An Agent Mapping Method and System for Asset Discovery in Isolated Network Blind Spots

Abstract

This invention relates to the fields of network security and information technology, specifically to an agent mapping method and system for asset discovery in isolated network blind spots. The method includes: deploying agents on terminals to collect local data, including ARP cache, network connection tables, hardware fingerprints, and behavioral profiles, and encrypting and uploading this data. The main control center performs asset deduplication and authentication based on hardware fingerprints, and uses time window alignment and session continuity analysis algorithms to process connection data, resolving association ambiguities caused by timing misalignments and temporary connections, and establishing high-confidence cross-agent connection relationships. Finally, the connection relationships and behavioral profile data are merged, and unmanaged assets discovered at the link layer are included to synthesize a global asset topology across logical network segments. This invention improves the coverage, identification accuracy, and real-time performance of asset discovery in complex isolated network environments, while eliminating the risk of interference to business networks during the scanning process.

Description

Technical Field

[0001] This invention relates to the fields of network security and information technology, and in particular to an agent mapping method and system for discovering assets in isolated network blind spots. Background Technology

[0002] As enterprise networks evolve towards highly isolated, dynamically heterogeneous cloud and IoT environments, traditional asset scanning technologies based on proactive detection (such as Nmap, Network Mapper, or network scanning tools) face fundamental bottlenecks in complex, isolated networks. Their main drawbacks are: First, under zero-trust and strict network isolation policies, scanners are blocked by firewalls, security groups, and other policies, making it impossible to discover "shadow assets" within isolated network segments, creating inevitable blind spots. Second, in environments where NAT (Network Address Translation), private address reuse, and dynamic IP (Internet Protocol) allocation are prevalent, the traditional method of using IP as a unique identifier leads to severe address conflicts and identity confusion, causing asset ledger data pollution. Third, proactive scanning is high-risk and inefficient, potentially causing business interruptions and triggering alarm storms in vulnerable environments such as industrial control systems, and its long scanning cycle cannot meet the real-time discovery needs of short-lifecycle assets such as containers. Existing solutions such as distributed hardware probes and traffic mirroring analysis either fail to systematically solve the above problems due to high deployment costs, complex management, inability to cover silent assets, or violation of the principle of least privilege. In particular, there is a lack of complete solutions that can achieve accurate identity recognition and cross-logical boundary topology restoration under the premise of zero network interference. Summary of the Invention

[0003] This invention provides an agent mapping method and system for asset discovery in isolated network blind spots, which solves the fundamental problem that traditional network scanning technology cannot discover assets in strictly isolated complex networks, has inaccurate identification, and interferes with business operations.

[0004] The objective of this invention can be achieved through the following technical solutions:

[0005] The first aspect of this invention is to provide an agent mapping method for discovering assets in isolated network blind spots, comprising:

[0006] A lightweight agent deployed on the network terminal collects the network terminal's asset data through local introspection. This asset data includes:

[0007] Link layer discovery data: obtained by parsing the Address Resolution Protocol (ARP) cache table of the local operating system;

[0008] Network layer connection data: obtained by parsing the network connection status table of the local operating system. The connection data includes the Transmission Control Protocol (TCP) connection status, User Datagram Protocol (UDP) listening status and their corresponding remote endpoint information.

[0009] Host identity fingerprint data: generated based on system-level hardware identification information collected from the network terminal;

[0010] Dynamic behavioral profile data: generated based on continuous analysis of connection patterns in the network connection status table. The behavioral profile data includes at least a set of high-frequency communication endpoints, time pattern characteristics of connection establishment, and port usage pattern characteristics.

[0011] The Agent uploads the collected asset data to the main control center via a secure channel;

[0012] The main control center receives asset data from multiple agents and performs the following processing:

[0013] Asset identity parsing and entity deduplication are performed based on the host identity fingerprint data;

[0014] For the deduplicated asset data, the time window alignment algorithm and connection session continuity analysis algorithm are used to establish a high-confidence cross-agent connection relationship by using the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint with host identity fingerprint data. This solves the association ambiguity caused by the time sequence asynchrony and temporary connection between data reported by different agents.

[0015] By integrating the high-confidence cross-Agent connection relationships with the dynamic behavior profile data, and incorporating the unmanaged assets identified in the link layer discovery data as topology nodes, a global asset topology across logical network segments is synthesized.

[0016] Furthermore, the step of verifying the uniqueness of the asset entity represented by the endpoint using the time window alignment algorithm and the connection session continuity analysis algorithm, based on the outbound and inbound connection endpoint information recorded in the network layer connection data, and using host identity fingerprint data, includes:

[0017] Acquire and parse network layer connection data from multiple agents, and extract outbound connection target endpoint and inbound connection source endpoint information;

[0018] Establish a unified time base based on Network Time Protocol (NTP) synchronization. Then, using the unified time base, perform bidirectional timing matching between outbound and inbound connection endpoints within a preset time tolerance window through a time window alignment algorithm.

[0019] During the matching process, host identity fingerprint data is used to verify the uniqueness of the asset entity associated with the endpoint information, eliminating matching ambiguities caused by IP address conflicts or reuse.

[0020] Furthermore, establishing a high-confidence cross-agent connection includes:

[0021] For connection pairs that have completed time-series matching and authentication, the continuity of their connection sessions is analyzed using a connection session continuity analysis algorithm, and a confidence score is generated based on historical connection patterns, session duration, and data interaction frequency.

[0022] The connections are classified according to the confidence score, and temporary connections with confidence scores lower than or equal to a preset threshold are filtered out. Only connections with confidence scores higher than the preset threshold are retained for synthesizing the global asset topology.

[0023] Furthermore, the dynamic behavioral profile data specifically includes:

[0024] Based on historical network connection status table data, a list of remote service ports accessed by the network terminal and access frequency characteristics are generated.

[0025] Based on historical ARP cache table data, a set of neighboring devices with stable communication within the broadcast domain of the network terminal is generated.

[0026] Furthermore, the method also includes:

[0027] For unmanaged assets identified solely through link-layer discovery data, their possible connection paths in the global asset topology are inferred by analyzing the ARP cache tables and switch address forwarding tables reported by multiple agents.

[0028] Furthermore, the establishment of the secure channel specifically involves:

[0029] The Agent initiates a one-way Transport Layer Security (TLS) connection to the main control center and performs two-way certificate authentication.

[0030] Furthermore, the synthesized global asset topology across logical network segments specifically includes:

[0031] Each asset entity, uniquely identified by its host identity fingerprint data, will be used as a node in the global asset topology.

[0032] The high-confidence cross-Agent connection relationship is used as the edge connecting the node;

[0033] Network devices that are not agent-deployed and are identified based on link layer discovery data will be added as unmanaged asset nodes to the global asset topology.

[0034] Based on the dynamic behavior profile data, behavioral feature labels are attached to the nodes and edges.

[0035] A second aspect of the present invention is to provide an agent mapping system for discovering assets in isolated network blind spots, comprising:

[0036] Asset data collection module: Used by a lightweight agent deployed on the network terminal to collect asset data of the network terminal through local introspection. The asset data includes:

[0037] Link layer discovery data: obtained by parsing the Address Resolution Protocol (ARP) cache table of the local operating system;

[0038] Network layer connection data: obtained by parsing the network connection status table of the local operating system. The connection data includes the Transmission Control Protocol (TCP) connection status, User Datagram Protocol (UDP) listening status and their corresponding remote endpoint information.

[0039] Host identity fingerprint data: generated based on system-level hardware identification information collected from the network terminal;

[0040] Dynamic behavioral profile data: generated based on continuous analysis of connection patterns in the network connection status table. The behavioral profile data includes at least a set of high-frequency communication endpoints, time pattern characteristics of connection establishment, and port usage pattern characteristics.

[0041] Asset data secure upload module: used by the Agent to upload the collected asset data to the main control center through a secure channel;

[0042] Asset data processing and topology synthesis module: Used by the main control center to receive asset data from multiple agents and perform the following processing:

[0043] Asset identity parsing and entity deduplication are performed based on the host identity fingerprint data;

[0044] For the deduplicated asset data, the time window alignment algorithm and connection session continuity analysis algorithm are used to establish a high-confidence cross-agent connection relationship by using the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint with host identity fingerprint data. This solves the association ambiguity caused by the time sequence asynchrony and temporary connection between data reported by different agents.

[0045] By integrating the high-confidence cross-Agent connection relationships with the dynamic behavior profile data, and incorporating the unmanaged assets identified in the link layer discovery data as topology nodes, a global asset topology across logical network segments is synthesized.

[0046] A third aspect of the present invention is to provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the Agent mapping method for discovering assets in isolated network blind spots.

[0047] A fourth aspect of the present invention is to provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the Agent mapping method for discovering assets in isolated network blind spots.

[0048] Compared with existing technologies, the beneficial effects of this invention are as follows: a lightweight agent deployed on a network terminal collects asset data of the network terminal through local introspection; it achieves asset data collection with zero network interference and penetration of local firewalls, fundamentally avoiding the blind spots and risks of traditional scanning; the agent uploads the collected asset data to the main control center through a secure channel; the authentication mechanism ensures the confidentiality, integrity, and reliability of sensitive asset data during transmission; the main control center receives asset data from multiple agents and performs the following processing:

[0049] Asset identity parsing and entity deduplication are performed based on the host identity fingerprint data; a unique asset identity independent of IP is established based on hardware fingerprints, completely resolving data pollution issues caused by address conflicts and drift; for the deduplicated asset data, a time window alignment algorithm and a connection session continuity analysis algorithm are used, based on the outbound and inbound connection endpoint information recorded in the network layer connection data, and the uniqueness of the asset entity represented by the endpoint is verified using the host identity fingerprint data, resolving the association ambiguity caused by the time sequence asynchrony between data reported by different agents and temporary connections, and establishing a high-confidence cross-agent connection relationship; through intelligent... It can associate local perspectives of multiple agents and automatically synthesize a global topology across isolated network segments, achieving a panoramic insight into the real network connection relationships. It integrates the high-confidence cross-agent connection relationships with the dynamic behavior profile data, and incorporates unmanaged assets identified in the link layer discovery data as topology nodes to synthesize a global asset topology across logical network segments. It adds dynamic behavior features to assets and connections, enabling the topology to have intelligent retrieval, accurate risk identification, and automated policy configuration capabilities. It solves the fundamental problem that traditional network scanning technologies cannot discover assets in strictly isolated complex networks, have inaccurate identification, and interfere with business operations. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This invention provides a flowchart illustrating the steps of an agent mapping method for discovering assets in isolated network blind spots.

[0052] Figure 2 This invention provides a schematic diagram of the module flow of an Agent mapping system for discovering assets in isolated network blind spots. Detailed Implementation

[0053] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0054] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0055] To address the problems existing in the background technology, this paper studies and designs an agent mapping method and system for asset discovery in isolated network blind spots, which has important practical significance.

[0056] like Figure 1 As shown, the first aspect of the present invention is to provide an agent mapping method for asset discovery in isolated network blind spots, comprising the following steps:

[0057] Step S1: The lightweight agent deployed on the network terminal collects the asset data of the network terminal through local introspection.

[0058] The asset data includes:

[0059] Link layer discovery data: obtained by parsing the Address Resolution Protocol (ARP) cache table of the local operating system;

[0060] Network layer connection data: obtained by parsing the network connection status table of the local operating system. The connection data includes the Transmission Control Protocol (TCP) connection status, User Datagram Protocol (UDP) listening status and their corresponding remote endpoint information.

[0061] Host identity fingerprint data: generated based on system-level hardware identification information collected from the network terminal;

[0062] Dynamic behavioral profile data: generated based on continuous analysis of connection patterns in the network connection status table. The behavioral profile data includes at least a set of high-frequency communication endpoints, time pattern characteristics of connection establishment, and port usage pattern characteristics.

[0063] The dynamic behavior profile data specifically includes:

[0064] Based on historical network connection status table data, a list of remote service ports accessed by the network terminal and access frequency characteristics are generated.

[0065] Based on historical ARP cache table data, a set of neighboring devices with stable communication within the broadcast domain of the network terminal is generated.

[0066] Step S2: The Agent uploads the collected asset data to the main control center through a secure channel.

[0067] It's important to note that an Agent is a lightweight software proxy program deployed on network endpoints (servers, PCs, virtual machines, containers, etc.). Its core function is to collect asset data from the endpoint through local introspection and upload it to the central control center via a secure channel. PC stands for Personal Computer.

[0068] Specifically, after completing local data collection, the Agent proactively initiates a one-way connection request to the control center based on Transport Layer Security (TLS). Before establishing the connection, both parties exchange and verify digital certificates to complete mutual authentication (mTLS, Mutual TLS) to ensure the trustworthiness of the communicating parties. After the connection is established, the Agent first performs lossless compression (such as GZIP, a lossless compression format) on the collected raw asset data, then encrypts it using a high-strength encryption algorithm (such as AES-256, Advanced Encryption Standard with a 256-bit key), and finally transmits the data packets in fragments to the control center through this protected channel. The entire process does not require any inbound ports to be opened on the Agent's terminal, and all transmissions are encrypted and integrity-verified, ensuring the confidentiality, integrity, and reliability of the data during transmission.

[0069] Step S3: The main control center integrates data reported by multiple agents, performs asset deduplication and identity verification based on host identity fingerprints, uses time window alignment and session continuity analysis to resolve temporal and correlation ambiguities to establish high-confidence connections, and combines dynamic behavior profiles with unmanaged assets discovered at the link layer to finally synthesize a global asset topology across logical network segments.

[0070] Specifically, the control center receives asset data from multiple agents and performs the following processing:

[0071] Asset identity parsing and entity deduplication based on host identity fingerprint data;

[0072] For the deduplicated asset data, the time window alignment algorithm and connection session continuity analysis algorithm are used to establish a high-confidence cross-agent connection relationship by using the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint with host identity fingerprint data. This solves the association ambiguity caused by the time sequence asynchrony and temporary connection between data reported by different agents.

[0073] By integrating the high-confidence cross-Agent connection relationships with the dynamic behavior profile data, and incorporating the unmanaged assets identified in the link layer discovery data as topology nodes, a global asset topology across logical network segments is synthesized.

[0074] Specifically, the algorithm utilizes a time window alignment algorithm and a connection session continuity analysis algorithm. Based on the outbound and inbound connection endpoint information recorded in the network layer connection data, and using host identity fingerprint data, it verifies the uniqueness of the asset entity represented by the endpoint, including:

[0075] Acquire and parse network layer connection data from multiple agents, and extract outbound connection target endpoint and inbound connection source endpoint information;

[0076] Establish a unified time base based on Network Time Protocol (NTP) synchronization. Then, using the unified time base, perform bidirectional timing matching between outbound and inbound connection endpoints within a preset time tolerance window through a time window alignment algorithm.

[0077] During the matching process, host identity fingerprint data is used to verify the uniqueness of the asset entity associated with the endpoint information, eliminating matching ambiguities caused by IP address conflicts or reuse.

[0078] Establishing high-confidence cross-agent connections includes:

[0079] For connection pairs that have completed time-series matching and authentication, the continuity of their connection sessions is analyzed using a connection session continuity analysis algorithm, and a confidence score is generated based on historical connection patterns, session duration, and data interaction frequency.

[0080] The connections are classified according to the confidence score, and temporary connections with confidence scores lower than or equal to a preset threshold are filtered out. Only connections with confidence scores higher than the preset threshold are retained for synthesizing the global asset topology.

[0081] Agent-based mapping methods also include:

[0082] For unmanaged assets identified solely through link-layer discovery data, their possible connection paths in the global asset topology are inferred by analyzing the ARP cache tables and switch address forwarding tables reported by multiple agents.

[0083] Specifically, the synthesis of global asset topology across logical network segments includes:

[0084] Each asset entity, uniquely identified by its host identity fingerprint data, will be used as a node in the global asset topology.

[0085] The high-confidence cross-Agent connection relationship is used as the edge connecting the node;

[0086] Network devices that are not agent-deployed and are identified based on link layer discovery data will be added as unmanaged asset nodes to the global asset topology.

[0087] Based on the dynamic behavior profile data, behavioral feature labels are attached to the nodes and edges.

[0088] The following are the performance data of this invention:

[0089] This invention reduces network bandwidth usage by 92% (traditional scanning peak 480Mbps → Agent mode 38Mbps). Scanning time is reduced from "hours" to "minutes" (full network scan of 100 network segments < 8 minutes) because all Agents work in parallel.

[0090] Furthermore, this invention also supports containerized agents (Docker images <15MB), which can be automatically injected and scaled up / down in a K8s cluster. Asset data is integrated with CMDB / SIEM via a RESTful API, with an update latency of <30 seconds, achieving "near real-time" asset situational awareness.

[0091] Among these, Mbps stands for Megabits per second. MB stands for Megabyte. RESTful API stands for Representational State Transfer Application Programming Interface. CMDB stands for Configuration Management Database. SIEM stands for Security Information and Event Management.

[0092] This concludes the embodiment.

[0093] like Figure 2 As shown, a second aspect of the present invention is to provide an agent mapping system for discovering assets in isolated network blind spots, comprising:

[0094] Asset data acquisition module 101: Used by a lightweight agent deployed on the network terminal to collect asset data of the network terminal through local introspection, the asset data including:

[0095] Link layer discovery data: obtained by parsing the Address Resolution Protocol (ARP) cache table of the local operating system;

[0096] Network layer connection data: obtained by parsing the network connection status table of the local operating system. The connection data includes the Transmission Control Protocol (TCP) connection status, User Datagram Protocol (UDP) listening status and their corresponding remote endpoint information.

[0097] Host identity fingerprint data: generated based on system-level hardware identification information collected from the network terminal;

[0098] Dynamic behavioral profile data: generated based on continuous analysis of connection patterns in the network connection status table. The behavioral profile data includes at least a set of high-frequency communication endpoints, time pattern characteristics of connection establishment, and port usage pattern characteristics.

[0099] Asset data secure upload module 102: used by the Agent to upload the collected asset data to the main control center through a secure channel;

[0100] Asset data processing and topology synthesis module 103: Used by the main control center to receive asset data from multiple agents and perform the following processing:

[0101] Asset identity parsing and entity deduplication are performed based on the host identity fingerprint data;

[0102] For the deduplicated asset data, the time window alignment algorithm and connection session continuity analysis algorithm are used to establish a high-confidence cross-agent connection relationship by using the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint with host identity fingerprint data. This solves the association ambiguity caused by the time sequence asynchrony and temporary connection between data reported by different agents.

[0103] By integrating the high-confidence cross-Agent connection relationships with the dynamic behavior profile data, and incorporating the unmanaged assets identified in the link layer discovery data as topology nodes, a global asset topology across logical network segments is synthesized.

[0104] A third aspect of the present invention is to provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements an agent mapping method for discovering assets in isolated network blind spots.

[0105] A fourth aspect of the present invention is to provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements an agent mapping method for discovering assets in isolated network blind spots.

[0106] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0107] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, systems, and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0108] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the present invention.

Claims

1. An agent mapping method for discovering assets in isolated network blind spots, characterized in that, include: A lightweight agent deployed on the network terminal collects the network terminal's asset data through local introspection. This asset data includes: Link layer discovery data: obtained by parsing the Address Resolution Protocol (ARP) cache table of the local operating system; Network layer connection data: obtained by parsing the network connection status table of the local operating system. The connection data includes the Transmission Control Protocol (TCP) connection status, User Datagram Protocol (UDP) listening status and their corresponding remote endpoint information. Host identity fingerprint data: generated based on system-level hardware identification information collected from the network terminal; Dynamic behavioral profile data: generated based on continuous analysis of connection patterns in the network connection status table. The behavioral profile data includes at least a set of high-frequency communication endpoints, time pattern characteristics of connection establishment, and port usage pattern characteristics. The Agent uploads the collected asset data to the main control center via a secure channel; The main control center receives asset data from multiple agents and performs the following processing: Asset identity parsing and entity deduplication are performed based on the host identity fingerprint data; For the deduplicated asset data, the time window alignment algorithm and connection session continuity analysis algorithm are used to establish a high-confidence cross-agent connection relationship by using the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint with host identity fingerprint data. This solves the association ambiguity caused by the time sequence asynchrony and temporary connection between data reported by different agents. By integrating the high-confidence cross-Agent connection relationship with the dynamic behavior profile data, and incorporating the unmanaged assets identified in the link layer discovery data as topology nodes, a global asset topology across logical network segments is synthesized. The method of using a time window alignment algorithm and a connection session continuity analysis algorithm, based on the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint using host identity fingerprint data, includes: Acquire and parse network layer connection data from multiple agents, and extract outbound connection target endpoint and inbound connection source endpoint information; Establish a unified time base based on Network Time Protocol (NTP) synchronization. Then, using the unified time base, perform bidirectional timing matching between outbound and inbound connection endpoints within a preset time tolerance window through a time window alignment algorithm. During the matching process, host identity fingerprint data is used to verify the uniqueness of the asset entity associated with the endpoint information, eliminating matching ambiguities caused by IP address conflicts or reuse. The establishment of a high-confidence cross-agent connection includes: For connection pairs that have completed time-series matching and authentication, the continuity of their connection sessions is analyzed using a connection session continuity analysis algorithm, and a confidence score is generated based on historical connection patterns, session duration, and data interaction frequency. The connections are classified according to the confidence score, and temporary connections with confidence scores lower than or equal to a preset threshold are filtered out. Only connections with confidence scores higher than the preset threshold are retained for synthesizing the global asset topology. The synthesized global asset topology spanning logical network segments specifically includes: Each asset entity, uniquely identified by its host identity fingerprint data, will be used as a node in the global asset topology. The high-confidence cross-Agent connection relationship is used as the edge connecting the node; Network devices that are not agent-deployed and are identified based on link layer discovery data will be added as unmanaged asset nodes to the global asset topology. Based on the dynamic behavior profile data, behavioral feature labels are attached to the nodes and edges.

2. The agent mapping method for discovering assets in isolated network blind spots according to claim 1, characterized in that, The dynamic behavior profile data specifically includes: Based on historical network connection status table data, a list of remote service ports accessed by the network terminal and access frequency characteristics are generated. Based on historical ARP cache table data, a set of neighboring devices with stable communication within the broadcast domain of the network terminal is generated.

3. The agent mapping method for discovering assets in isolated network blind spots according to claim 1, characterized in that, The method further includes: For unmanaged assets identified solely through link-layer discovery data, their possible connection paths in the global asset topology are inferred by analyzing the ARP cache tables and switch address forwarding tables reported by multiple agents.

4. The agent mapping method for asset discovery in isolated network blind spots according to claim 1, characterized in that, The establishment of the secure channel is specifically as follows: The Agent initiates a one-way Transport Layer Security (TLS) connection to the main control center and performs two-way certificate authentication.

5. An agent mapping system for discovering assets in isolated network blind spots, employing the agent mapping method according to any one of claims 1-4, characterized in that, include: Asset data collection module: Used by a lightweight agent deployed on the network terminal to collect asset data of the network terminal through local introspection. The asset data includes: Link layer discovery data: obtained by parsing the Address Resolution Protocol (ARP) cache table of the local operating system; Network layer connection data: obtained by parsing the network connection status table of the local operating system. The connection data includes the Transmission Control Protocol (TCP) connection status, User Datagram Protocol (UDP) listening status and their corresponding remote endpoint information. Host identity fingerprint data: generated based on system-level hardware identification information collected from the network terminal; Dynamic behavioral profile data: generated based on continuous analysis of connection patterns in the network connection status table. The behavioral profile data includes at least a set of high-frequency communication endpoints, time pattern characteristics of connection establishment, and port usage pattern characteristics. Asset data secure upload module: used by the Agent to upload the collected asset data to the main control center through a secure channel; Asset data processing and topology synthesis module: Used by the main control center to receive asset data from multiple agents and perform the following processing: Asset identity parsing and entity deduplication are performed based on the host identity fingerprint data; For the deduplicated asset data, the time window alignment algorithm and connection session continuity analysis algorithm are used to establish a high-confidence cross-agent connection relationship by using the outbound and inbound connection endpoint information recorded in the network layer connection data, and verifying the uniqueness of the asset entity represented by the endpoint with host identity fingerprint data. This solves the association ambiguity caused by the time sequence asynchrony and temporary connection between data reported by different agents. By integrating the high-confidence cross-Agent connection relationships with the dynamic behavior profile data, and incorporating the unmanaged assets identified in the link layer discovery data as topology nodes, a global asset topology across logical network segments is synthesized.

6. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the Agent mapping method for discovering assets in isolated network blind spots as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the Agent mapping method for asset discovery in isolated network blind spots as described in any one of claims 1-4.

Images