; S421: ICMPv6 Neighbor Solicitation Probe: Sends an ICMPv6 Neighbor Solicitation message to the target IPv6 address to obtain the MAC address of the target device; S422: HTTP / 2 over IPv6 probe: If the target device has port 80 or port 443 open, it will attempt to probe via the HTTP / 2 over IPv6 protocol to obtain the fingerprint information of the web service.

[0012] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, the multi-S5 steps include: S51: Network Attribute Information Parsing: Parse the source IP address, source port, destination IP address, destination port, and MAC address in the response message; S52: Communication and Application Protocol Identification: Identify the communication and application protocols in the response message; S53: Operating System Feature Recognition: Identify the target device's operating system type, version, and manufacturer information based on TCP fingerprints, HTTP header features, and other network behavior characteristics; S531: TCP fingerprint matching: Based on TCP option fingerprinting, it identifies the operating system type by analyzing the window size, option list, and maximum segment length in TCP packets; S532: HTTP header feature recognition: Parse HTTP response headers, extract the Server field and X-Powered-By field, and identify the web server type and application stack version; S533: Clock skew analysis: Calculate clock skew based on TCP timestamp options. If the skew is greater than 500ms, it is suspected to be a virtual machine. S54: CPE Encoding Information Extraction: Extract the general platform enumeration encoding information from the response data; S55: Product Information and Equipment Type Identification: Identify the product information and equipment type of the target equipment based on the product name, equipment model, version, and manufacturer information in the response data.

[0013] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, step S6 includes: S61: Same Source Merging: Merge IPv4 and IPv6 detection results based on MAC address or device unique identifier (e.g., hostname); S62: Dual-stack status marking: Mark the dual-stack status of each device, i.e. whether it has both IPv4 and IPv6 addresses at the same time; S63: Multidimensional statistical analysis: Perform multidimensional statistical analysis on the data in the asset database; S64: Time-series based anomaly detection: Perform time-series analysis on key indicators of network assets to detect abnormal behavior and configuration changes; S65: Graph-based address relationship fusion: Constructs a graph structure from IPv4 / IPv6 addresses, MAC addresses, hostnames, and switch ports, and uses graph theory algorithms to identify the relationships between devices.

[0014] Furthermore, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis includes the following multi-dimensional statistical analysis of the data in the asset database: S631: IPv6 address deployment rate calculation: Calculate the ratio of the number of active IPv6 addresses to the total number of terminals to assess the deployment status of IPv6; S632: Calculation of IPv6 support rate for internal network devices: Calculate the ratio of the number of internal network devices that support IPv6 to the total number of internal network devices, and evaluate the IPv6 support of internal network devices; S633: IPv6 access rate calculation for various types of terminals: Calculate the IPv6 access rate for various terminals such as servers, workstations, and IoT devices, and evaluate the IPv6 access status of different types of terminals. S634: Comparison of the number of dual-stack devices and single-stack devices: Compare the number of dual-stack devices and single-stack devices; S635: Operating System Distribution and Vendor Share Statistics: Statistics on the distribution of various operating systems in the network; S636: Terminal Asset Coverage and Distribution Map Generation: Generate a terminal asset coverage report and distribution map based on data in the asset database.

[0015] Furthermore, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, wherein the method of identifying the relationships between devices using graph theory algorithms includes: NodeRank = g(Graph, Node); NodeRank represents the importance or relevance of a node in the graph, Graph represents the graph structure constructed from network asset information, Node represents a node in the graph, representing a network device or interface, and g() is a graph theory algorithm.

[0016] The beneficial effects of this invention are: This invention combines multi-protocol response features in a dual-stack IPv4 and IPv6 environment as core identification data to construct a refined identification mechanism suitable for heterogeneous network devices. This method breaks through the limitations of traditional asset detection that relies on a single protocol and static feature matching. It can accurately identify terminal devices that hide their true identities or use lightweight protocol stacks, avoiding identification omissions caused by address drift, protocol mixing, and other factors. This greatly improves the accuracy and stability of identifying various terminal assets in complex intranet environments. Attached Figure Description

[0017] Fig. 1 This is a flowchart illustrating a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis.

[0018] Fig. 2 This is a schematic diagram illustrating the implementation of a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis in one embodiment. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0021] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0022] This invention proposes a dual-stack network asset discovery method based on multi-protocol collaborative probing and intelligent fingerprint analysis, possessing capabilities in protocol collaboration, dynamic identification, and multi-dimensional analysis. The method collects IPv4 / IPv6 addresses and MAC information via command line or API, and after cleaning and standardization, generates a target parameter set suitable for probing. The system constructs various types of TCP, UDP, and ICMP probe packets based on dual protocol stacks, actively initiating probes to target addresses, and performs fingerprint analysis on the response data to extract key features such as operating system, service type, and vendor information. Based on this, combined with IPv4 / IPv6 binding relationships, the system can track the identity migration of terminals in different network environments and construct dynamic device profiles. This method further integrates big data analytics to achieve multi-dimensional modeling of terminal distribution, protocol support, and asset composition, improving the breadth and accuracy of identification in complex dual-stack networks, significantly reducing the false negative rate and false positive risk, and providing reliable support for asset management in new network architectures such as cloud-edge convergence and virtualization deployment.

[0023] Specifically, such asFigs. 1-2 As shown, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis includes the following implementation steps: S1: Multi-source parallel acquisition: Collect network layer information from various terminal devices in the intranet via command-line interface or application programming interface; including the following sub-steps: S11: Network device information collection: Read the address resolution protocol (ARP) table and neighbor discovery cache of network devices through simple network management protocol (SNMP) to obtain IPv4 address, IPv6 address, MAC address and interface information; S12: Host System Information Acquisition: Remotely execute command-line tools, such as ipconfig (Windows) or ifconfig (Linux), via Windows Management Instrumentation (WMI) or Secure Shell Protocol (SSH) to obtain the host's IPv4 address, IPv6 address, MAC address, hostname, and operating system information; S13: Cloud Environment Information Collection: Call the application programming interface (API) provided by the cloud vendor, such as AWS EC2API or Azure Compute API, to obtain the IPv4 address, IPv6 address, MAC address, instance ID, and instance type of the cloud virtual instance; S14: Passive eavesdropping information collection: eavesdrop on network traffic mirroring ports, analyzes Dynamic Host Configuration Protocol (DHCPv6) and Domain Name System (DNS) messages, and extracts the client's IPv4 address, IPv6 address, hostname, and MAC address.

[0024] S2: Data Cleaning and Standardization: Cleaning and standardizing the collected raw data, including the following sub-steps: S21: Data Deduplication: Remove duplicate IPv4 address, IPv6 address, and MAC address records; S22: Invalid address filtering: Filter out invalid IPv4 addresses (e.g., 127.0.0.1) and IPv6 addresses (e.g., link-local address fe80:: / 10). S23: Format Standardization: Convert IPv4 addresses to dotted decimal format, IPv6 addresses to full format, and MAC addresses to uppercase hexadecimal colon-separated format; S3: Target Device Identification and Detection Strategy Generation: Based on the cleaned address list and device information, identify the type of target device and automatically generate corresponding detection parameters, including the following sub-steps: S31: Device Type Identification: Identify the type of target device based on the MAC address prefix (OUI), hostname, and operating system information, such as network switch, Windows host, Linux server, IP camera, etc. S32: Probe Protocol Selection: Select the appropriate probe protocol based on the device type, such as TCP, UDP, ICMP, SNMP, HTTP, etc. S33: Port list generation: Generate the corresponding port list according to the device type. For example, for a web server, select port 80 and port 443, and for an SSH server, select port 22. S34: Message parameter configuration: Configure the corresponding message parameters according to the probe protocol, such as the flag bits of the TCP SYN message, the length of the UDP message, and the data of the ICMP Echo message; S35: Retry mechanism configuration: Configure the number of retries and timeout for probe packets to improve the reliability of probes; S4: Multiprotocol Asset Probe Message Sending: Based on configuration parameters, probe messages are sent to target IPv4 and IPv6 addresses; including the following sub-steps: S41: IPv4 Priority Probe: Prioritize sending probe packets to the target IPv4 address to reduce the probe delay for IPv6 addresses; S411: TCP SYN probe: Sends TCP SYN packets to ports 80 and 443 of the target IPv4 address to detect whether the web service is available; S412: ICMP Echo Probe: If the TCP SYN probe does not respond, an ICMP Echo request message is sent to the target IPv4 address to check if the target device is alive; S42: IPv6 Supplemental Probe: Perform supplemental probing on the target IPv6 address to discover services on the IPv6 address; S421: ICMPv6 Neighbor Solicitation Probe: Sends an ICMPv6 Neighbor Solicitation message to the target IPv6 address to obtain the MAC address of the target device; S422: HTTP / 2 over IPv6 probe: If the target device has port 80 or 443 open, attempt to probe via the HTTP / 2 over IPv6 protocol to obtain the fingerprint information of the web service.

[0025] S5: Response Data Parsing and Fingerprint Recognition: Perform structured parsing and multi-dimensional recognition on the received response data, including the following sub-steps: S51: Network Attribute Information Parsing: Parse the source IP address, source port, destination IP address, destination port, and MAC address in the response message; S52: Communication and Application Protocol Identification: Identify the communication and application protocols in the response message, such as TCP, UDP, HTTP, SSH, DNS, etc. S53: Operating System Feature Recognition: Based on TCP fingerprints, HTTP header features, and other network behavior characteristics, identify the target device's operating system type, version, and manufacturer information; specifically including: S531: TCP Fingerprint Matching: Based on TCP option fingerprinting, this method identifies the operating system type by analyzing fields such as window size, option list, and maximum segment size (MSS) in TCP packets. For example, the TCP window scaling factor in the Linux kernel is typically between 7 and 14, while the initial TTL value for Windows systems is 128.

[0026] The algorithm formula is: OS = F(WS, Options, MSS, TTL), where OS represents the operating system type, WS represents the TCP window size, Options represents the TCP option list, MSS represents the maximum segment size, and TTL represents the time to live. This formula indicates that the operating system type is a function of the TCP fingerprint characteristics. The fingerprint database contains TCP fingerprint characteristics corresponding to various operating systems.

[0027] S532: HTTP Header Feature Recognition: Parse the HTTP response header, extract the Server and X-Powered-By fields, and identify the web server type and application stack version. For example, if the Server field contains "nginx," it indicates that the web service type is nginx, and if the X-Powered-By field contains "PHP / 7," it indicates that the application stack version is PHP 7.

[0028] The algorithm formula is: WebType = G(Server), AppVersion = H(X-Powered-By), where WebType represents the web service type, AppVersion represents the application stack version, Server represents the Server field in the HTTP response header, and X-Powered-By represents the X-Powered-By field in the HTTP response header. This formula indicates that the web service type and application stack version are functions of the HTTP response header fields.

[0029] Different web servers and application stacks contain different characteristic information in their HTTP response headers, which can be used to identify the web server type and application stack version.

[0030] S533: Clock skew analysis: Calculates clock skew based on TCP timestamp options. If the skew is greater than 500ms, it is suspected to be a virtual machine.

[0031] The algorithm formula is: ClockOffset = T2 - T1 - RTT / 2, where ClockOffset represents the clock offset, T1 represents the timestamp of sending a TCP packet, T2 represents the timestamp of receiving a TCP packet, and RTT represents the round-trip time. This formula indicates that the clock offset is a function of the sending time, receiving time, and round-trip time.

[0032] There may be discrepancies in clock synchronization between virtual machines and physical machines. By calculating the clock deviation of the TCP timestamp option, it can be determined whether the target device is a virtual machine.

[0033] S54: CPE Encoding Information Extraction: Extract the Common Platform Enumeration (CPE) encoding information from the response data, such as cpe: / a:apache:http_server:2.4.46, to identify software and hardware version information; S5.5: Product Information and Device Type Identification: Based on the product name, device model, version, and manufacturer information in the response data, identify the product information and device type of the target device, such as printer, camera, router, etc.

[0034] S6: Dual-Stack Network Data Fusion and Statistical Analysis: After fingerprint recognition is completed, the IPv4 and IPv6 detection results are fused and analyzed to build a unified asset database; including the following sub-steps: S61: Same Source Merging: Based on the MAC address or unique device identifier (such as hostname), merge the detection results of IPv4 and IPv6 to avoid duplicate records; S62: Dual-stack status marking: Mark the dual-stack status of each device, i.e. whether it has both IPv4 and IPv6 addresses at the same time; S63: Multidimensional Statistical Analysis: Perform multidimensional statistical analysis on the data in the asset database, including: S631: IPv6 address deployment rate calculation: Calculate the ratio of the number of active IPv6 addresses to the total number of terminals to assess the deployment status of IPv6.

[0035] The algorithm formula is: IPv6DeploymentRate = IPv6ActiveCount / TotalTerminalCount, where IPv6DeploymentRate represents the IPv6 address deployment rate, IPv6ActiveCount represents the number of active IPv6 addresses, and TotalTerminalCount represents the total number of terminals. This formula indicates that the IPv6 address deployment rate is a function of the number of active IPv6 addresses and the total number of terminals.

[0036] S632: Calculation of IPv6 support rate for internal network devices: Calculate the ratio of the number of internal network devices that support IPv6 to the total number of internal network devices, and evaluate the IPv6 support of internal network devices.

[0037] Algorithm formula: IPv6SupportRate = IPv6CapableCount / TotalInternalCount, where IPv6SupportRate represents the IPv6 support rate of internal network devices, IPv6CapableCount represents the number of internal network devices that support IPv6, and TotalInternalCount represents the total number of internal network devices; this formula means that the IPv6 support rate of internal network devices is a function of the number of internal network devices that support IPv6 and the total number of internal network devices.

[0038] S633: IPv6 Access Rate Calculation for Various Terminals: Calculate the IPv6 access rate for various terminals such as servers, workstations, and IoT devices, and evaluate the IPv6 access status of different types of terminals.

[0039] The algorithm formula is: TerminalIPv6Rate(Type) = IPv6EnabledCount(Type) / TotalCount(Type), where TerminalIPv6Rate(Type) represents the IPv6 access rate of terminals of type Type, IPv6EnabledCount(Type) represents the number of IPv6-enabled devices among terminals of type Type, and TotalCount(Type) represents the total number of terminals of type Type. This formula indicates that the IPv6 access rate of a specific type of terminal is a function of the number of IPv6-enabled devices among terminals of that type and the total number of terminals of that type.

[0040] S634: Comparison of the number of dual-stack and single-stack devices: Compare the number of dual-stack and single-stack devices to understand the mixed situation of IPv4 and IPv6 in the network; S635: Operating System Distribution and Vendor Share Statistics: Statistics on the distribution of various operating systems in the network and the share of equipment from different vendors, to understand the diversity of equipment in the network; S636: Terminal asset coverage and distribution map generation: Based on the data in the asset database, generate a terminal asset coverage report and distribution map to understand the distribution of assets in the network; S64: Time-series-based anomaly detection: Perform time-series analysis on key indicators of network assets (such as online status, traffic patterns, and service port openness) to detect abnormal behavior and configuration changes.

[0041] Algorithm formula: AnomalyScore = f(TimeSeriesData); Here, AnomalyScore represents the anomaly score, used to quantify the degree of deviation between the current state and the historical state; TimeSeriesData represents the time series data of key network asset indicators over a period of time; f() can be a function based on statistical models (such as ARIMA, Prophet) or machine learning models (such as LSTM, Autoencoder) to analyze patterns in time series data and detect anomalies; by learning from the historical data of network assets, normal behavior patterns are established; when new data points deviate significantly from historical patterns, anomalies are considered to be possible.

[0042] S65: Graph-based address relationship fusion: By constructing a graph structure from information such as IPv4 / IPv6 addresses, MAC addresses, hostnames, and switch ports, and using graph theory algorithms (such as PageRank and community discovery) to identify the relationships between devices, the problem of device identity tracking in scenarios with multiple interfaces and dynamic IPs can be solved.

[0043] Algorithm formula: NodeRank = g(Graph, Node); In this context, NodeRank represents the importance or relevance of a node (device) in the graph; Graph represents the graph structure constructed from network asset information; Node represents a node in the graph, representing a network device or interface; g() is a graph theory algorithm, such as PageRank or community detection algorithm, used to calculate the importance of a node in the graph; modeling the relationships between network assets as a graph structure allows for a more comprehensive consideration of various relational information, thereby improving the accuracy of device identification.

[0044] In one embodiment: A company has over 500 terminal devices (including servers, office computers, network equipment, and IoT devices), and its network uses a dual-stack IPv4 / IPv6 architecture. Due to the diverse types of devices and the fact that some older devices are not included in IT asset management, the company wants to comprehensively discover and manage its dual-stack network assets through automation, while ensuring that the discovery process does not affect business operations. Implementation process: Network data acquisition: Network data acquisition is the foundation of asset discovery. The goal is to obtain the IP addresses, MAC addresses, and other relevant information of all devices in the network. To achieve comprehensive network coverage, data needs to be collected from multiple data sources.

[0045] Network devices (switches, routers): Obtain the ARP (Address Resolution Protocol) table: The ARP table stores the mapping relationship between IP addresses and MAC addresses and is a key data source for discovering IPv4 devices.

[0046] Obtaining the NDP (Neighbor Discovery Protocol) cache: NDP is a protocol in IPv6 used for address resolution and neighbor discovery. By reading the NDP cache, the mapping relationship between IPv6 addresses and MAC addresses can be obtained.

[0047] Use an SNMP client tool (such as snmpwalk) or write a Python script to connect to the network device via the SNMP protocol; specify the SNMP OID (Object Identifier) ​​to read the ARP table and NDP cache. A commonly used ARP table OID is 1.3.6.1.2.1.3.1.1. The NDP cache OID can be queried based on the network device's model and manufacturer. Parse the data returned by SNMP to extract the IP address and MAC address; store the collected data in a database or file.

[0048] Hosting systems (servers, office computers): WMI: Used to obtain information about Windows devices, including IP address, MAC address, hostname, operating system version, etc. Linux host: Use SSH client tools (such as paramiko) or write Python scripts to connect to Linux devices via SSH.

[0049] Windows: Execute the `ipconfig / all` command to obtain network configuration information; Linux: Execute the `ifconfig` or `ipaddr` command to obtain network configuration information; Optional: Execute the `hostname` command to obtain the hostname; Parse the data returned by the command to extract information such as IP address, MAC address, and hostname; Store the collected data in a database or file.

[0050] Data cleaning and standardization: The raw data collected often has problems such as duplication, invalidity or inconsistent format, and needs to be cleaned and standardized in order to provide a high-quality data foundation for subsequent exploration.

[0051] Deduplication: Remove duplicate IP address and MAC address records.

[0052] Invalid address removal: IPv4: Remove private address ranges (such as 10.0.0.0 / 8, 172.16.0.0 / 12, 192.168.0.0 / 16), local loopback addresses (127.0.0.1), and multicast addresses.

[0053] IPv6: Remove local link-local addresses (fe80:: / 10), reserved address ranges, and multicast addresses.

[0054] Standardized format: IP address: IPv4: Unified in dotted decimal notation (e.g., 192.168.1.1).

[0055] IPv6: Unified to a simplified format (e.g., 2001:db8::1).

[0056] MAC address: uniformly in uppercase hexadecimal colon-separated format (e.g., 00:1A:2B:3C:4D:5E).

[0057] Target device identification and detection strategy generation: Based on the cleaned address list and device information, the target device type is identified and the corresponding detection parameters are automatically generated; this can improve detection efficiency and accuracy and avoid performing the same detection on all devices.

[0058] Device type identification: MAC address prefix (OUI): The device manufacturer can be identified by the first 6 hexadecimal characters (OUI) of the MAC address. For example, 00:1A:2B is Cisco's OUI.

[0059] IP address ranges: The type of device can be inferred from the IP address range. For example, the 192.168.1.0 / 24 network segment may be used for office computers, while the 10.0.0.0 / 24 network segment may be used for servers.

[0060] Hostname: The hostname can be used to identify the device type. For example, a hostname starting with "SRV-" may be a server, while a hostname starting with "PC-" may be an office computer.

[0061] Service ports: The type of device can be inferred from the open service ports. For example, devices with open ports 80 and 443 are likely web servers, while those with open port 22 are likely SSH servers.

[0062] Detection strategy generation: Select the appropriate detection protocol and port based on the device type.

[0063] Configure detection parameters: timeout, number of retries, number of concurrent connections, etc.

[0064] Configure message parameters: TCP flags, HTTP headers, etc.

[0065] Establish a retry mechanism: If the probe fails, you can try to retry using a different protocol or port.

[0066] Example: For a device identified as a web server, an HTTP request can be sent to obtain the server's type and version.

[0067] For devices identified as printers, the printer's status and configuration information can be obtained via the SNMP protocol.

[0068] For devices identified as network devices, commands can be executed via the SSH protocol to obtain the device's configuration information.

[0069] Multi-protocol asset probe message sending: The system sends probe messages to target IPv4 and IPv6 addresses according to configuration parameters; the types of probe messages include TCPSYN, TCPACK, UDP empty message, ICMPEcho, etc.; by receiving response messages (such as SYN-ACK, RST, etc.), the port status or device activity is determined.

[0070] IPv4 priority probe: Send TCPSYN packets to ports 80 / 443 to determine if the target device provides web services; trigger ICMP Echo requests for unresponsive targets to determine if the target device is alive.

[0071] IPv6 supplemental probe: Send ICMPv6 NeighborSolicitation message to discover IPv6 neighbor nodes; Attempt HTTP / 2 over IPv6 on devices with open ports to determine if the target device supports IPv6 web services.

[0072] Response data parsing and fingerprint recognition: The received response data is structured and multidimensionally identified to extract key features, including network attribute information, communication and application protocols, operating system features, CPE encoding information, product information and device type, etc.

[0073] Data parsing: Extract network attribute information such as target IP address, target port, and target MAC address; identify communication and application protocols such as HTTP, SSH, and FTP; parse HTTP headers to extract information such as the Server field and Content-Type field; parse TCP headers to extract information such as window size and TTL value.

[0074] Fingerprint recognition; Operating system fingerprint recognition: TCP fingerprint matching: Window scaling factor ∈ [7,14] => Linux kernel.

[0075] Initial TTL=128 => Windows system.

[0076] ICMP response patterns: Different operating systems respond differently to ICMP messages.

[0077] Service fingerprint recognition: HTTP header characteristics: The Server field contains nginx => Web service type.

[0078] X-Powered-By includes PHP / 7.* => application stack version.

[0079] SSH version information: The type and version of the SSH server can be identified based on the SSH protocol version information.

[0080] Device type fingerprint recognition: CPE (Common Platform Enumeration) coding: CPE coding is a standardized method for describing software and hardware.

[0081] Product Information and Equipment Type: The equipment type can be identified based on the equipment model, version, and manufacturer information.

[0082] Clock skew analysis: Calculate clock skew using the TCP timestamp option; skew > 500ms => suspected virtual machine.

[0083] Dual-stack network data fusion and statistical analysis: The IPv4 and IPv6 detection results are fused and analyzed to build a unified asset database; IPv4 / IPv6 source merging is performed based on MAC address or device unique identifier, and the dual-stack status of each device is marked.

[0084] Data fusion: Associating IPv4 and IPv6 addresses with the same device based on MAC address or device unique identifier (such as hostname).

[0085] Mark the dual-stack status of the device: Devices that support both IPv4 and IPv6 are marked as dual-stack devices.

[0086] Statistical analysis: IPv6 address deployment rate: Number of active IPv6 addresses / Total number of terminals.

[0087] IPv6 support rate of internal network devices.

[0088] IPv6 access rate of various terminals (servers, workstations, IoT, etc.).

[0089] Comparison of the number of dual-stack devices and single-stack devices.

[0090] Operating system distribution and vendor share.

[0091] Terminal asset coverage, distribution map, etc.

[0092] Suppose the company has a web server with an IPv4 address of 192.168.1.100, an IPv6 address of 2001:db8::100, and a MAC address of 00:1A:2B:3C:4D:5E.

[0093] Network data acquisition: Obtain the server's IPv4 and IPv6 addresses from the switch via the SNMP protocol, and obtain its MAC address and hostname from the server via the SSH protocol.

[0094] Data cleaning and standardization: The collected data is cleaned and standardized to remove invalid addresses and unify the data format.

[0095] Target device identification and detection strategy generation: Based on the IP address range and service port (80 and 443), the device is identified as a web server, and corresponding detection strategies are generated, including sending HTTP requests and TCP port scanning.

[0096] Multiprotocol asset probe message sending: Sends HTTP request and TCP port scan messages to the server's IPv4 and IPv6 addresses.

[0097] Response data parsing and fingerprinting: Parse the HTTP response header, extract the Server field, and identify the web server type as Nginx.

[0098] The operating system type was identified as Linux through TCP fingerprint matching.

[0099] Dual-stack network data fusion and statistical analysis: Associate IPv4 and IPv6 addresses with the same device, marking it as a dual-stack device. Calculate the IPv6 access rate of this server and add it to the asset database.

[0100] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0101] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for dual stack network asset discovery based on multi-protocol collaborative probing and intelligent fingerprinting, characterized in that, The method comprises the following steps: S1: Multi-source parallel collection: collecting network layer information of each terminal device in the intranet through a command line interface or an application programming interface; S2: Data cleaning and standardization: cleaning and standardizing the collected original data; S3: Target device identification and detection strategy generation: identifying the target device type according to the cleaned address list and combining device information, and automatically generating corresponding detection parameters; S4: Multi-protocol asset detection packet sending: sending detection packets to target IPv4 and IPv6 addresses according to the configuration parameters; S5: Response data analysis and fingerprint identification: structurally analyzing and multi-dimensionally identifying the received response data; S6: Dual-stack network data fusion and statistical analysis: after fingerprint identification, fusing and analyzing the IPv4 and IPv6 detection results, and constructing a unified asset database. 2.The multi-protocol collaborative probing and intelligent fingerprinting based dual stack network asset discovery method according to claim 1, characterized in that, The S1 step further comprises: S11: Network device information collection: reading the address resolution protocol table and the neighbor discovery cache of the network device through the simple network management protocol to obtain the IPv4 address, the IPv6 address, the MAC address and the interface information; S12: Host system information collection: remotely executing a command line tool through the Windows management specification or the secure shell protocol; S13: Cloud environment information collection: calling an application programming interface provided by a cloud vendor; S14: Passive listening information collection: listening to a network traffic mirroring port, analyzing dynamic host configuration protocol and domain name system packets, and extracting the IPv4 address, the IPv6 address, the host name and the MAC address of the client. 3.The multi-protocol collaborative probing and intelligent fingerprinting based dual stack network asset discovery method according to claim 1, characterized in that, The S3 step further comprises: S31: Target device identification and detection strategy generation: identifying the target device type according to the cleaned address list and combining device information, and automatically generating corresponding detection parameters; S32: Detection protocol selection: selecting a suitable detection protocol according to the device type; S33: Port list generation: generating a corresponding port list according to the device type; S34: Packet parameter configuration: configuring corresponding packet parameters according to the detection protocol; S35: Retry mechanism configuration: configuring the retry number and the timeout time of the detection packet to improve the reliability of detection. 4.The multi-protocol collaborative probing and intelligent fingerprinting based dual stack network asset discovery method of claim 1, wherein, The S4 step comprises: S41: IPv4 priority detection: preferentially sending detection packets to the target IPv4 address; S411: TCP SYN detection: sending a TCP SYN packet to the 80 port and the 443 port of the target IPv4 address to detect whether the Web service is available; S412: ICMP Echo detection: if the TCP SYN detection has no response, sending an ICMP Echo request packet to the target IPv4 address to detect whether the target device is alive; S42: IPv6 supplementary detection: supplementally detecting the target IPv6 address to discover services on the IPv6 address; S421: ICMPv6 Neighbor Solicitation detection: sending an ICMPv6 Neighbor Solicitation packet to the target IPv6 address to obtain the MAC address of the target device; S422: HTTP / 2 over IPv6 probe: If the target device has opened port 80 or port 443, try to probe through the HTTP / 2 over IPv6 protocol to obtain the fingerprint information of the Web service. 5.The multi-protocol collaborative probing and intelligent fingerprinting based dual stack network asset discovery method according to claim 1, wherein, The S5 step includes: S51: Network attribute information analysis: Analyze the source IP address, source port, target IP address, target port, and MAC address in the response message; S52: Communication and application protocol identification: Identify the communication protocol and application protocol in the response message; S53: Operating system feature identification: Identify the operating system type, version, and vendor information of the target device based on TCP fingerprint, HTTP header features, and other network behavior features; S531: TCP fingerprint matching: Based on the TCP option fingerprint identification, identify the operating system type by analyzing the window size, option list, and maximum packet segment length in the TCP message; S532: HTTP header feature identification: Parse the HTTP response header, extract the Server field and X-Powered-By field, and identify the Web server type and application stack version; S533: Clock offset analysis: Calculate the clock offset based on the TCP timestamp option, if the offset is greater than 500ms, it is suspected to be a virtual machine; S54: CPE encoding information extraction: Extract the general platform enumeration encoding information in the response data; S55: Product information and device type identification: Identify the product information and device type of the target device based on the product name, device model, version, and vendor information in the response data. 6.The multi-protocol collaborative probing and intelligent fingerprinting based dual stack network asset discovery method according to claim 1, wherein, The S6 step includes: S61: Homologous merging: Merge the IPv4 and IPv6 probe results based on the MAC address or device unique identifier (such as hostname); S62: Dual-stack state marking: Mark the dual-stack state of each device, i.e., whether it has both IPv4 and IPv6 addresses; S63: Multi-dimensional statistical analysis: Perform multi-dimensional statistical analysis on the data in the asset database; S64: Time series-based anomaly detection: Perform time series analysis on the key indicators of network assets to detect abnormal behavior and configuration changes; S65: Graph theory-based address relationship fusion: Construct a graph structure using IPv4 / IPv6 addresses, MAC addresses, hostnames, and switch ports, and use graph theory algorithms to identify the association between devices. 7.The multi-protocol collaborative probe-based and intelligent fingerprint analysis-based dual stack network asset discovery method according to claim 6, characterized in that, The multi-dimensional statistical analysis of the data in the asset database includes: S631: IPv6 address deployment rate calculation: Calculate the proportion of IPv6 active addresses to total terminal numbers to evaluate the deployment of IPv6; S632: Intranet device IPv6 support rate calculation: Calculate the proportion of IPv6-supporting intranet devices to the total number of intranet devices to evaluate the IPv6 support of intranet devices; S633: IPv6 access rate calculation of various terminals: Calculate the IPv6 access rate of servers, workstations, and IoT devices to evaluate the IPv6 access of different types of terminals; S634: Comparison of the number of dual-stack devices and single-stack devices: Compare the number of dual-stack devices and single-stack devices; S635: Operating system distribution and vendor proportion statistics: statistics of the distribution of various operating systems in the network; S636: Terminal asset coverage rate and distribution map generation: generate terminal asset coverage rate report and distribution map according to the data in the asset database. 8.The multi-protocol collaborative probing and intelligent fingerprinting based dual stack network asset discovery method of claim 1, wherein, The correlation between the devices is identified by using a graph algorithm, and the correlation between the devices includes: NodeRank = g(Graph, Node); Where NodeRank represents the importance or correlation of the node in the graph, Graph represents the graph structure constructed by the network asset information, Node represents a node in the graph, representing a network device or interface, and g() is a graph algorithm.

Images