A network asset topology construction method, system, device and computer medium

Abstract

This application discloses a method, system, device, and computer medium for constructing network asset topology, relating to the field of network security technology. The method involves: collecting traffic data from a target network to obtain basic traffic data; generating a basic asset topology for the target network based on the basic traffic data; obtaining a known asset topology for a known network; performing topology inference on the basic asset topology based on the known asset topology to obtain an inferred asset topology; collecting traffic data from the target network to obtain verification traffic data; checking the correctness of the inferred asset topology based on the verification traffic data; if the inferred asset topology is determined to be incorrect, adjusting the topology inference strategy and returning to the step of performing topology inference on the basic asset topology based on the known asset topology; if the inferred asset topology is determined to be correct, determining the target asset topology for the target network based on the inferred asset topology. This application reduces the resource consumption of network asset topology construction, weakens the limitations of traffic data on asset topology, and has good scalability.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, system, device, and computer medium for constructing network asset topology. Background Technology

[0002] In today's digital and information age, networks have become the infrastructure for enterprise operations. A company's daily operations, decision support, and innovation capabilities all depend on the stability and security of its network. Asset topology identification, as one of the technologies for network security operations management, plays a role in improving network security, optimizing asset management, and supporting decision-making.

[0003] Passive asset topology identification based on traffic analysis is one type of asset topology identification technology. It primarily involves analyzing network traffic (such as NetFlow and sFlow) to determine the communication patterns and traffic paths of devices within the network, thereby inferring the network topology. However, asset topology identification technology based on full network traffic analysis places extremely high demands on the performance of network devices and management tools. The large amount of data collection and processing also increases storage and computing costs. Furthermore, as enterprises grow in size and network structures, this technology struggles to achieve good scalability in terms of performance and accuracy.

[0004] In summary, how to reduce the resource consumption of network asset topology construction and improve scalability is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a method for constructing network asset topologies, which can, to some extent, solve the technical problem of how to reduce resource consumption and improve scalability in network asset topology construction. This application also provides a network asset topology construction system, an electronic device, and a computer-readable storage medium.

[0006] To achieve the above objectives, this application provides the following technical solution: A method for constructing network asset topology, comprising: Traffic is collected from the target network to obtain basic traffic data; The basic asset topology of the target network is generated based on the aforementioned basic traffic data; Obtain the known asset topology of a known network; Based on the known asset topology, topological reasoning is performed on the underlying asset topology to obtain the inferred asset topology; Traffic is collected from the target network to obtain verification traffic data; Based on the verification traffic data, determine whether the inference asset topology is correct; If the inferred asset topology is determined to be incorrect, the topology inference strategy is adjusted, and the step of performing topology inference on the base asset topology based on the known asset topology is returned. If the inference asset topology is determined to be correct, then the target asset topology of the target network is determined based on the inference asset topology.

[0007] Preferably, generating the basic asset topology of the target network based on the basic traffic data includes: Each pair of communication nodes in the basic traffic data is treated as a data point; According to the conversion rule that distance is inversely proportional to the number of data packets, the data packets between the communication node pairs in the basic traffic data are converted into the distance between the corresponding data points; The data points are clustered according to the distance to obtain the clustering results; The basic asset topology of the target network is generated based on the clustering results.

[0008] Preferably, generating the basic asset topology of the target network based on the clustering results includes: Based on the number of data packets, determine the traffic level of the cluster centers in the clustering results; The flow level of the cluster center is used as the cluster category; For each communication node, among all the clusters corresponding to the communication node, the cluster with the highest frequency of occurrence is determined as the main cluster of the communication node according to the category; The communication nodes that share the same primary cluster are divided into a logical subnet; Generate the internal connections of the logical subnet; Generate cross-network connections between the logical subnets; The underlying asset topology of the target network is generated based on the logical subnet.

[0009] Preferably, generating the internal connections of the logical subnet includes: For the first node and the second node within the logical subnet, if the cluster category of the edge formed by the first node and the second node is the same as the main cluster of the logical subnet, then the internal connection between the first node and the second node is marked as a core connection. For the first node and the second node within the logical subnet, if the cluster category of the edge formed by the first node and the second node is different from the main cluster of the logical subnet, then the internal connection between the first node and the second node is marked as an edge connection.

[0010] Preferably, generating cross-network connections between the logical subnets includes: For the third and fourth nodes between the logical subnets, if the cluster category of the edge formed by the third node and the fourth node belongs to the highest traffic level, then the cross-network connection between the third node and the fourth node is marked as a core cross-subnet connection. For the third and fourth nodes between the logical subnets, if the cluster category of the edge formed by the third node and the fourth node does not belong to the highest traffic level, then the cross-network connection between the third node and the fourth node is marked as a normal cross-subnet connection.

[0011] Preferably, the step of performing topological reasoning on the underlying asset topology based on the known asset topology to obtain the inferred asset topology includes: The aforementioned basic asset topology is used as the asset topology to be processed. Generate the similarity between the topology of the asset to be processed and the known asset topology; Based on the similarity, the connection relationship between the extended nodes and the extended nodes is inferred; Based on the connection relationships of the extended nodes, the extended nodes are added to the topology of the assets to be processed, thus obtaining the inference asset topology.

[0012] Preferably, determining the target asset topology of the target network based on the inference asset topology includes: Determine whether to end the topological reasoning; If topological reasoning continues, the reasoned asset topology is used as the asset topology to be processed, and the process returns to the step of generating the similarity between the asset topology to be processed and the known asset topology. If topology inference ends, the inferred asset topology is taken as the target asset topology of the target network.

[0013] A network asset topology construction system, comprising: The first acquisition module is used to collect traffic data from the target network to obtain basic traffic data. The first generation module is used to generate the basic asset topology of the target network based on the basic traffic data; The first acquisition module is used to acquire the known asset topology of a known network; The first reasoning module is used to perform topological reasoning on the basic asset topology based on the known asset topology to obtain the reasoned asset topology. The second acquisition module is used to acquire traffic data from the target network and obtain verification traffic data. The first verification module is used to detect whether the inference asset topology is correct based on the verification traffic data. The first adjustment module is used to adjust the topology inference strategy and return to the step of performing topology inference on the base asset topology based on the known asset topology if it is determined that the inferred asset topology is incorrect. The first determining module is used to determine the target asset topology of the target network based on the inference asset topology if the inference asset topology is determined to be correct.

[0014] An electronic device, comprising: Memory, used to store computer programs; A processor, used to implement the steps of the network asset topology construction method as described above when executing the computer program.

[0015] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the above-described network asset topology construction methods.

[0016] This application provides a method for constructing network asset topology, which involves: collecting traffic data from a target network to obtain basic traffic data; generating a basic asset topology for the target network based on the basic traffic data; obtaining a known asset topology for a known network; performing topology inference on the basic asset topology based on the known asset topology to obtain an inferred asset topology; collecting traffic data from the target network to obtain verification traffic data; detecting the correctness of the inferred asset topology based on the verification traffic data; if the inferred asset topology is determined to be incorrect, adjusting the topology inference strategy and returning to the step of performing topology inference on the basic asset topology based on the known asset topology; if the inferred asset topology is determined to be correct, determining the target asset topology for the target network based on the inferred asset topology. In this application, a basic asset topology of the target network is generated based on the basic traffic data of the target network. Then, topology inference is performed on the basic asset topology using known asset topology data to obtain the inferred asset topology. This achieves asset topology construction with a small amount of traffic data. Furthermore, the correctness of the inferred asset topology needs to be checked based on verification traffic data. If an error is detected, the inference strategy needs to be adjusted and inference repeated to obtain a target asset topology adapted to the target network. Compared with schemes that directly construct a complete target asset topology based on traffic data, this reduces the amount of traffic data collected and reduces the operations of constructing asset topology based on traffic by using topology inference, thereby reducing the resource consumption of network asset topology construction. In addition, only a small amount of traffic data is needed to construct the asset topology, weakening the limitation of traffic data on asset topology and providing good scalability. The network asset topology construction system, electronic device, and computer-readable storage medium provided in this application also solve the corresponding technical problems. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a network asset topology construction method provided in this application embodiment; Figure 2 A schematic diagram of a network asset topology construction system provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application; Figure 4 This is another structural schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] Please see Figure 1 , Figure 1 A flowchart illustrating a network asset topology construction method provided in this application embodiment.

[0021] This application provides a method for constructing network asset topology, which may include the following steps: Step S101: Collect traffic data from the target network to obtain basic traffic data.

[0022] Step S102: Generate the basic asset topology of the target network based on the basic traffic data.

[0023] In practical applications, during the process of constructing the asset topology of a target network, traffic can be collected from the target network first to obtain basic traffic data, and then the basic asset topology of the target network can be generated based on the basic traffic data.

[0024] It should be noted that this basic traffic data refers to the traffic data used to create a partial asset topology of the target network. In other words, the basic asset topology refers to a portion of the target network's asset topology, not the complete asset topology. Furthermore, the size and type of the basic traffic data can be flexibly determined based on the application scenario.

[0025] For example, in an exemplary embodiment, traffic monitoring devices can be deployed at key nodes in the target network. Using the NetFlow or sFlow protocol, traffic samples are collected on demand, recording information such as the source IP, destination IP, protocol, port number, and timestamp for each traffic sample as basic traffic data. Key nodes refer to critical nodes in network interaction, such as core aggregation switches. During this process, sampling traffic is collected from the core switch, which can be achieved through port mirroring, directing the traffic to a traffic probe. The traffic probe parses network packets and converts them into structured traffic session logs, as shown in Table 1.

[0026] Table 1 Unified Network Traffic Session Log

[0027] In an exemplary embodiment, during the process of generating the basic asset topology of the target network based on basic traffic data, a preliminary basic asset topology can be constructed by using a clustering algorithm in graph theory to identify common communication patterns and connections between nodes based on the collected basic traffic data. This means that each pair of communication nodes in the basic traffic data can be treated as a data point, such as a pair of IP addresses that interact with each other. Following the conversion rule that distance is inversely proportional to the number of data packets, the data packets between communication node pairs in the basic traffic data are converted into distances between corresponding data points. Thus, the larger the number of data packets between communication node pairs, the more frequent the communication between them, and the smaller the distance between them, the easier it is to cluster them together to form a cluster reflecting the frequency of communication between them. The data points are then clustered according to distance to obtain clustering results. Finally, the basic asset topology of the target network is generated based on the clustering results.

[0028] To facilitate understanding the construction process of the basic asset topology in this application, we assume a network in which it is necessary to identify the communication patterns of devices and the relationships between nodes. After collecting basic traffic data, the dataset shown in Table 2 was obtained.

[0029] Table 2 Traffic Dataset

[0030] Each IP address pair (source IP and destination IP) is treated as a data point, and the distance between data points is reflected by the number of data packets. That is, the more data packets there are, the smaller the distance between the two IPs. For example, the reciprocal of the number of data packets can be used as the distance between data points to cluster IP pairs with more data packets into the same group. The distances are shown in Table 3.

[0031] Table 3 Data points and distances

[0032] Suppose we want to divide the target network into three main communication groups (K=3), the process of obtaining the clustering results using the K-Means algorithm is as follows: Choose three initial random cluster centers; Calculate the distance from each data point to each cluster center, and assign the data point to the cluster containing the nearest cluster center; For each cluster, the average distance between data points in the cluster is used as the new cluster center; Calculate the distance from each data point to each cluster center, and assign the data point to the cluster containing the nearest cluster center; Detect whether the cluster has changed; If the clusters change, return to the step of using the average distance between data points in each cluster as the new cluster center; otherwise, the clusters are used as the clustering result.

[0033] In specific application scenarios, during the process of generating the basic asset topology of the target network based on clustering results, the traffic level of the cluster centers in the clustering results can be determined according to the number of data packets. For example, the traffic level of the cluster centers in the clustering results can be divided into high traffic, medium traffic, and low traffic according to the number of data packets. Among them, the high traffic group (Cluster 0) can be the core communication link, such as traffic between internal servers; the medium traffic group (Cluster 1) can be the regular business interaction, such as communication between users and servers; and the low traffic group (Cluster 2) can be the low traffic group. 2) This can be for edge or intermittent communication, such as cross-network area traffic. The traffic level of the cluster center is used as the cluster category. For example, if the traffic level of the cluster center is high traffic, then the category of the cluster to which this cluster center belongs is high traffic. For each communication node, among all the clusters corresponding to the communication node, the cluster with the highest frequency is determined as the primary cluster of the communication node according to the category. For example, if IP_A has 10 edges, 7 of them belong to the high traffic cluster (cluster=0) and 3 belong to the medium traffic cluster (cluster=1), then the primary cluster of IP_A is 0, which is the high traffic cluster. If multiple clusters have the same frequency, the higher-level cluster is selected first. The system divides communication nodes with the same primary cluster into logical subnets. This results in higher communication strength between IP nodes within the same subnet (guaranteed by k-means clustering) and lower communication strength between IP nodes in different subnets. For example, all IPs with primary cluster 0 belong to subnet 0, which is the high-traffic core subnet; IPs with primary cluster 1 belong to subnet 1, which is the regular business subnet; and IPs with primary cluster 2 belong to subnet 2, which is the low-traffic edge subnet. The system then generates internal connections within the logical subnets, generates cross-network connections between logical subnets, and generates the basic asset topology of the target network based on the logical subnets.

[0034] In specific application scenarios, during the generation of internal connections within a logical subnet, for the first and second nodes within the logical subnet, if the cluster category of the edge formed by the first and second nodes is the same as the main cluster of the logical subnet, then the internal connection between the first and second nodes is marked as a core connection; for the first and second nodes within the logical subnet, if the cluster category of the edge formed by the first and second nodes is different from the main cluster of the logical subnet, then the internal connection between the first and second nodes is marked as an edge connection. For example, if the edge between IP_A (main cluster 0) and IP_B (main cluster 0) belongs to cluster 0, then it is a core connection of Subnet0; if the edge between IP_C (main cluster 1) and IP_D (main cluster 1) belongs to cluster 2, then it is an edge connection of Subnet1.

[0035] In specific application scenarios, during the generation of cross-network connections between logical subnets, for the third and fourth nodes between logical subnets, if the cluster category of the edge formed by the third and fourth nodes belongs to the highest traffic level, then the cross-network connection between the third and fourth nodes is marked as a core cross-subnet connection; for the third and fourth nodes between logical subnets, if the cluster category of the edge formed by the third and fourth nodes does not belong to the highest traffic level, then the cross-network connection between the third and fourth nodes is marked as a normal cross-subnet connection. For example, if the edge between IP_E (main cluster 0) and IP_F (main cluster 1) belongs to cluster 0, then it is a backbone link between Subnet0 and Subnet1; if the edge between IP_G (main cluster 1) and IP_H (main cluster 2) belongs to cluster 1, then it is a normal cross-subnet connection.

[0036] Step S103: Obtain the known asset topology of the known network.

[0037] Step S104: Perform topological reasoning on the basic asset topology based on the known asset topology to obtain the inferred asset topology.

[0038] In practical applications, if networks are similar, their asset topologies are also relatively similar. Therefore, the asset topology of the target network can be generated through topology reasoning based on the known asset topology of the known network. In other words, the known asset topology of the known network can be obtained, and topology reasoning can be performed on the basic asset topology based on the known asset topology to obtain the inferred asset topology. For example, there should be firewall devices between the business area and the storage area to ensure communication security, and there should be load balancing devices to distribute request load and optimize the response time of the storage area.

[0039] In an exemplary embodiment, during the process of performing topological reasoning on the base asset topology based on the known asset topology to obtain the inferred asset topology, the base asset topology can be used as the asset topology to be processed; the similarity between the asset topology to be processed and the known asset topology is generated, for example, by using a graph similarity algorithm (such as Graph Edit Distance); the extended nodes and their connection relationships are inferred based on the similarity; and the extended nodes are added to the asset topology to be processed based on their connection relationships to obtain the inferred asset topology.

[0040] Step S105: Collect traffic data from the target network to obtain verification traffic data.

[0041] Step S106: Detect whether the inferred asset topology is correct based on the verification traffic data; if the inferred asset topology is determined to be incorrect, adjust the topology inference strategy and return to the step of performing topology inference on the basic asset topology based on the known asset topology; if the inferred asset topology is determined to be correct, execute step S107.

[0042] Step S107: Determine the target asset topology of the target network based on the inference asset topology.

[0043] In practical applications, the inferred asset topology obtained through reasoning may differ from the actual asset topology of the target network. To avoid this and ensure accurate asset topology generation, traffic can be collected from the target network to obtain verification traffic data. This verification traffic data can be other traffic data besides the basic traffic data. The correctness of the inferred asset topology is then checked based on the verification traffic data. If the inferred asset topology is determined to be incorrect, the topology reasoning strategy is adjusted, such as adjusting node role identification or path reasoning strategies. The process returns to the steps of reasoning the basic asset topology based on the known asset topology, thus obtaining a more accurate asset topology by changing the reasoning strategy. If the inferred asset topology is determined to be correct, the target asset topology of the target network is determined based on it. Furthermore, the topological relationships of nodes (IPs) and edges (IP pairs) can be converted into JSON or graph database (such as Neo4j) format to save the attribute and connection information of network nodes. In addition, the target network and target asset topology can also be used as known networks and known asset topologies to guide the construction of asset topologies for other unknown networks.

[0044] In an exemplary embodiment, during the process of determining the target asset topology of the target network based on the inferred asset topology, it can be determined whether to end the topology inference. If topology inference continues, the inferred asset topology is used as the asset topology to be processed, and the process returns to the step of generating the similarity between the asset topology to be processed and the known asset topology, so as to include more nodes in the inference scope. If topology inference ends, the inferred asset topology is used as the target asset topology of the target network. In this way, sampling, verification, and adjustment can be performed repeatedly to gradually improve the inferred network asset topology. It can also ensure that the accuracy can be improved in each iteration, and finally, through multiple iterations, a closed-loop, verified, and complete network asset topology structure is formed.

[0045] In specific application scenarios, to ensure the accuracy and efficiency of verification, a reasonable traffic sampling strategy can be designed to obtain representative traffic data for verification. For example, based on the preliminary inferred asset topology, key nodes and paths can be identified, and traffic sampling can be prioritized at these locations. Alternatively, appropriate time intervals can be selected for sampling to ensure the representativeness of data collected in different time periods. Furthermore, the sampling frequency can be increased to obtain verification traffic data when specific events occur (such as high-traffic periods or network changes). Correspondingly, in the process of detecting the correctness of the inferred asset topology based on verification traffic data, the sampled verification traffic data can be compared with the inferred asset topology to check the consistency of node connections and traffic paths. Alternatively, graph comparison algorithms can be used to evaluate the similarity between the inferred asset topology and the topology constructed from the verification data. During this process, the accuracy of key nodes and paths can be emphasized to ensure their matching with the actual situation.

[0046] It should be noted that network asset topology can be used to identify the inherent logic between various devices, hosts, applications, and software, as well as the physical connections between network devices. Nodes in a network asset topology can include systems, DUs (Deployment Units), groups (host instance groups), software, virtual machines, physical machines, access switches, core switches, aggregation switches, routers, firewalls, etc. Relationships can include constitute, call, logical, cluster, ship, host, connect, etc.

[0047] It should also be noted that the target asset topology can be processed according to actual needs. For example, in numerous projects where network asset topology construction has been completed and delivered, the network asset topology can be uniformly converted into JSON format to save the attribute information and connection information of network nodes. A graph database (e.g., Neo4j) can be used to represent the basic model of the network asset topology, creating the basic structure of nodes and edges within the graph. Nodes represent different network devices, including but not limited to switches and servers, while edges represent the connection relationship between two nodes. Attributes of nodes can be added, such as asset type, asset name, manufacturer, and geographical location; attributes of edges can be added, such as the traffic volume and protocol between two points within a unit of time. Node features can be extracted, such as out-degree (traffic outflow) and in-degree (traffic inflow); edge features can be extracted, such as traffic volume and transmission protocol; global features can be extracted, such as network diameter and average path length. Graph learning methods such as Graph Neural Networks (GNNs) can be selected, which are suitable for processing graph structure data; feature data can be used as input to train the model to learn the characteristic patterns of the network topology; supervised or semi-supervised learning methods can be used, with training performed on the required labeled data. It can divide the training and test sets to ensure the model's generalization ability, use metrics such as accuracy, recall, and F1 score to evaluate model performance, and adjust model parameters such as learning rate and number of layers to optimize model performance. It can also generate knowledge graphs of typical network topologies.

[0048] This application provides a method for constructing network asset topology, which involves: collecting traffic data from a target network to obtain basic traffic data; generating a basic asset topology for the target network based on the basic traffic data; obtaining a known asset topology for a known network; performing topology inference on the basic asset topology based on the known asset topology to obtain an inferred asset topology; collecting traffic data from the target network to obtain verification traffic data; detecting the correctness of the inferred asset topology based on the verification traffic data; if the inferred asset topology is determined to be incorrect, adjusting the topology inference strategy and returning to the step of performing topology inference on the basic asset topology based on the known asset topology; if the inferred asset topology is determined to be correct, determining the target asset topology for the target network based on the inferred asset topology. In this application, a basic asset topology of the target network is generated based on the basic traffic data of the target network. Then, topology inference is performed on the basic asset topology using the known asset topology to obtain the inferred asset topology. This achieves asset topology construction with a small amount of traffic data. It is necessary to check the correctness of the inferred asset topology based on the verification traffic data. If an error is detected, the inference strategy needs to be adjusted and inference is performed again to obtain a target asset topology that is compatible with the target network. Compared with the scheme of directly constructing a complete target asset topology based on traffic data, this reduces the amount of traffic data collected and reduces the operation of constructing asset topology based on traffic by using topology inference, thereby reducing the resource consumption of network asset topology construction. In addition, only a small amount of traffic data is needed to construct the asset topology, which weakens the limitation of traffic data on asset topology and has good scalability.

[0049] Please see Figure 2 , Figure 2 This is a schematic diagram of a network asset topology construction system provided in an embodiment of this application.

[0050] This application provides a network asset topology construction system, which may include: The first acquisition module 101 is used to acquire traffic data from the target network to obtain basic traffic data. The first generation module 102 is used to generate the basic asset topology of the target network based on basic traffic data; The first acquisition module 103 is used to acquire the known asset topology of a known network; The first reasoning module 104 is used to perform topological reasoning on the basic asset topology based on the known asset topology to obtain the reasoned asset topology. The second acquisition module 105 is used to acquire traffic data from the target network and obtain verification traffic data. The first verification module 106 is used to detect and infer whether the asset topology is correct based on the verification traffic data. The first adjustment module 107 is used to adjust the topology reasoning strategy if it is determined that the reasoning asset topology is incorrect, and return the steps of performing topology reasoning on the base asset topology based on the known asset topology. The first determining module 108 is used to determine the target asset topology of the target network based on the inference asset topology if the inference asset topology is determined to be correct.

[0051] This application provides a network asset topology construction system, wherein the first generation module may include: The first setting unit is used to treat each communication node pair in the basic traffic data as a data point; The first conversion unit is used to convert data packets between communication node pairs in the basic traffic data into distances between corresponding data points according to the conversion rule that distance is inversely proportional to the number of data packets; The first clustering unit is used to cluster data points according to distance to obtain clustering results; The first generation unit is used to generate the basic asset topology of the target network based on the clustering results.

[0052] This application provides a network asset topology construction system. The first generation unit can be used to: determine the traffic level of the cluster center in the clustering result based on the number of data packets; take the traffic level of the cluster center as the cluster category; for each communication node, among all the clusters corresponding to the communication node, determine the cluster with the highest frequency as the main cluster of the communication node according to the category; divide the communication nodes with the same main cluster into a logical subnet; generate the internal connection of the logical subnet; generate the cross-network connection between logical subnets; and generate the basic asset topology of the target network based on the logical subnet.

[0053] This application provides a network asset topology construction system. The first generation unit can be used to: for a first node and a second node within a logical subnet, if the cluster type of the edge formed by the first node and the second node is the same as the main cluster of the logical subnet, then mark the internal connection between the first node and the second node as a core connection; for a first node and a second node within a logical subnet, if the cluster type of the edge formed by the first node and the second node is not the same as the main cluster of the logical subnet, then mark the internal connection between the first node and the second node as an edge connection.

[0054] This application provides a network asset topology construction system. The first generation unit can be used to: for a third node and a fourth node between logical subnets, if the cluster category of the edge formed by the third node and the fourth node belongs to the highest traffic level, then mark the cross-network connection between the third node and the fourth node as a core cross-subnet connection; for a third node and a fourth node between logical subnets, if the cluster category of the edge formed by the third node and the fourth node does not belong to the highest traffic level, then mark the cross-network connection between the third node and the fourth node as a normal cross-subnet connection.

[0055] This application provides a network asset topology construction system, wherein the first inference module may include: The second setting unit is used to set the basic asset topology as the asset topology to be processed. The second generation unit is used to generate the similarity between the topology of the asset to be processed and the topology of known assets; The first reasoning unit is used to infer the connection relationship between extended nodes based on similarity. The first extension unit is used to add extension nodes to the topology of the assets to be processed based on the connection relationship of the extension nodes, so as to obtain the inference asset topology.

[0056] This application provides a network asset topology construction system, wherein the first determining module may include: The first judgment unit is used to determine whether to end topological reasoning; if topological reasoning continues, the reasoned asset topology is taken as the asset topology to be processed, and the step of generating the similarity between the asset topology to be processed and the known asset topology is returned; if topological reasoning ends, the reasoned asset topology is taken as the target asset topology of the target network.

[0057] This application also provides an electronic device and a computer-readable storage medium, both of which have the corresponding effects of the network asset topology construction method provided in the embodiments of this application. Please refer to... Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0058] An electronic device provided in this application includes a memory 201 and a processor 202. The memory 201 stores a computer program, and the processor 202 executes the computer program to implement the steps of the network asset topology construction method described in any of the above embodiments.

[0059] Please see Figure 4Another electronic device provided in this application embodiment may further include: an input port 203 connected to the processor 202 for transmitting commands input from the outside to the processor 202; a display unit 204 connected to the processor 202 for displaying the processing results of the processor 202 to the outside; and a communication module 205 connected to the processor 202 for enabling communication between the electronic device and the outside. The display unit 204 may be a display panel, a laser scanner, or the like; the communication method used by the communication module 205 includes, but is not limited to, Mobile High-Definition Link (MHL), Universal Serial Bus (USB), High-Definition Multimedia Interface (HDMI), wireless connectivity: Wireless Fidelity (WiFi), Bluetooth communication technology, Bluetooth Low Energy communication technology, and communication technology based on IEEE 802.11s.

[0060] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the network asset topology construction method described in any of the above embodiments.

[0061] The computer-readable storage media involved in this application include random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs (compact disc read-only memory), or any other form of storage media known in the art.

[0062] For descriptions of relevant parts in the network asset topology construction system, electronic device, and computer-readable storage medium provided in this application's embodiments, please refer to the detailed description of the corresponding parts in the network asset topology construction method provided in this application's embodiments; they will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0063] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0064] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for constructing network asset topology, characterized in that, include: Traffic is collected from the target network to obtain basic traffic data; The basic asset topology of the target network is generated based on the aforementioned basic traffic data; Obtain the known asset topology of a known network; Based on the known asset topology, topological reasoning is performed on the underlying asset topology to obtain the inferred asset topology; Traffic is collected from the target network to obtain verification traffic data; Based on the verification traffic data, determine whether the inference asset topology is correct; If the inferred asset topology is determined to be incorrect, the topology inference strategy is adjusted, and the step of performing topology inference on the base asset topology based on the known asset topology is returned. If the inference asset topology is determined to be correct, then the target asset topology of the target network is determined based on the inference asset topology.

2. The method according to claim 1, characterized in that, The generation of the basic asset topology of the target network based on the basic traffic data includes: Each pair of communication nodes in the basic traffic data is treated as a data point; According to the conversion rule that distance is inversely proportional to the number of data packets, the data packets between the communication node pairs in the basic traffic data are converted into the distance between the corresponding data points; The data points are clustered according to the distance to obtain the clustering results; The basic asset topology of the target network is generated based on the clustering results.

3. The method according to claim 2, characterized in that, The step of generating the basic asset topology of the target network based on the clustering results includes: Based on the number of data packets, determine the traffic level of the cluster centers in the clustering results; The flow level of the cluster center is used as the cluster category; For each communication node, among all the clusters corresponding to the communication node, the cluster with the highest frequency of occurrence is determined as the main cluster of the communication node according to the category; The communication nodes that share the same primary cluster are divided into a logical subnet; Generate the internal connections of the logical subnet; Generate cross-network connections between the logical subnets; The underlying asset topology of the target network is generated based on the logical subnet.

4. The method according to claim 3, characterized in that, The generation of the internal connections of the logical subnet includes: For the first node and the second node within the logical subnet, if the cluster category of the edge formed by the first node and the second node is the same as the main cluster of the logical subnet, then the internal connection between the first node and the second node is marked as a core connection. For the first node and the second node within the logical subnet, if the cluster category of the edge formed by the first node and the second node is different from the main cluster of the logical subnet, then the internal connection between the first node and the second node is marked as an edge connection.

5. The method according to claim 3, characterized in that, The generation of cross-network connections between the logical subnets includes: For the third and fourth nodes between the logical subnets, if the cluster category of the edge formed by the third node and the fourth node belongs to the highest traffic level, then the cross-network connection between the third node and the fourth node is marked as a core cross-subnet connection. For the third and fourth nodes between the logical subnets, if the cluster category of the edge formed by the third node and the fourth node does not belong to the highest traffic level, then the cross-network connection between the third node and the fourth node is marked as a normal cross-subnet connection.

6. The method according to claim 1, characterized in that, The process of performing topological reasoning on the underlying asset topology based on the known asset topology to obtain the inferred asset topology includes: The aforementioned basic asset topology is used as the asset topology to be processed. Generate the similarity between the topology of the asset to be processed and the known asset topology; Based on the similarity, the connection relationship between the extended nodes and the extended nodes is inferred; Based on the connection relationships of the extended nodes, the extended nodes are added to the topology of the assets to be processed, thus obtaining the inference asset topology.

7. The method according to claim 6, characterized in that, Determining the target asset topology of the target network based on the inference asset topology includes: Determine whether to end the topological reasoning; If topological reasoning continues, the reasoned asset topology is used as the asset topology to be processed, and the process returns to the step of generating the similarity between the asset topology to be processed and the known asset topology. If topology inference ends, the inferred asset topology is taken as the target asset topology of the target network.

8. A network asset topology construction system, characterized in that, include: The first acquisition module is used to collect traffic data from the target network to obtain basic traffic data. The first generation module is used to generate the basic asset topology of the target network based on the basic traffic data; The first acquisition module is used to acquire the known asset topology of a known network; The first reasoning module is used to perform topological reasoning on the basic asset topology based on the known asset topology to obtain the reasoned asset topology. The second acquisition module is used to acquire traffic data from the target network and obtain verification traffic data. The first verification module is used to detect whether the inference asset topology is correct based on the verification traffic data. The first adjustment module is used to adjust the topology inference strategy and return to the step of performing topology inference on the base asset topology based on the known asset topology if it is determined that the inferred asset topology is incorrect. The first determining module is used to determine the target asset topology of the target network based on the inference asset topology if the inference asset topology is determined to be correct.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network asset topology construction method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the network asset topology construction method as described in any one of claims 1 to 7.

Images