A port service identification method, device, equipment and readable storage medium
By detecting and identifying the target port, updating the target number and controlling the detection process according to the threshold, the problem of incomplete detection caused by the TCP wrapper service is solved, and the accuracy and efficiency of network asset detection is improved.
Patent Information
- Application Number
- CN202010826160.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-08-17
- Publication Date
- 2024-12-27
- Estimated Expiration
- 2040-08-17
AI Technical Summary
In the detection of network assets, the detection time of TCP wrapper service is limited due to the long detection time of TCP packaging service, which may lead to some open ports not being detected and the detection effect is poor.
By probing the target port, we determine whether the TCP wrapper service is deployed, and update the target number according to the detection results. When the number reaches the threshold, we stop probing to ensure that all ports are fully probed.
It effectively avoids the situation where the detection time reaches a fixed time, improves the accuracy and completeness of port service detection, ensures that all ports are detected, and solves the problem of poor detection effect.
Smart Images
Figure CN111897698B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of network asset identification, and in particular to a port service identification method, a port service identification device, a port service identification equipment and a computer-readable storage medium. Background Art
[0002] TCP wrapper service is a TCP-based service provided by the TCP wrapper software to restrict unauthorized connections. The characteristic of this service is that after the TCP three-way handshake establishes a TCP connection, the port where the service is deployed will not respond to any TCP traffic until the TCP connection is disconnected after a timeout.
[0003] When detecting network assets (such as servers), port service detection is required. Since the detection of TCP wrapper services takes a long time (for example, 4 seconds), in order to avoid a long detection time, the relevant technology will limit the overall detection time, that is, the port service detection of each network asset is performed with a maximum detection time of the overall detection time. If the detection time reaches the overall detection time, the detection will be stopped regardless of whether the detection is completed. However, there are actually network assets where TCP wrapper services are deployed on some ports and TCP wrapper services are not deployed on other open ports. When performing port detection on such network assets, the relevant technology may stop detecting them because the overall detection time is reached before all ports are detected, resulting in all or part of the open ports not being detected. Therefore, the detection effect of the relevant technology is poor.
[0004] Therefore, how to solve the problem of poor detection effect of related technologies is a technical problem that technical personnel in this field need to solve. Summary of the invention
[0005] In view of this, the purpose of the present application is to provide a port service identification method, a port service identification device, a port service identification equipment and a computer-readable storage medium, which solve the problem of poor detection effect in related technologies.
[0006] To solve the above technical problems, the present application provides a port service identification method, comprising:
[0007] Perform port detection on the target device to determine the target port;
[0008] Perform port service identification on the target port, and determine whether a TCP wrapper service is deployed on the target port;
[0009] If so, the target quantity is cumulatively updated;
[0010] If not, the target quantity is reset to zero;
[0011] When the target quantity is greater than a preset threshold, the port service identification is stopped.
[0012] Optionally, the performing port service identification on the target port and determining whether a TCP wrapper service is deployed on the target port includes:
[0013] Sending service detection data to the target port;
[0014] Determining whether the response data sent by the target port is received;
[0015] If the response data is not received, determining whether the connection with the target port is disconnected after the establishment time reaches a preset time;
[0016] If disconnected, it is determined that the TCP wrapper service is deployed on the target port.
[0017] Optionally, if the response data is received, determining that the TCP wrapper service is not deployed on the target port;
[0018] The response data is used to determine the port service provided by the target port.
[0019] Optionally, the determining the port service provided by the target port by using the response data includes:
[0020] Using the response data to match a preset regular expression;
[0021] Determine whether there is a target regular expression that successfully matches the response data;
[0022] If the target regular expression exists, the port service corresponding to the target port is determined according to the target regular expression.
[0023] Optionally, if the target regular expression does not exist, comprising:
[0024] Send target detection data respectively according to a preset order, and obtain target response data corresponding to the target detection data;
[0025] Determine whether the target response data matches the target preset regular expression corresponding to the target detection data successfully;
[0026] If the match is successful, the port service is determined according to the target preset regular expression;
[0027] If the match is unsuccessful, determining whether there is any unsent target detection data;
[0028] If not, the port service is determined as an unknown service.
[0029] Optionally, performing port detection on the target device to determine the target port includes:
[0030] Performing port detection on the target device to determine multiple open ports of the target device;
[0031] A first open port with the largest concurrent number is selected from the plurality of open ports as the target port.
[0032] Optionally, it also includes:
[0033] If the port service identification of any one of the target ports is completed, a second open port is selected from the open ports to replace the target port for which the port service identification is completed.
[0034] The present application also provides a port service identification device, comprising:
[0035] A detection module is used to perform port detection on the target device and determine the target port;
[0036] A judgment module, used for performing port service identification on the target port and judging whether a TCP wrapper service is deployed on the target port;
[0037] A first updating module, configured to cumulatively update the target quantity if a TCP wrapper service is deployed on the target port;
[0038] A second updating module, configured to clear the target quantity to zero if the target port is not deployed with a TCP wrapper service;
[0039] The stopping module is used to stop the port service identification when the target quantity is greater than a preset threshold.
[0040] The present application also provides a port service identification device, including a memory and a processor, wherein:
[0041] The memory is used to store the computer program;
[0042] The processor is used to execute the computer program to implement the above-mentioned port service identification method.
[0043] The present application also provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the above-mentioned port service identification method when executed by a processor.
[0044] The port service identification method provided in the present application performs port detection on the target device to determine the target port; performs port service identification on the target port and determines whether the target port has a TCP wrapper service deployed; if so, updates the target quantity based on the service identification status of the target port; if not, clears the target quantity to zero; when the target quantity is greater than a preset threshold, stops port service identification.
[0045] It can be seen that the method is provided with the concept of target number, which is used to indicate the number of target ports that are continuously detected to have TCP wrapper services deployed. After performing port detection on the target device, the target port that receives the port service detection is determined and the port service detection is performed on it. After determining that the target port is deployed with TCP wrapper services, the target number is updated according to the identification situation, that is, the number of target ports that are continuously detected to have TCP wrapper services deployed is updated. When the target number is greater than the preset threshold, it is considered that there are no ports on the target device that do not have TCP wrapper services deployed among the undetected ports, so the port service identification is stopped. If it is detected that there is a target port that does not have TCP wrapper services deployed, it means that there may be ports on the undetected ports that do not have TCP wrapper services deployed, so the target number is cleared to continue port service detection. By updating the target number and comparing it with the preset threshold, it is possible to avoid the situation where the detection must be stopped after the detection time reaches a fixed time, thereby improving the detection effect of the port service detection and solving the problem of poor detection effect of the related technology.
[0046] In addition, the present application also provides a port service identification device, a port service identification equipment and a computer-readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0048] Figure 1 A flow chart of a port service identification method provided in an embodiment of the present application;
[0049] Figure 2 A flow chart of a specific port service identification method provided in an embodiment of the present application;
[0050] Figure 3 A schematic diagram of the structure of a port service identification device provided in an embodiment of the present application;
[0051] Figure 4A structural diagram of a port service identification device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0053] Please refer to Figure 1 , Figure 1 A flow chart of a port service identification method provided in an embodiment of the present application. The method includes:
[0054] S101: Perform port detection on the target device to determine the target port.
[0055] The target device is specifically a network asset that is subject to detection, for example, it can be a server or computer of any model. Before performing port service identification on each port on the target device, it is necessary to determine how many available ports, i.e., open ports, the target device has. This embodiment does not limit the specific determination method for determining how many open ports the target device has, and reference can be made to the relevant technology, which will not be repeated here. After performing port detection on the target device, the target port can be determined, and the target port is the port that receives port service identification (or is called port service detection, service detection), and the number can be one or more. In one embodiment, the number of target ports can be one, that is, only the port service of a single port is identified each time. In another embodiment, in order to improve the detection efficiency and reduce the time required for port service identification, the number of target ports can be multiple, that is, port service identification is performed on multiple target ports at the same time during a port service identification process. Furthermore, since the time required for port service identification on each target port is not necessarily the same, in order to further improve efficiency, the port service identification of each target port can be concurrent, that is, the process of port service identification is independent of each other and does not affect each other. After the port service identification of any target port is completed, there is no need to wait for the port service identification of other target ports to be completed. In this implementation, if it is not necessary to stop the port service identification and there are unidentified open ports, one of the unidentified open ports can be designated as the target port and the port service identification can be performed on it.
[0056] Specifically, step S101 may include:
[0057] Step 11: Perform port detection on the target device to determine multiple open ports of the target device.
[0058] Step 12: Select the first open port with the largest concurrent number from the multiple open ports as the target port.
[0059] The specific method of port detection can refer to the relevant technology, which will not be described here. After port detection is performed on the target device, the number of open ports of the target device can be determined. According to actual needs, port detection can also obtain other information of the open ports, such as port numbers, etc. In this embodiment, in order to improve the port service identification efficiency of the target device, after multiple open ports are obtained by port detection on the target device, multiple first open ports are selected as target ports. It should be noted that the first open port is the open port designated as the target port when the target port is determined in the target device for the first time. The first open port can be any open port. At the same time, in order to avoid large computing resource consumption caused by port service identification, the maximum concurrent number can also be set, and the maximum concurrent number is the maximum number of target ports for simultaneous port service identification. That is, at any time, only the maximum concurrent number of open ports in the target device can be simultaneously identified for port service. Therefore, when the target port is selected for the first time, the maximum concurrent number of open ports can be selected as the target port.
[0060] Furthermore, when port service identification is performed in a concurrent manner, the following steps may also be included:
[0061] Step 21: If the port service identification of any target port is completed, a second open port is selected from the open ports to replace the target port for which the port service identification is completed.
[0062] It should be noted that before step 21, it is necessary to determine that the port service identification does not need to be stopped. If the port service identification process of any target port is completed, it can be determined that the service detection of the target port is completed. After the service detection of any target port is completed, a second open port can be selected from the open ports to replace the target port for which the service detection is completed. The second open port is any open port in the target device that has not undergone port service identification. Since port service identification is performed in a concurrent manner, the process of replacing any target port after the service detection is completed by the second open port will not affect the port service identification process of other target ports. At the same time, by replacing the target port for which the service detection is completed and detecting the new target port (i.e., the second open port), the port service identification efficiency of the target device can be further improved.
[0063] S102: Perform port service identification on the target port, and determine whether a TCP wrapper service is deployed on the target port.
[0064] The TCP wrapper service may be referred to as a TCP wrapper service or a TCP wrapped service. When the target port is identified as a port service, it may be determined whether the target port is deployed with a TCP wrapper service. The present embodiment does not limit the specific identification method of the TCP wrapper service, for example, it may be identified by utilizing the characteristics of the TCP wrapper service. Specifically, after the target port deployed with the TCP wrapper service establishes a connection with the unauthorized port, it will not respond to any data traffic sent by the unauthorized port, and will disconnect the connection with the unauthorized port after reaching a preset time. Therefore, the TCP wrapper service may be identified by determining whether the connection with the target port is disconnected after a preset time. After determining that the target port is deployed with a TCP wrapper service, step S103 may be entered, and after determining that the target port is not deployed with a TCP wrapper service, step S104 may be entered.
[0065] Specifically, in one implementation, step S102 may include:
[0066] Step 31: Send service detection data to the target port.
[0067] The service detection data is used to identify the port service of the target port, which can be specifically TCP traffic. The specific content of the service detection data is not limited, and its content can be request traffic, that is, traffic used to request port services. The service detection data can include request traffic corresponding to one port service, or can include request traffic corresponding to multiple port services, that is, the request traffic of multiple port services is combined to obtain service detection data, so as to detect multiple port services in the process of sending and receiving data at one time.
[0068] Step 32: Determine whether the response data sent by the target port is received.
[0069] After receiving the service detection data, if the target port can respond, it will send response data. In one embodiment, there is just a request flow corresponding to the port service of the target port in the service detection data. At this time, the target port can send the corresponding response data. In another possible embodiment, there is no request flow corresponding to the port service of the target port in the service detection data. At this time, although the target port has not received the request flow requesting the service of this port, it detects that it is being detected. At this time, it can also send the response data corresponding to the port service deployed on the target port, so that the detection device can determine what port service is deployed on the target port based on the response data. In another possible embodiment, there is no request flow corresponding to the port service of the target port in the service detection data. The target port detects that it is being detected. At this time, it can send fixed response data. The response data is not the response data corresponding to the port service deployed on the target port, and is only used for a simple response to the detection.
[0070] Step 33: If no response data is received, determine whether the connection with the target port is disconnected after the establishment time reaches a preset time.
[0071] The establishment duration is the duration that exists after the connection with the target port is established. If no response data is received, it may be that the computing power of the target device where the target port is located is poor, and it takes a long time to process and respond to the service detection data; or the network bandwidth between the target device and the port service identification device is small, and it takes a long time to send or receive data; or the target port is deployed with a TCP wrapper service and will not respond to the service detection data. At this time, in order to further determine whether the target port is deployed with a TCP wrapper service, it can be determined whether the connection with the target port is disconnected after the establishment duration reaches the preset duration, that is, it is identified according to the characteristics of the TCP wrapper service itself. This embodiment does not limit the specific size of the preset duration, which can be determined according to the TCP wrapper service itself, for example, it can be 4 seconds.
[0072] Step 34: If disconnected, determine that a TCP wrapper service is deployed on the target port.
[0073] If the connection with the target port is disconnected after reaching the preset duration, it can be determined that the target port is deployed with a TCP wrapper service. It should be noted that this embodiment does not limit the execution order of step 32 and step 33. For example, step 32 can be executed first, and then step 33, that is, first determine whether the response data is received, and determine whether to disconnect when the response data is not received; or step 32 and step 33 can be executed at the same time, that is, determine whether the response data is received, or disconnect at the same time, and stop determining whether to disconnect after receiving the response data. It should be noted that in order to improve the efficiency of port service identification, step 33 is generally not executed first, because the judgment duration of step 33 is a preset duration. When the preset duration is not reached, the target port may have sent the response data, which will result in reduced efficiency.
[0074] Further, if the response data sent by the target port is received, it can be determined that the target port does not deploy the TCP wrapper service. At this time, the response data can be used to determine the port service provided by the target port, so as to perform a deeper level of detection on the target port. In a possible implementation, the step of using the response data to determine the port service provided by the target port may include:
[0075] Step 41: Use the response data to match the preset regular expression.
[0076] The preset regular expression is a regular expression (Regular Expression), which can also be called a regular expression. There are multiple regular expressions, and different preset regular expressions correspond to different request data one by one, and there is a one-to-one correspondence between the unused request data and different port services. The preset regular expression is used to match the response data, and then identify the port service deployed on the target port. After the response data is obtained, it is matched with each preset regular expression one by one. The specific matching method is not limited in this embodiment, and reference can be made to the relevant technology.
[0077] Step 42: Determine whether there is a target regular expression that successfully matches the response data.
[0078] Step 43: If a target regular expression exists, the port service corresponding to the target port is determined according to the target regular expression.
[0079] If there is a target regular expression that successfully matches the response data, it means that the response data is used to correspond to the request data corresponding to the target regular expression, and the port service deployed on the target port is the port service corresponding to the target regular expression. Therefore, the port service corresponding to the target port can be determined according to the target regular expression.
[0080] Further, if there is no target regular expression, that is, no preset regular expression matches the response data, it means that the port service of the target port cannot be determined. At this time, the port service can be further determined. If there is no target regular expression, it can also include:
[0081] Step 51: Send target detection data respectively in a preset order, and obtain target response data corresponding to the target detection data.
[0082] Step 52: Determine whether the target response data and the target preset regular expression corresponding to the target detection data are matched successfully.
[0083] Step 53: If the match is successful, the port service is determined according to the target preset regular expression.
[0084] Step 54: If the match is unsuccessful, determine whether there is any unsent target detection data.
[0085] Step 55: If it does not exist, the port service is determined as an unknown service.
[0086] The target detection data is the request data corresponding to various port services. In order to determine the port service of the target port, each target detection data can be sent to the target port in sequence according to the preset order, and the target response data corresponding to the target detection data sent by the target port can be received. It should be noted that the specific content of the preset order is not limited, for example, it can be an order from high to low in terms of applicability. The applicability corresponds to the port service, specifically the probability that the target port is deployed with a port service of a corresponding category. After receiving the target response data, it can be determined whether the target preset regular expression corresponding to the target detection data matches successfully. If the match is successful, it means that the port service corresponding to the target preset regular expression is the port service deployed by the target port, so the port service of the target port is determined according to the target preset regular expression. If the match is unsuccessful, it is determined whether there is unsent target detection data. If so, the target detection data is continued to be sent in the preset order; if not, the port service of the target port is determined as an unknown service, and the port service identification process of the target port is completed.
[0087] S103: cumulatively updating the target quantity.
[0088] The target quantity is the number of target ports that are continuously detected to have TCP wrapper services deployed. After determining that a TCP wrapper service is deployed on a target port, the target quantity can be cumulatively updated. Specifically, if there are multiple target ports, when any target port is identified to have a TCP wrapper service deployed, the target quantity needs to be cumulatively updated to record the number of target ports that are continuously detected to have TCP wrapper services deployed. The cumulative update can be a linear accumulation, that is, when it is detected that a TCP wrapper service is deployed on a target port, a fixed value is added to the target quantity, such as one each time. In another possible implementation, the cumulative update can be a nonlinear accumulation, which is not limited in this embodiment.
[0089] S104: Clear the target quantity.
[0090] After determining that the target port has no TCP wrapper service deployed, it means that there may be open ports of other services that have no TCP wrapper service deployed on the target device, so the target device is still worth detecting. Therefore, the target number can be reset to zero in order to re-accumulate the number of target ports that have been continuously detected with TCP wrapper services deployed.
[0091] S105: When the target quantity is greater than a preset threshold, stop port service identification.
[0092] When the number of targets is greater than the preset threshold, it means that the number of ports with TCP wrapper services deployed is large, and the target device may not have open ports with other services deployed. Therefore, the target device no longer has detection value, and port service identification can be stopped. This embodiment does not limit the specific size of the preset threshold, for example, it can be 50. It should be noted that this embodiment does not limit the timing of detecting whether the number of targets is greater than the preset threshold, for example, it can be detected in real time, or it can be detected according to a preset period. Preferably, step S105 can be performed every time the number of targets changes, that is, after step S103 is completed or step S104 is completed, the number of targets is compared with the preset threshold; or the number of targets can be compared with the preset threshold only after step S103 is completed. In another embodiment, the number of targets may not be greater than the preset threshold, and this embodiment does not limit the operations performed in this case, for example, the port service identification process of other target ports can be waited for to end, or when a concurrent method is adopted, other open ports that have not been detected can be selected to replace the target port that has been detected, or a preset operation can be performed, and this embodiment does not limit this.
[0093] The port service identification method provided by the embodiment of the present application is applied, and the concept of target number is set, and the target number is used to represent the number of target ports that are continuously detected to be deployed with TCP wrapper service. After port detection is performed on the target device, the target port that receives the port service detection is determined and the port service detection is performed on it. After determining that the target port is deployed with TCP wrapper service, the target number is updated according to the identification situation, that is, the number of target ports that are continuously detected to be deployed with TCP wrapper service is updated. When the target number is greater than the preset threshold, it is considered that there is no port on the target device that does not deploy TCP wrapper service among the undetected ports, so the port service identification is stopped. If it is detected that there is a target port that does not deploy TCP wrapper service, it means that there may be a port that does not deploy TCP wrapper service among the undetected ports, so the target number is cleared to continue port service detection. By updating the target number and comparing it with the preset threshold, the situation where the detection must be stopped after the detection time reaches a fixed time can be avoided, the detection effect of port service detection is improved, and the problem of poor detection effect of related technologies is solved.
[0094] Based on the above embodiment, this embodiment will specifically describe several steps in the above embodiment. Figure 2 , Figure 2 A flow chart of a specific port service identification method provided in an embodiment of the present application.
[0095] 1. After scanning and finding that the target device has multiple open TCP ports (i.e., open ports), according to the setting requirements of the scanning task, select N target ports from the scanned open port results and use the service detection method to perform concurrent service detection. The detection process of each target port does not affect each other.
[0096] 2. According to the service detection method, establish a TCP connection with each target port, assemble different data packets to obtain a request packet (i.e., service detection data) and send it, and try to receive the result (i.e., response data). This is the normal service detection process.
[0097] 3. Set up a TCPwrapped counter R related to the target device (for example, related to the IP address of the target device), and make the following judgment based on the result obtained in step 2:
[0098] 3.1. If a service named TCPwrapped is detected, the counter R is incremented. That is, the TCPwrapped count is increased by 1.
[0099] 3.1.1. If the value of the counter R reaches the threshold value 50, the service identification is terminated, otherwise continue to step 4.
[0100] 3.2. Otherwise, clear the counter R to 0, that is, clear the TCPwrapped count to 0, and proceed to step 4.
[0101] 4. Determine whether all port services have been identified. If so, complete the scan; otherwise, jump to step 1.
[0102] Specifically, step 2 may include:
[0103] 2.1. Establish a TCP connection with the target TCP port and try to receive data actively sent by the target service within 5 seconds. If the server directly disconnects within 5 seconds, it is determined to be a TCPwrapped service.
[0104] 2.2. Maintain a fingerprint database, which stores multiple sets of regular expressions and service names. Specifically, group them according to the sent information (i.e. the corresponding data packets to be sent). In addition, the port number applicable to each set of information and the applicable probability can also be included; the format of the fingerprint database includes but is not limited to text and database. The fingerprint database is used to specify the content of the sent data and match the received response data with the regular expression. If the match is successful, it can be determined as the corresponding service.
[0105] 2.3. If the target service actively sends data in step 2.1, the fingerprint database described in step 2.2 is used for matching. If the match is successful, the result service can be obtained and the detection is completed.
[0106] 2.4. If the target service does not actively send data in step 2.1, or the received data fails to match any regular expression, the data packets are sent and received in descending order according to the applicable probability. If the received data packets can match the corresponding regular expression, the final service type can be determined. If all the information in the fingerprint database has executed the above steps and still cannot match the service, it means that the target service is unknown.
[0107] The following is an introduction to a port service identification device provided in an embodiment of the present application. The port service identification device described below and the port service identification method described above can be referenced to each other.
[0108] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of a port service identification device provided in an embodiment of the present application includes:
[0109] The detection module 110 is used to perform port detection on the target device and determine the target port;
[0110] The determination module 120 is used to identify the port service of the target port and determine whether the target port is deployed with a TCP wrapper service;
[0111] A first updating module 130 is used to cumulatively update the target quantity if a TCP wrapper service is deployed on the target port;
[0112] A second updating module 140 is configured to clear the target quantity if the target port is not deployed with a TCP wrapper service;
[0113] The stopping module 150 is used to stop the port service identification when the target quantity is greater than a preset threshold.
[0114] Optionally, the judging module 120 includes:
[0115] A data sending unit, used for sending service detection data to a target port;
[0116] A receiving judgment unit, used for judging whether the response data sent by the target port is received;
[0117] A disconnection determination unit, for determining whether the connection with the target port is disconnected after the establishment time reaches a preset time if no response data is received;
[0118] The first service determination unit is used to determine whether a TCP wrapper service is deployed on the target port if disconnected.
[0119] Optionally, the judging module 120 includes:
[0120] a second service determination unit, configured to determine that the target port does not have a TCP wrapper service deployed thereon if the response data is received;
[0121] The port service determination unit is used to determine the port service provided by the target port using the response data.
[0122] Optionally, the port service determination unit includes:
[0123] A matching subunit, used to match the response data with a preset regular expression;
[0124] The first judgment subunit is used to judge whether there is a target regular expression that successfully matches the response data;
[0125] The first determination subunit is used to determine the port service corresponding to the target port according to the target regular expression if there is a target regular expression.
[0126] Optionally, the port service determination unit includes:
[0127] The sending subunit is used to send the target detection data respectively in a preset order and obtain the target response data corresponding to the target detection data;
[0128] The second judgment subunit is used to judge whether the target response data and the target preset regular expression corresponding to the target detection data are matched successfully;
[0129] A second determination subunit is used to determine the port service according to a target preset regular expression if the match is successful;
[0130] A third judgment subunit is used to judge whether there is unsent target detection data if the match is unsuccessful;
[0131] The third determining subunit is used to determine the port service as an unknown service if it does not exist.
[0132] Optionally, the detection module 110 includes:
[0133] An open port determination unit, used to perform port detection on a target device and determine a plurality of open ports of the target device;
[0134] The target port selection module is used to select the first open port with the largest concurrent number from multiple open ports as the target port.
[0135] Optionally, it also includes:
[0136] The replacement module is used for selecting a second open port from the open ports to replace the target port for which the port service identification has been completed if the port service identification of any target port has been completed.
[0137] The following is an introduction to a port service identification device provided in an embodiment of the present application. The port service identification device described below and the port service identification method described above can be referenced to each other.
[0138] Please refer to Figure 4 , Figure 4 The structure diagram of a port service identification device provided in an embodiment of the present application is shown in FIG. The port service identification device 100 may include a processor 101 and a memory 102 , and may further include one or more of a multimedia component 103 , an information input / information output (I / O) interface 104 , and a communication component 105 .
[0139] The processor 101 is used to control the overall operation of the port service identification device 100 to complete all or part of the steps in the above-mentioned port service identification method; the memory 102 is used to store various types of data to support the operation of the port service identification device 100, and these data may include, for example, instructions for any application or method used to operate on the port service identification device 100, and data related to the application. The memory 102 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.
[0140] The multimedia component 103 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone, which is used to receive external audio signals. The received audio signal may be further stored in the memory 102 or sent through the communication component 105. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 104 provides an interface between the processor 101 and other interface modules, and the above-mentioned other interface modules may be a keyboard, a mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 105 is used for wired or wireless communication between the port service identification device 100 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 105 may include: Wi-Fi component, Bluetooth component, NFC component.
[0141] The port service identification device 100 can be implemented by one or more application specific integrated circuits (Application Specific Integrated Circuit, referred to as ASIC), digital signal processors (Digital Signal Processor, referred to as DSP), digital signal processing devices (Digital Signal Processing Device, referred to as DSPD), programmable logic devices (Programmable Logic Device, referred to as PLD), field programmable gate arrays (Field Programmable Gate Array, referred to as FPGA), controllers, microcontrollers, microprocessors or other electronic components, and is used to execute the port service identification method given in the above embodiment.
[0142] The computer-readable storage medium provided in the embodiment of the present application is introduced below. The computer-readable storage medium described below and the port service identification method described above can be referenced to each other.
[0143] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned port service identification method are implemented.
[0144] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.
[0145] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.
[0146] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0147] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0148] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.
[0149] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A port service identification method, characterized in that: include: Perform port detection on the target device to determine the target port, wherein the target number is used to represent the number of target ports that are continuously detected and deployed with the TCP wrapper service; Perform port service identification on the target port, and determine whether a TCP wrapper service is deployed on the target port; If so, the target quantity is cumulatively updated; If not, the target quantity is reset to zero; When the target quantity is greater than a preset threshold, it is considered that there is no port without a TCP wrapper service deployed among the undetected ports on the target device, and the port service identification is stopped; If it is detected that there is a target port for which no TCP wrapper service is deployed, the target quantity is cleared to zero so as to continue the port service detection.
2. The port service identification method according to claim 1, characterized in that: The performing port service identification on the target port and determining whether a TCP wrapper service is deployed on the target port includes: Sending service detection data to the target port; Determining whether the response data sent by the target port is received; If the response data is not received, determining whether the connection with the target port is disconnected after the establishment time reaches a preset time; If disconnected, it is determined that the TCP wrapper service is deployed on the target port.
3. The port service identification method according to claim 2, characterized in that: If the response data is received, determining that the TCP wrapper service is not deployed on the target port; The response data is used to determine the port service provided by the target port.
4. The port service identification method according to claim 3, characterized in that: The step of using the response data to determine the port service provided by the target port includes: Using the response data to match a preset regular expression; Determine whether there is a target regular expression that successfully matches the response data; If the target regular expression exists, the port service corresponding to the target port is determined according to the target regular expression.
5. The port service identification method according to claim 4, characterized in that: After determining whether there is a target regular expression that successfully matches the response data, the method further includes: If the target regular expression does not exist, the target detection data are sent respectively in a preset order, and the target response data corresponding to the target detection data are obtained; Determine whether the target response data matches the target preset regular expression corresponding to the target detection data successfully; If the match is successful, the port service is determined according to the target preset regular expression; If the match is unsuccessful, determining whether there is any unsent target detection data; If not, the port service is determined as an unknown service.
6. The port service identification method according to any one of claims 1 to 5, characterized in that: The performing port detection on the target device to determine the target port includes: Performing port detection on the target device to determine multiple open ports of the target device; A first open port with the largest concurrent number is selected from the plurality of open ports as the target port.
7. The port service identification method according to claim 6, characterized in that: Also includes: If the port service identification of any one of the target ports is completed, a second open port is selected from the open ports to replace the target port for which the port service identification is completed.
8. A port service identification device, characterized in that: include: A detection module, used to perform port detection on a target device to determine a target port, wherein the target number is used to indicate the number of target ports that are continuously detected and deployed with a TCP wrapper service; A judgment module, used for performing port service identification on the target port and judging whether a TCP wrapper service is deployed on the target port; A first updating module, configured to cumulatively update the target quantity if a TCP wrapper service is deployed on the target port; A second updating module, configured to clear the target quantity to zero if the target port is not deployed with a TCP wrapper service; A stopping module, configured to, when the number of targets is greater than a preset threshold, deem that there is no port on which the TCP wrapper service is not deployed among the undetected ports on the target device, and stop the port service identification; Also used for: If it is detected that there is a target port for which no TCP wrapper service is deployed, the target quantity is cleared to zero so as to continue the port service detection.
9. A port service identification device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store the computer program; The processor is used to execute the computer program to implement the port service identification method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the port service identification method according to any one of claims 1 to 7 is implemented.