Method and device for identifying asset properties based on network traffic mirroring

Abstract

The present disclosure provides a method and device for identifying the nature of assets based on network traffic mirroring, wherein the method includes: obtaining mirrored traffic data of core network devices at the border; extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data; processing the extracted information to obtain final extracted information; comparing the final extracted information with data in an existing asset database to determine shadow assets and / or abandoned assets corresponding to the existing asset database. The present disclosure can timely identify unknown and / or abandoned network assets in an organization. By automatically identifying assets to be updated, timely updates are driven and security management is increased, which makes up for problems such as untimely, incomplete, and long cycles of manual inventory of assets and reduces security risks caused by shadow and / or abandoned assets.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method and device for identifying asset properties based on network traffic mirroring. Background Art

[0002] With the rapid development of the Internet, enterprises supporting industrial development have exposed the problem of unified security control of assets. Enterprises now mostly use existing asset management systems to implement asset management and update the asset library through manual periodic inventory. However, due to the long cycle and incompleteness (forgetfulness, mistakes) of manual asset update, a small number of assets will be in a state of not being securely controlled, also known as shadow assets. If they are not controlled, they are very likely to be vulnerable. Asset vulnerability hides threats and may bring irreversible security risks to the organization. Maintaining the existing asset management system is a labor-intensive and time-consuming task. It often happens that assets are not stored, asset changes are not updated, forgotten, or isolated shadow assets are not under security control, and changed and abandoned assets are not updated (these assets may have been returned to other external organizations), but they still exist in the asset management database. Security has a barrel effect. Attackers look for the most vulnerable assets of the organization to launch attacks. These shadow assets are likely to be the weakest assets. In addition, asset inventory requires the participation of various business lines, departments, and operation and maintenance teams to check and update network asset data, which is very inefficient, resulting in additional costs for continuous security control of the organization. Summary of the invention

[0003] The present invention provides a method and device for identifying the nature of assets based on network traffic mirroring, which is used to solve the defect of low efficiency of manually maintaining asset database in the prior art, realize automatic identification of assets to be updated, drive timely update and increase security management and control.

[0004] In a first aspect, the present disclosure provides a method for identifying asset properties based on network traffic mirroring, comprising:

[0005] Obtain mirrored traffic data from core network devices at the border;

[0006] Extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data;

[0007] Processing the extracted information to obtain final extracted information;

[0008] The final extracted information is compared with the data in the existing asset database to determine the shadow assets and / or abandoned assets corresponding to the existing asset database.

[0009] According to a method for identifying asset properties based on network traffic mirroring provided by the present disclosure, obtaining mirrored traffic data of a core network device at a border includes:

[0010] Obtain mirrored traffic data of network devices located at the junction of the organization's intranet and the Internet, which receive and transmit traffic between the organization's intranet and the Internet;

[0011] or,

[0012] Obtain mirrored traffic data of network devices located at the connection between different data centers within the organization's local area network, receiving and transmitting data exchanges between different data centers;

[0013] or,

[0014] Obtain the mirrored traffic data of network devices located at the connection point of different business data lines within the organization's local area network, which receive and transmit data interactions of different business data lines.

[0015] According to a method for identifying the nature of an asset based on network traffic mirroring provided by the present disclosure, wherein extracting information from the mirrored traffic data to obtain the extracted information of the mirrored traffic data specifically includes:

[0016] Extracting information from the mirrored traffic data to obtain five-tuple information of the mirrored traffic data;

[0017] or,

[0018] Extracting information from the mirrored traffic data to obtain quintuple information and application fingerprint information of the mirrored traffic data;

[0019] The five-tuple information includes the source address, destination address, protocol, source port and destination port of the mirrored traffic data.

[0020] According to a method for identifying the nature of an asset based on network traffic mirroring provided by the present disclosure, the step of processing the extracted information to obtain the final extracted information specifically includes:

[0021] Preprocessing the extracted information to obtain preprocessed extracted information;

[0022] storing the preprocessed extracted information in a database;

[0023] The pre-processed extracted information stored in the database is reprocessed to obtain final extracted information.

[0024] According to a method for identifying the nature of an asset based on network traffic mirroring provided by the present disclosure, the method of comparing the final extracted information with the data in an existing asset database to determine the shadow assets in the existing asset database specifically includes:

[0025] Comparing the final extracted information with the data in the existing asset database to determine a portion of the final extracted information that has a corresponding relationship with the data;

[0026] Removing part of the final extracted information corresponding to the data, and using the asset data corresponding to the remaining final extracted information as shadow assets in the existing asset database;

[0027] The comparing the final extracted information with the data in the existing asset database to determine the abandoned assets in the existing asset database specifically includes:

[0028] Comparing the data in the existing asset database with the final extracted information to determine a portion of the data that has a corresponding relationship with the final extracted information;

[0029] Part of the data corresponding to the final extracted information is removed, and the remaining data in the existing asset database is used as abandoned data of the existing asset database.

[0030] According to a method for identifying the nature of an asset based on network traffic mirroring provided by the present disclosure, the preprocessing of the extracted information to obtain the preprocessed extracted information specifically includes:

[0031] Dividing the extracted information according to unit time to obtain the extracted information within the unit time;

[0032] The extracted information within the unit time is pre-processed by de-duplication and noise reduction to obtain the pre-processed extracted information.

[0033] According to a method for identifying the nature of an asset based on network traffic mirroring provided by the present disclosure, the pre-processed extracted information stored in the database is reprocessed to obtain the final extracted information, specifically including:

[0034] Determining the acquisition source of the preprocessed extracted information;

[0035] If the acquisition source of the pre-processed extracted information is the device located at the connection between the organization's intranet and the Internet, extracting the extracted information corresponding to the unidirectional flow in the inbound direction from the pre-processed extracted information;

[0036] If the source of the preprocessed extracted information is the device located at the connection of different data centers within the institution's local area network or the device located at the connection of different business data lines within the institution's local area network, the extracted information corresponding to the unidirectional traffic in the output direction is extracted from the preprocessed extracted information.

[0037] In a second aspect, the present disclosure provides an asset property identification device based on network traffic mirroring, comprising:

[0038] A first processing module is used to obtain mirrored traffic data of a core network device at a border;

[0039] A second processing module is used to extract information from the mirrored traffic data to obtain extracted information of the mirrored traffic data;

[0040] A third processing module, used for processing the extracted information to obtain final extracted information;

[0041] The fourth processing module is used to compare the final extracted information with the data in the existing asset database to determine the shadow assets and / or abandoned assets in the asset database.

[0042] In a third aspect, the present disclosure also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for identifying the properties of an asset based on network traffic mirroring as described in any one of the above are implemented.

[0043] In a fourth aspect, the present disclosure further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described methods for identifying asset properties based on network traffic mirroring.

[0044] The present disclosure provides a method and device for identifying the nature of assets based on network traffic mirroring, which obtains the mirrored traffic data of the core device at the boundary, and then processes the obtained traffic data to obtain processed information of the traffic data, and compares the obtained processed information with the asset data in the existing asset database, thereby determining the shadow assets and / or abandoned assets corresponding to the existing asset database. The present disclosure automatically identifies unknown network assets in the organization, asset drivers to be updated, and updates them in a timely manner to increase security control, make up for the problems of untimely, incomplete, and long-cycle manual inventory of assets, and reduce the security risks caused by shadow assets and abandoned assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 It is a flowchart of the method for identifying the nature of assets based on network traffic mirroring provided by the present disclosure;

[0047] Figure 2 It is a schematic diagram of the three-layer structure of the enterprise network provided by the present disclosure;

[0048] Figure 3 It is a structural schematic diagram of an asset property identification device based on network traffic mirroring provided by the present disclosure;

[0049] Figure 4 It is a schematic diagram of the structure of an electronic device provided by the present disclosure. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of the present disclosure.

[0051] Combine the following Figure 1 The method for identifying the property of an asset based on network traffic mirroring provided by an embodiment of the present disclosure includes:

[0052] Step 100: Obtain mirrored traffic data of the core device at the border;

[0053] Specifically, since the present disclosure needs to determine the nature of the assets in the existing asset database, it is obtained by comparing the flow data of the assets with the data in the existing asset database. Therefore, when determining the flow data of the assets, the core device at the boundary is selected to collect comprehensive asset data. In the present disclosure, the bidirectional traffic mirrored from the network traffic is passed to the application to be processed through the mature network traffic mirroring technology of the routing switching device. Among them, mirroring refers to copying a message passing through a designated port (source port or mirror port) to another designated port (destination port or observation port). Mirroring can copy a message from the mirror port to the observation port without affecting the normal processing of the message by the device.

[0054] Step 200: extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data;

[0055] Specifically, after receiving the mirrored traffic data, the acquired mirrored traffic data is not used directly, because the information in the acquired mirrored traffic data is of various types, and many types of information are not very useful for judging the nature of assets in the asset library. Therefore, in the present disclosure, information is extracted from the mirrored traffic data, and the extracted information is used to judge the data in the asset database.

[0056] Step 300: Process the extracted information to obtain final extracted information;

[0057] Specifically, after the extracted information of the mirrored traffic data is obtained, the extracted information is further processed to further refine the traffic data and reduce noise and redundancy of the information.

[0058] Step 400: Compare the final extracted information with the data in the existing asset database to determine the shadow assets and / or abandoned assets corresponding to the existing asset database.

[0059] Specifically, after processing the mirrored traffic data, the processed mirrored traffic data is compared with the data in the existing asset database to determine the asset data not included in the existing asset database and the data included in the existing asset database but not reflected in the mirrored traffic data. These two parts of data are regarded as shadow assets and abandoned assets.

[0060] The present disclosure provides a method for identifying the nature of assets based on network traffic mirroring, which obtains the mirrored traffic data of the core device at the boundary, and then processes the obtained traffic data to obtain processed information of the traffic data, and compares the obtained processed information with the asset data in the existing asset database, thereby determining the shadow assets and / or abandoned assets corresponding to the existing asset database. The present disclosure automatically identifies unknown network assets in the organization, asset drivers to be updated, and updates them in a timely manner to increase security control, make up for the problems of untimely, incomplete, and long-cycle manual inventory of assets, and reduce security risks caused by shadow assets and abandoned assets.

[0061] According to an embodiment of the present disclosure, a method for identifying asset properties based on network traffic mirroring is provided, wherein the mirrored traffic data of a core device at a border is obtained, including:

[0062] Obtain mirrored traffic data of network devices located at the junction of the organization's intranet and the Internet, which receive and transmit traffic between the organization's intranet and the Internet;

[0063] or,

[0064] Obtain mirrored traffic data of network devices located at the connection between different data centers within the organization's local area network, receiving and transmitting data exchanges between different data centers;

[0065] or,

[0066] Obtain the mirrored traffic data of network devices located at the connection point of different business data lines within the organization's local area network, which receive and transmit data interactions of different business data lines.

[0067] Specifically, combined Figure 2 The three-layer structure of the enterprise network shown in the figure is explained. The inventory needs to collect traffic network devices. These devices are preferably core devices at the edge. After selection, the traffic of these devices should cover the communication traffic between the company's intranet and the Internet (such as Figure 2 R1, R2), network traffic across computer rooms and business lines within the company (such as Figure 2 SW1, SW2) etc. Among them, R1 and R2 are devices located at the connection between the organization's intranet and the Internet, receiving and transmitting traffic between the organization's intranet and the Internet; SW1 and SW2 are devices located at the connection between different data centers within the organization's LAN, receiving and transmitting data interactions between different data centers.

[0068] According to an embodiment of the present disclosure, a method for identifying the nature of an asset based on network traffic mirroring is provided, wherein the extracting information from the mirrored traffic data to obtain the extracted information of the mirrored traffic data specifically includes:

[0069] Extracting information from the mirrored traffic data to obtain five-tuple information of the mirrored traffic data;

[0070] or,

[0071] Extracting information from the mirrored traffic data to obtain quintuple information and application fingerprint information of the mirrored traffic data;

[0072] The five-tuple information includes the source address, destination address, protocol, source port and destination port of the mirrored traffic data.

[0073] Specifically, the data of the network traffic mirror is received, and the asset information can be extracted through DPI technology (NIDS products use this technology and can be reused) to extract the five-tuple information (source IP, destination IP, protocol, source port, destination port) and application fingerprint information in the network data packet. Many flows are encrypted, and application fingerprint information is not easy to obtain in encrypted flows. Application information is the payload information of assets and is not necessary information, so it is not necessary to extract this information.

[0074] According to an embodiment of the present disclosure, a method for identifying the nature of an asset based on network traffic mirroring is provided, wherein the processing of the extracted information to obtain the final extracted information specifically includes:

[0075] Preprocessing the extracted information to obtain preprocessed extracted information;

[0076] storing the preprocessed extracted information in a database;

[0077] The pre-processed extracted information stored in the database is reprocessed to obtain final extracted information.

[0078] Specifically, because the network flow throughput of some organizations is very large, it is difficult to implement the project of storing the full amount of traffic. After extracting the information, you can pre-process the information first. You can use Flink, Flume, Spark and other stream processing technologies to pre-process the traffic information in unit time, such as deduplication and noise reduction, to reduce the amount of data in the database and storage costs. After extracting the information, store it in the database. The extracted five-tuple and fingerprint information can be directly written into HDFS. After storage, the data is cleaned and extracted again through big data technology. For the traffic facing the Internet side, such as R1 and R2, you can extract the five-tuple information of the unidirectional inbound traffic (destination IP, protocol, destination port). These assets are assets facing the public network. For the traffic within the organization, such as SW1 and SW2, you can extract the unidirectional traffic in the outbound direction. These assets are assets marked with private network addresses within the company. You can also traverse and extract the traffic of the access layer device (such as: s1, etc.). Among them, the inbound direction refers to copying the message received by the mirror port to the observation port. The outbound direction refers to copying the message sent by the mirror port to the observation port. Bidirectional means that the messages received and sent by the mirror port are copied to the observation port. The more complete the collected data is, the more accurate the attack surface convergence from the Internet side is, and the asset data after logical cleaning is written into an independent asset library.

[0079] According to an embodiment of the present disclosure, a method for identifying the nature of an asset based on network traffic mirroring is provided, wherein the finally extracted information is compared with data in an existing asset database to determine the shadow assets in the existing asset database, specifically including:

[0080] Comparing the final extracted information with the data in the existing asset database to determine a portion of the final extracted information that has a corresponding relationship with the data;

[0081] Removing part of the final extracted information corresponding to the data, and using the asset data corresponding to the remaining final extracted information as shadow assets in the existing asset database;

[0082] The comparing the final extracted information with the data in the existing asset database to determine the abandoned assets in the existing asset database specifically includes:

[0083] Comparing the data in the existing asset database with the final extracted information to determine a portion of the data that has a corresponding relationship with the final extracted information;

[0084] Part of the data corresponding to the final extracted information is removed, and the remaining data in the existing asset database is used as abandoned data of the existing asset database.

[0085] Specifically, the data (IP, protocol, port) in the asset library is extracted through traffic, and a two-way comparison is performed with the assets in the company's existing asset library CMDB. Since the IP is unique to the asset data, the asset data can be compared based on the IP address. If the IP addresses are the same, the traffic asset data is considered to be the same as the data in the existing asset database. Under the premise that the IP addresses are the same, further confirmation can be performed based on the data's protocol or port to determine whether the data is the same.

[0086] On the one hand, the CMDB is checked through the asset library data extracted from the traffic. If there is a hit, the data is a known asset. If there is no hit, it is a shadow asset, that is, an unknown asset that has not been included in security management. These assets need to be quickly located through the collected five-tuple information and application fingerprints, and the business line to which the asset belongs needs to be manually confirmed to update the company's CMDB asset library and add security management. For example, if an asset is forgotten and has a security vulnerability, hackers may use the asset to launch an attack and cause organizational losses, but through this technology, the asset can be discovered in time and included in security management, and timely security reinforcement can avoid being attacked.

[0087] On the other hand, the company's CMDB assets collide with the asset library data collected by traffic. If they are matched, it means that they are known normal assets. If the query does not match for a long time (January, March, June), the asset is likely to be faulty, offline, or abandoned. You need to contact the CMDB historical record information, confirm with the owner, and update the CMDB (delete) record. At the same time, the asset is also removed from security management. For example, there is a public network IP organization that has been returned to the operator, but the organization has not manually updated the asset library CMDB. The IP asset is still alive and is still used by other organizations. The security team continues to monitor the asset (such as vulnerability scanning), which increases certain costs and security risks. The asset is tested without authorization. This technology can promptly discover that the asset has no traffic in the company's boundary network, which can drive the business to update the asset information in time, reducing the security operation of the asset.

[0088] In summary, the IP, protocol, port, application fingerprint and other data in the network data packet are extracted through the network traffic mirroring technology in the enterprise. After storage and cleaning, they are compared with the data in the company's existing CMDB database. Assets that are not in the CMDB are shadow assets. It is necessary to extract these shadow assets, manually confirm and update the company's CMDB asset library on a small scale. Add these shadow assets to security management and control to improve the level of enterprise security construction and ensure the sustainable development of the organization. On the other hand, by comparing the existing asset data in the company's CMDB library with the asset library collected by network traffic mirroring, assets with no traffic for a long time are found, and whether they have been abandoned are confirmed, etc. The assets are deleted from the CMDB and the operation of the assets is stopped, saving security operation expenses.

[0089] According to an embodiment of the present disclosure, a method for identifying the nature of an asset based on network traffic mirroring is provided, wherein the preprocessing of the extracted information to obtain the preprocessed extracted information specifically includes:

[0090] Dividing the extracted information according to unit time to obtain the extracted information within the unit time;

[0091] The extracted information within the unit time is pre-processed by de-duplication and noise reduction to obtain the pre-processed extracted information.

[0092] Specifically, because the flow throughput of some organizations is very large, it is difficult to implement a project to store the full flow. After extracting the information, you can pre-process the information first. You can use stream processing technologies such as Flink, Flume, and Spark to pre-process the flow information in unit time by deduplication and noise reduction, etc., to reduce the amount of data entered into the warehouse and reduce storage costs.

[0093] According to an embodiment of the present disclosure, a method for identifying the nature of an asset based on network traffic mirroring is provided, wherein the pre-processed extracted information stored in the database is reprocessed to obtain the final extracted information, specifically including:

[0094] Determining the acquisition source of the preprocessed extracted information;

[0095] If the acquisition source of the pre-processed extracted information is the device located at the connection between the organization's intranet and the Internet, extracting the extracted information corresponding to the unidirectional flow in the inbound direction from the pre-processed extracted information;

[0096] If the source of the preprocessed extracted information is the device located at the connection of different data centers within the institution's local area network or the device located at the connection of different business data lines within the institution's local area network, the extracted information corresponding to the unidirectional traffic in the output direction is extracted from the preprocessed extracted information.

[0097] Specifically, the information is extracted and stored in the database. The extracted five-tuple and fingerprint information can be directly written into HDFS. After storage, the data is cleaned and extracted again through big data technology. The five-tuple information of the one-way incoming traffic (destination IP, protocol, destination port) can be extracted on R1 and R2 for the traffic facing the Internet side. These assets are assets facing the public network. The one-way traffic in the outgoing direction can be extracted on SW1 and SW2 for the traffic within the organization. These assets are assets marked with private network addresses within the company. The traffic of the access layer devices (such as s1, etc.) can also be traversed and extracted. The device coverage of the extracted traffic is nearly complete. The more complete the collected data is, the more accurate the attack surface convergence from the Internet side is, and the asset data after logical cleaning is written into an independent asset library.

[0098] Combination Figure 3 As shown, the present disclosure provides an asset property identification device based on network traffic mirroring, comprising:

[0099] The first processing module 31 is used to obtain the mirrored traffic data of the core network device at the border;

[0100] A second processing module 32 is used to extract information from the mirrored traffic data to obtain extracted information of the mirrored traffic data;

[0101] A third processing module 33 is used to process the extracted information to obtain final extracted information;

[0102] The fourth processing module 34 is used to compare the final extracted information with the data in the existing asset database to determine the shadow assets and / or abandoned assets in the asset database.

[0103] Since the device provided in the embodiment of the present invention can be used to execute the method described in the above embodiment, its working principle and beneficial effects are similar, so they are not described in detail here. For specific contents, please refer to the introduction of the above embodiment.

[0104] The present disclosure provides an asset property identification device based on network traffic mirroring, which obtains the mirrored traffic data of the core device at the boundary, and then processes the obtained traffic data to obtain processed information of the traffic data, and compares the obtained processed information with the asset data in the existing asset database, thereby determining the shadow assets and / or abandoned assets corresponding to the existing asset database. The present disclosure automatically identifies unknown network assets in the organization, asset drivers to be updated, and updates them in a timely manner to increase security control, make up for the problems of untimely, incomplete, and long-cycle manual inventory of assets, and reduce security risks caused by shadow assets and abandoned assets.

[0105] According to the device for identifying the property of an asset based on network traffic mirroring provided by the present invention, the first processing module 31 is specifically used for:

[0106] Obtain mirrored traffic data of network devices located at the junction of the organization's intranet and the Internet, which receive and transmit traffic between the organization's intranet and the Internet;

[0107] or,

[0108] Obtain mirrored traffic data of network devices located at the connection between different data centers within the organization's local area network, receiving and transmitting data exchanges between different data centers;

[0109] or,

[0110] Obtain the mirrored traffic data of network devices located at the connection point of different business data lines within the organization's local area network, which receive and transmit data interactions of different business data lines.

[0111] According to the device for identifying the property of an asset based on network traffic mirroring provided by the present invention, the second processing module 32 is specifically used for:

[0112] Extracting information from the mirrored traffic data to obtain five-tuple information of the mirrored traffic data;

[0113] or,

[0114] Extracting information from the mirrored traffic data to obtain quintuple information and application fingerprint information of the mirrored traffic data;

[0115] The five-tuple information includes the source address, destination address, protocol, source port and destination port of the mirrored traffic data.

[0116] According to the device for identifying the property of an asset based on network traffic mirroring provided by the present invention, the third processing module 33 is specifically used for:

[0117] Preprocessing the extracted information to obtain preprocessed extracted information;

[0118] storing the preprocessed extracted information in a database;

[0119] The pre-processed extracted information stored in the database is reprocessed to obtain final extracted information.

[0120] According to the device for identifying the property of an asset based on network traffic mirroring provided by the present invention, the fourth processing module 34 is specifically used for:

[0121] Comparing the final extracted information with the data in the existing asset database to determine a portion of the final extracted information that has a corresponding relationship with the data;

[0122] Removing part of the final extracted information corresponding to the data, and using the asset data corresponding to the remaining final extracted information as shadow assets in the existing asset database;

[0123] The comparing the final extracted information with the data in the existing asset database to determine the abandoned assets in the existing asset database specifically includes:

[0124] Comparing the data in the existing asset database with the final extracted information to determine a portion of the data that has a corresponding relationship with the final extracted information;

[0125] Part of the data corresponding to the final extracted information is removed, and the remaining data in the existing asset database is used as abandoned data of the existing asset database.

[0126] According to the device for identifying the property of an asset based on network traffic mirroring provided by the present invention, the third processing module 33 is specifically used for:

[0127] Dividing the extracted information according to unit time to obtain the extracted information within the unit time;

[0128] The extracted information within the unit time is pre-processed by de-duplication and noise reduction to obtain the pre-processed extracted information.

[0129] According to the device for identifying the property of an asset based on network traffic mirroring provided by the present invention, the third processing module 33 is specifically used for:

[0130] Determining the acquisition source of the preprocessed extracted information;

[0131] If the acquisition source of the pre-processed extracted information is the device located at the connection between the organization's intranet and the Internet, extracting the extracted information corresponding to the unidirectional flow in the inbound direction from the pre-processed extracted information;

[0132] If the source of the preprocessed extracted information is the device located at the connection of different data centers within the institution's local area network or the device located at the connection of different business data lines within the institution's local area network, the extracted information corresponding to the unidirectional traffic in the output direction is extracted from the preprocessed extracted information.

[0133] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute an asset property identification method based on network traffic mirroring, the method comprising: obtaining mirrored traffic data of a core device at a boundary; extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data; processing the extracted information to obtain final extracted information; comparing the final extracted information with data in an existing asset database to determine shadow assets and / or abandoned assets corresponding to the existing asset database.

[0134] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the embodiment of the present disclosure is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0135] On the other hand, the present disclosure also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the asset property identification method based on network traffic mirroring provided by the above-mentioned methods, and the method includes: obtaining mirrored traffic data of a core device at a boundary; extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data; processing the extracted information to obtain final extracted information; comparing the final extracted information with the data in an existing asset database to determine the shadow assets and / or abandoned assets corresponding to the existing asset database.

[0136] On the other hand, the present disclosure also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the above-mentioned asset property identification method based on network traffic mirroring, the method comprising: obtaining mirrored traffic data of a core device at a boundary; extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data; processing the extracted information to obtain final extracted information; comparing the final extracted information with data in an existing asset database to determine shadow assets and / or abandoned assets corresponding to the existing asset database.

[0137] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0138] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A method for identifying the nature of assets based on network traffic mirroring, characterized in that: include: Without affecting the normal processing of packets by the device, the mirrored traffic data of the core network device at the border can be obtained by copying the packets of the mirrored port to the observation port. Extracting information from the mirrored traffic data to obtain extracted information of the mirrored traffic data, and storing the extracted information in a database; Processing the extracted information to obtain final extracted information; Comparing the final extracted information with the data in the existing asset database to determine a portion of the final extracted information that has a corresponding relationship with the data; Removing part of the final extracted information that has a corresponding relationship with the data, using the remaining asset data corresponding to the final extracted information as shadow assets in the existing asset database, locating the business line to which the shadow assets belong through the collected quintuple information and application fingerprints, updating the existing asset database and adding the shadow assets to security management and control; Comparing the data in the existing asset database with the final extracted information to determine a portion of the data that has a corresponding relationship with the final extracted information; The part of the data corresponding to the final extracted information is removed, the remaining data in the existing asset database is used as the abandoned data of the existing asset database, the existing asset database is updated, and the abandoned data is subtracted in the security management.

2. The method for identifying the nature of assets based on network traffic mirroring according to claim 1 is characterized in that: Obtain mirrored traffic data from core network devices at the edge, including: Obtain mirrored traffic data of network devices located at the junction of the organization's intranet and the Internet, which receive and transmit traffic between the organization's intranet and the Internet; or, Obtain mirrored traffic data of network devices located at the connection between different data centers within the organization's local area network, receiving and transmitting data exchanges between different data centers; or, Obtain the mirrored traffic data of network devices located at the connection point of different business data lines within the organization's local area network, which receive and transmit data interactions of different business data lines.

3. The method for identifying the nature of assets based on network traffic mirroring according to claim 1, characterized in that: The extracting information from the mirrored traffic data to obtain the extracted information of the mirrored traffic data specifically includes: Extracting information from the mirrored traffic data to obtain five-tuple information of the mirrored traffic data; or, Extracting information from the mirrored traffic data to obtain quintuple information and application fingerprint information of the mirrored traffic data; The five-tuple information includes the source address, destination address, protocol, source port and destination port of the mirrored traffic data.

4. The method for identifying the nature of assets based on network traffic mirroring according to claim 2, characterized in that: The processing of the extracted information to obtain final extracted information specifically includes: Preprocessing the extracted information to obtain preprocessed extracted information; storing the preprocessed extracted information in a database; The pre-processed extracted information stored in the database is reprocessed to obtain final extracted information.

5. The method for identifying the nature of assets based on network traffic mirroring according to claim 4 is characterized in that: The preprocessing of the extracted information to obtain the preprocessed extracted information specifically includes: Dividing the extracted information according to unit time to obtain the extracted information within the unit time; The extracted information within the unit time is pre-processed by de-duplication and noise reduction to obtain the pre-processed extracted information.

6. The method for identifying the nature of assets based on network traffic mirroring according to claim 4, characterized in that: The reprocessing of the preprocessed extraction information stored in the database to obtain final extraction information specifically includes: Determining the acquisition source of the preprocessed extracted information; If the acquisition source of the pre-processed extracted information is the device located at the connection between the organization's intranet and the Internet, extracting the extracted information corresponding to the unidirectional flow in the inbound direction from the pre-processed extracted information; If the source of the preprocessed extracted information is the device located at the connection of different data centers within the institution's local area network or the device located at the connection of different business data lines within the institution's local area network, the extracted information corresponding to the unidirectional traffic in the output direction is extracted from the preprocessed extracted information.

7. A device for identifying the nature of assets based on network traffic mirroring, characterized in that: include: The first processing module is used to obtain the mirrored traffic data of the core device of the network at the boundary by copying a copy of the message of the mirrored port to the observation port without affecting the normal processing of the message by the device; A second processing module is used to extract information from the mirrored traffic data, obtain extracted information of the mirrored traffic data, and store the extracted information in a database; A third processing module, used for processing the extracted information to obtain final extracted information; The fourth processing module is used for: Comparing the final extracted information with the data in the existing asset database to determine a portion of the final extracted information that has a corresponding relationship with the data; Removing part of the final extracted information that has a corresponding relationship with the data, using the remaining asset data corresponding to the final extracted information as shadow assets in the existing asset database, locating the business line to which the shadow assets belong through the collected quintuple information and application fingerprints, updating the existing asset database and adding the shadow assets to security management and control; Comparing the data in the existing asset database with the final extracted information to determine a portion of the data that has a corresponding relationship with the final extracted information; The part of the data corresponding to the final extracted information is removed, the remaining data in the existing asset database is used as the abandoned data of the existing asset database, the existing asset database is updated, and the abandoned data is subtracted in the security management.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method for identifying asset properties based on network traffic mirroring as described in any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for identifying the property of an asset based on network traffic mirroring as described in any one of claims 1 to 6 are implemented.

Images