A method, device and electronic equipment for network asset identification

Abstract

The application discloses a network asset identification method, device and electronic equipment. The method comprises the following steps: obtaining text data to be processed; extracting sub-data matched with network asset data in a network asset database from the text data; taking the extracted sub-data as candidate network assets; calculating probability values between the candidate network assets; selecting probability values satisfying preset conditions; and taking candidate network assets corresponding to the probability values as target network assets. The above method can extract structured network assets from text data, expand the types and range of identifiable network assets, and effectively solve the problem of low accuracy in identifying network assets in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a network asset identification method and device and electronic equipment. BACKGROUND

[0002] At present, in order to guarantee network security, a security product needs to perform a series of network security management activities such as network security monitoring, vulnerability scanning reporting, threat situation awareness, etc. In order to better perform the network security management activities, the network assets need to be detected and identified first. In other words, the more network asset information obtained from network information such as protocol messages, the more complete the network asset information obtained, and the more effective the network security management activities performed by the security product.

[0003] At present, the method for identifying network assets, especially the method for identifying network assets such as application services, middleware, big data frameworks, and WEB frameworks, is mostly implemented by using corresponding matching rules to perform corresponding matching on text data such as application layer protocol messages.

[0004] For example, if 'BC' is a network asset to be identified, 'BC' appears after 'A' and before 'D', a matching rule for identifying 'BC' is formulated, and a field after 'A' and before 'D' is selected as a network asset. However, the form of text data such as protocol messages is uncertain in the process of generation, that is, 'BC' can also appear after 'V'. If 'BC' appears after 'V', 'BC' cannot be identified.

[0005] Therefore, in the current scenario of high-speed growth of network asset scale and identification demand, using the matching rule of the prior art to identify network assets has the problem of low identification accuracy. SUMMARY

[0006] The present application provides a network asset identification method, device and electronic equipment for identifying network assets in text data, solving the problem of low accuracy in identifying network assets in the prior art, effectively improving the accuracy of identifying network assets, expanding the types and range of identifiable network assets, and reducing the cost of identifying network assets.

[0007] In a first aspect, the present application provides a network asset identification method, which comprises:

[0008] acquiring text data to be processed;

[0009] extracting sub-data from the text data as candidate network assets, wherein the sub-data is data matched with network asset data in a network asset database;

[0010] The probability values between the candidate network assets are calculated, a probability value meeting a preset condition is selected, and a candidate network asset corresponding to the probability value is taken as a target network asset.

[0011] By the above method, the network assets in the text data are identified, the problem of low accuracy in identifying network assets in the prior art is solved, the types and range of identifiable network assets are effectively expanded, the accuracy of identifying network assets is improved, and the cost of identifying network assets is reduced.

[0012] In a possible design, the extracting of the sub-data from the text data as the candidate network assets includes one or more of the following cases:

[0013] The sub-data matching the network asset data is extracted from the text data as the candidate network assets by character comparison;

[0014] The sub-data matching the network asset data is extracted from the text data as the candidate network assets by fuzzy recognition;

[0015] The sub-data matching the network asset data is extracted from the text data as the candidate network assets by similarity calculation.

[0016] Any combination of the character comparison, the fuzzy recognition and the similarity calculation can be used to extract the candidate network assets, change the dependence on the matching rule in the traditional technology, expand the types and range of identifiable network assets, effectively improve the accuracy of identifying network assets, and reduce the cost of identifying network assets.

[0017] In a possible design, the extracting of the sub-data from the text data as the candidate network assets further includes:

[0018] The sub-data in the text data is extracted as the candidate network assets based on a machine learning model, and the missing data in the text data is predicted based on the machine learning model and taken as the candidate network assets. Here, the machine learning model is used to determine the candidate network assets in the text data;

[0019] The machine learning model is used to automatically extract and predict the candidate network assets, which not only eliminates the dependence on the matching rule, improves the range and types of extractable network assets, but also effectively reduces the cost of manually setting the matching rule to extract the network assets.

[0020] In a possible design, the calculating of the probability values between the candidate network assets, the selecting of the probability value meeting the preset condition, and the taking of the candidate network asset corresponding to the probability value as the target network asset include:

[0021] The probability value of combination between candidate network assets is calculated based on the network asset identifier in the network asset database, and the candidate network asset corresponding to the maximum probability value is selected as the target network asset from the calculated multiple probability values, where the probability value represents the probability of combination of different candidate network assets.

[0022] The unstructured network asset data or text data is converted into structured network asset data by calculating the probability value, and the identification capability of the network asset is improved.

[0023] In a possible design, the calculation of the probability value between the candidate network assets includes:

[0024] The combination probability and the combination distance of the candidate network asset are calculated based on the network asset identifier in the network asset database, the combination probability weighted distance of the candidate network asset is calculated according to the combination probability and the combination distance, and the candidate asset corresponding to the minimum distance is selected as the target network asset from the calculated multiple distances. Here, the combination probability represents the conditional probability of combination of different candidate network assets, and the combination distance represents the character distance of distribution of different candidate network assets in the text data; and the combination probability weighted distance represents the probability of combination of different candidate network assets.

[0025] The unstructured network asset data or text data is converted into structured network asset data by calculating the probability value, and the identification capability of the network asset is improved.

[0026] In a possible design, the network asset database has the following specific updating modes: the network asset database is updated according to the feedback information of the target network asset, where the feedback information represents the feedback of the user to the target network asset; or the network asset database is updated based on the business data or the open source data at a preset time.

[0027] The structured network asset data output based on the updated network asset database can adapt to various downstream tasks, and the efficiency of the corresponding security management activities is improved.

[0028] In a second aspect, the present application provides a network asset identification device, which comprises:

[0029] The acquisition module acquires the text data to be processed.

[0030] The extraction module extracts the sub-data from the text data as the candidate network asset, where the sub-data is the data matched with the network asset data in the network asset database.

[0031] The computing module calculates probability values between the candidate network assets, selects a probability value meeting a preset condition, and takes a candidate network asset corresponding to the probability value as a target network asset.

[0032] In a possible design, the extraction module is specifically configured to extract, as the candidate network asset, the sub-data matching the network asset data from the text data in one or more of the following manners:

[0033] extracting, as the candidate network asset, the sub-data matching the network asset data from the text data by character comparison;

[0034] extracting, as the candidate network asset, the sub-data matching the network asset data from the text data by fuzzy recognition;

[0035] extracting, as the candidate network asset, the sub-data matching the network data from the text data by similarity calculation.

[0036] In a possible design, the extraction module is specifically configured to extract, as the candidate network asset, the sub-data in the text data based on a machine learning model, where the machine learning model is used to determine the candidate network asset in the text data; and predict missing data in the text data based on the machine learning model, and take the missing data as the candidate network asset.

[0037] In a possible design, the computing module is specifically configured to calculate, based on network asset identifiers in the network asset database, a probability value of combination of the candidate network assets, where the probability value represents a probability that different candidate network assets are combined together; and select, from the calculated multiple probability values, a candidate network asset corresponding to a maximum probability value as a target network asset.

[0038] In a possible design, the computing module is specifically configured to calculate, based on network asset identifiers in the network asset database, a combination probability and a combination distance of the candidate network assets, where the combination probability represents a conditional probability that different candidate network assets are combined together, and the combination distance represents a character distance of distribution of different candidate network assets in the text data; calculate a combination probability weighted distance of the candidate network assets according to the combination probability and the combination distance, where the combination probability weighted distance represents a probability that different candidate network assets are combined together; and select, from the calculated multiple distances, a candidate asset corresponding to a minimum distance as a target network asset.

[0039] In a possible design, the network asset database is updated in the following manners: the network asset database is updated according to feedback information of the target network asset, where the feedback information represents feedback of a user on the target network asset; and the network asset database is updated based on business data or open source data at a preset time.

[0040] In a third aspect, the present application provides an electronic device, which comprises:

[0041] a memory for storing a computer program;

[0042] a processor for executing the computer program stored in the memory, so as to implement the method steps of the network asset identification.

[0043] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method steps of the network asset identification.

[0044] The technical effects of the second aspect to the fourth aspect and each possible solution of the first aspect can be referred to the technical effect description of the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 a structural diagram of a possible application scenario of the present application;

[0046] Figure 2 a flowchart of a network asset identification method of the present application;

[0047] Figure 3 a structural diagram of a candidate network asset extraction method of the present application;

[0048] Figure 4 a flowchart of a candidate network asset extraction method of the present application;

[0049] Figure 5 a schematic diagram of a string-network asset label sequence generation method of the present application;

[0050] Figure 6 a schematic diagram of a target network asset generation method of the present application;

[0051] Figure 7 a schematic diagram of a network asset identification device of the present application;

[0052] Figure 8A schematic diagram of a structure of an electronic device is provided. DETAILED DESCRIPTION

[0053] For the better understanding of the present application by those skilled in the art, the technical terms involved in the present application are first simply described below.

[0054] Network assets, devices used in computer (or communication) networks. Specifically including but not limited to servers, switches, computers, mobile phones, cameras, etc.

[0055] Referring to Figure 1 , the embodiments of the present application provide a possible application scenario of network asset identification.

[0056] As Figure 1 shown, the application scenario includes a business layer 110, a service layer 120 and a data layer 130.

[0057] The business layer 110 receives externally incoming text data to be processed, which includes unstructured text data and protocol text data of network assets. The business layer 110 is also configured to obtain target network asset data, which is structured data obtained by processing the text data by the service layer 120. In addition, the business layer 110 also receives feedback information about the target network asset data from the outside and transmits the feedback information to the data layer 130.

[0058] For example, the target network asset data includes manufacturer A and asset type B. After receiving the target network asset data, the business layer 110 will make manufacturer A and asset type B visible to the user. The user can update manufacturer A to manufacturer C or update asset type B to asset type D or add product name E according to the actual application situation. These user updates or additions will be received by the business layer 110 as feedback information.

[0059] In Figure 1 , the service layer 120 is configured to obtain the text data transmitted by the business layer 110 and the network asset database transmitted by the data layer 130, the network asset database including network asset data and network asset identification.

[0060] Taking Table 1 as an example, the network asset identification is used to express the network asset, and the network asset identification specifically includes manufacturer, asset type, product name, product type, version, release information. Here, the network asset identification and the network asset data are in a one-to-many relationship. Taking the manufacturer as an example, the manufacturer corresponds to multiple different manufacturers, specifically including manufacturer 1, manufacturer 2, …, manufacturer n.

[0061] Manufacturer Asset Type Product Name Product Type Version Release Information Manufacturer 1 Asset Type 1 Product Name 1 Product Type 1 Version 1 Release Information 1 Manufacturer 2 Asset Type 2 Product Name 2 Product Type 2 Version 2 Release Information 2 …… …… …… …… …… …… Manufacturer n Asset Type n Product Name n Product Type n Version n Release Information n

[0062] Table 1

[0063] It is worth noting that Table 1 is a possible design in the embodiments of the present application, and the network asset database further includes other network asset identifiers and network asset data for describing network asset information.

[0064] In Figure 1 , the service layer 120 is configured to perform data conversion on the text data, and the data conversion includes converting the field format in the text data, counting the field information in the text data, and labeling the field information.

[0065] After the text data is converted, the service layer 120 is configured to identify the sub-data in the text data that matches the network asset database in the data layer 130, and extract the corresponding sub-data as a candidate network asset.

[0066] In addition, the service layer 120 is further configured to perform legal correction on the candidate network asset, and the method of legal correction is: combining the candidate network assets, calculating the probability value of the probability maximum combination target of the candidate network assets, and determining the candidate network asset combination corresponding to the maximum probability value as the target network asset.

[0067] In Figure 1 , the data layer 130 is configured to extract network asset data and network asset identifiers from the data source to form a network asset database. The data layer 130 also updates the network asset database regularly, including updating the network asset database based on the updated data source by the data layer 130, or updating the network asset database by the feedback information of the business layer 110 by the data layer 130.

[0068] Based on the above application scenarios, the embodiments of the present application provide a network asset identification method applied to the above scenarios to solve the problem of low identification accuracy in identifying network assets in the prior art.

[0069] The method provided by the embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

[0070] Referring to Figure 2 , the embodiments of the present application provide a network asset identification method, and the specific process is as follows:

[0071] Step 201: obtaining text data to be processed;

[0072] The text data to be processed includes but is not limited to unstructured text data and protocol text data of network assets.

[0073] In the embodiments of the present application, the text data can be represented as a string, and the sub-data in the text data can be represented as a field in the string.

[0074] For example, the string "S1 S2 S3 S4 S5 S6 S7" contains 7 characters "S1", "S2", "S3", "S4", "S5", "S6", "S7", and adjacent characters in the string can be combined to form fields. For example, the string can be divided into four fields "S1S2", "S3 S4 S5", "S6", "S7", or four fields "S1", "S2 S3", "S4 S5 S6", "S7", or three fields "S1S2 S3", "S4", "S5 S6 S7".

[0075] It is worth noting that the above enumerated fields are part of the fields in the string, and other fields contained in the string are not specifically described here.

[0076] Step 202: extracting sub-data from the text data as a candidate network asset;

[0077] In the embodiments of the present application, the structural diagram of the method for extracting the candidate network asset can be seen from Figure 3 .

[0078] In Figure 3 , it includes a character recognition and segmentation module 310, a fuzzy recognition module 320, and a similarity correction module 330. Each module represents a method for extracting a candidate network asset. Here, the extraction of the candidate network asset can be realized by any one of the modules, or by the combination of any two of the modules, or by the combination of all three of the modules.

[0079] The character recognition and segmentation module 310 is used to obtain a string to be recognized, segment the candidate network asset fields in the string, and obtain a segmentation result. Then, the string that is reasonable after segmentation is marked. The marking is based on the network asset identifier of the candidate network asset field, so as to obtain a string-network asset marking sequence.

[0080] The fuzzy recognition module 320 is used to segment the candidate network asset fields in the string that is unreasonable after segmentation in the character recognition and segmentation module 310, and obtain a fuzzy recognition segmentation result. Then, the string that is reasonable after fuzzy recognition segmentation is marked. The marking is based on the network asset identifier of the candidate network asset field, so as to obtain a string-network asset marking sequence.

[0081] The similarity correction module 330 is used to segment the candidate network asset fields in the string according to a similarity scoring criterion, and obtain a similarity segmentation result. Then, the string that is reasonable after similarity segmentation is marked. The marking is based on the network asset identifier of the candidate network asset field, so as to obtain a string-network asset marking sequence.

[0082] In the embodiments of the present application, the method for extracting candidate network asset in combination with three modules is taken as an example, and the following detailed description is made in combination with the drawings.

[0083] It should be noted that the number of modules and the combination order of the combined modules are only one possible implementation, and can be arbitrarily combined and ordered according to actual business requirements.

[0084] Referring to Figure 4 The specific process of extracting candidate network asset is described in detail as follows.

[0085] S400: Obtain a string to be recognized;

[0086] In the embodiments of the present application, the string to be recognized represents the text data to be processed.

[0087] S411: Segment a candidate network asset field in the string to obtain a segmentation result;

[0088] Based on the network asset data in the network asset database, the characters in the string are matched with the network asset data, and the candidate network asset field with consistent matching result is segmented, and the candidate network asset field is taken as the segmentation result.

[0089] S412: Determine whether the segmentation result is reasonable;

[0090] If yes, S413 is executed; if no, S421 is executed.

[0091] In the embodiments of the present application, the main basis for determining whether the segmentation result is reasonable is whether the important network asset identifier corresponds to the candidate network asset field.

[0092] It should be noted that the important network asset identifier is set according to actual application requirements. For example, if six network asset identifiers are preset to be extracted in the string: manufacturer, asset type, product name, product type, version, and release information, and according to actual application requirements, the manufacturer and product name are set as important network asset identifiers. In S412, it is determined whether there is a candidate network asset field corresponding to the manufacturer and product name: if there is, S413 is executed; if there is not, S421 is executed.

[0093] S413: Label the string based on the network asset identifier of the candidate network asset field to obtain a string-network asset label sequence;

[0094] The relationship between the candidate network asset field and the network asset identifier can be referred to as shown in Table 2.

[0095] In Table 2, the network asset identifiers include "Field 1", "Field 2", "Field 3", and here "1", "2", "3" are used to distinguish the network asset identifiers and have no actual meaning.

[0096] Suppose the candidate network asset fields extracted from the string "S1 S2 S3 S4 S5 S6 S7" are: "S1 S2", "S3 S4 S5", "S7", "S2 S3", "S4 S5 S6", and "S4". The candidate network asset fields corresponding to the network asset identifier "Field 1" are "S1 S2", "S3 S4 S5", and "S7"; the candidate network asset fields corresponding to the network asset identifier "Field 2" are "S2 S3" and "S4 S5 S6"; and the candidate network asset fields corresponding to the network asset identifier "Field 3" are "S4".

[0097]

[0098] Table 2

[0099] The process of marking the string based on the network asset identifiers of the candidate network asset fields to obtain the string-network asset marking sequence can be seen in Figure 5 .

[0100] In Figure 5 , the marking parameter M represents the relationship of belonging to, and the marking parameter O represents the relationship of not belonging to.

[0101] Taking "Field 1" as an example, the candidate network asset fields "S1 S2", "S3 S4 S5", and "S7" are marked with M, indicating that "S1 S2", "S3 S4 S5", and "S7" belong to "Field 1"; and the candidate network asset field "S6" is marked with O, indicating that "S6" does not belong to "Field 1".

[0102] S421: Adopting fuzzy recognition, the candidate network asset fields in the string are segmented to obtain the fuzzy recognition segmentation result;

[0103] The fuzzy recognition is adopted to improve the stability and anti-interference of identifying the candidate network asset fields.

[0104] Specifically, the fuzzy recognition can be implemented by using a regular expression. For example, fixed characters ".*?" are inserted between the beginning and the end of the string to be segmented and each character as a matching pattern. The corresponding network asset identification field in the network asset database is taken as a matching target to match the network asset data in the network asset database, and a matching degree score between the matched network asset data and the original string to be segmented is calculated. The field composed of the characters with a matching degree score satisfying a preset matching value is taken as a candidate network asset field, and then the candidate network asset field is segmented to obtain the fuzzy recognition segmentation result.

[0105] Here, the criterion for calculating the matching degree score can be represented as a scoring function, and factors affecting the scoring function include but are not limited to: a length ratio between the original string and the matched network asset, and an index position of the first character of the original string in the matched network asset data.

[0106] It should be noted that the above example is one possible fuzzy recognition method in the embodiments of the present application, and other fuzzy recognition methods are not described in detail here.

[0107] S422: determining whether the fuzzy recognition segmentation result is reasonable;

[0108] If yes, step S413 is performed; if no, step S431 is performed.

[0109] The specific determination process in this step is the same as that in S412, which is not described in detail here.

[0110] S431: using a similarity score criterion to segment the candidate network asset field in the string to obtain a similarity segmentation result;

[0111] The similarity score criterion is used to improve the stability and anti-interference of the candidate network asset field.

[0112] Specifically, the similarity can be obtained by calculating the distance similarity between the characters in the string and the characters in the network asset database. Here, the specific calculation method of the distance similarity includes but is not limited to the edit distance. Taking the edit distance as an example, the edit distance between the characters is calculated to obtain the similarity between the characters. Here, the smaller the similarity, the more similar the characters, and the larger the similarity, the less similar the characters. The similarity less than a preset threshold is selected, and the characters corresponding to the similarity are taken as the candidate network asset field, i.e., the similarity segmentation result.

[0113] S432: determining whether the similarity segmentation result is reasonable;

[0114] If yes, S413 is performed; if no, step S433 is performed.

[0115] The specific judgment process in this step is the same as S412, and will not be described in detail here.

[0116] S433: There is no candidate network asset field in the string.

[0117] The candidate network asset field cannot be segmented from the string, and it can be considered that there is no candidate network asset field in the string.

[0118] In addition to using the above method to extract the candidate network asset field in the embodiments of the present application, the candidate network asset field of the string can also be extracted or predicted based on a machine learning model.

[0119] For example, 6 network asset identifiers are to be extracted from the string: manufacturer, asset type, product name, product type, version, and release information. After inputting the string into the machine learning model, the machine learning model will automatically output candidate network asset fields corresponding to the 6 network asset identifiers respectively. The output candidate network asset fields can be directly extracted from the string, or can be obtained by predicting the machine learning model. Then, based on the network asset identifier of the candidate network asset field, the string is labeled to obtain a string-network asset label sequence.

[0120] Based on the machine learning model, the missing network assets in the text data can be probabilistically inferred, so that the extracted candidate network assets are more abundant than those extracted based on the first method of rule matching. Not only is the dependence on matching rules eliminated, but the range and types of extractable network assets are also improved, and the cost of manually setting matching rules to extract network assets is effectively reduced.

[0121] Step 103: Calculate the probability values between the candidate network assets, select the probability values that meet the preset conditions, and take the candidate network assets corresponding to the probability values as the target network assets.

[0122] After step 102, the string-network asset label sequence is obtained, as shown in Table 2. It can be seen that one network asset identifier can correspond to multiple candidate network asset fields, for example, the network asset identifier "Field 1" corresponds to three candidate network asset fields "S1S2", "S3 S4 S5", and "S7". Here, it is further determined which candidate network asset field "Field 1" actually corresponds to. By calculating the probability values between the candidate network asset fields, one candidate network asset field is selected in each network asset identifier, and the selected candidate network asset field is taken as the target network asset of the string.

[0123] Specifically, in the embodiments of the present application, the asset portfolio correction model is used to determine the target network asset, and the asset portfolio correction model will be further explained below.

[0124] The portfolio correction model can be based on the following assumptions:

[0125] Assumption 1: There is no overlap between the label results of the corresponding candidate network asset fields of a single network asset identifier.

[0126] Assumption 2: The combination probability of the corresponding candidate network asset fields of different network asset identifiers is different, because the order of appearance of the corresponding candidate network asset fields in the text is different.

[0127] Assumption 3: When performing combination correction, characters that are not labeled as candidate network asset fields will be ignored.

[0128] Assumption 4: If there is an overlapping part between the labels of the corresponding candidate network asset fields of two adjacent network asset identifiers, the combination optimization is performed using the probability maximization target; and if there is no overlapping part between the labels of the corresponding candidate network asset fields of the network asset identifiers, the combination optimization is performed using the distance minimization target with combination probability weighting.

[0129] In the embodiments of the present application, the portfolio correction model mainly extracts the target network asset based on the probability maximization target, and the calculation method of the probability maximization target will be described in detail below.

[0130] In a first aspect, the network asset identifiers are sorted, and the label results of the string-network asset label sequence of important network asset identifiers are pre-processed.

[0131] For example, there are F network asset identifiers, and 2 of them are set as important network asset identifiers. The set of candidate network asset characters (i.e., label characters) corresponding to the network asset identifiers can be represented as Field f , f = 1, 2, 3,..., F.

[0132] For the set of label characters of Field f , each label character can be represented as where start f represents the start label position of the label character, and its value range is [0, 1, 2, 3,..., string_len-1]; end f represents the end label position of the label character, and its value range is [1, 2, 3,..., string_len]; represents the start character of the label character; represents the end character of the label character.

[0133] In the second aspect, the probability matching calculation is performed according to the marking of the candidate network asset fields corresponding to the two important network asset identifiers (i.e., the main fields), and the main fields are matched in the order marked by the start positions. The combination order of the main fields and other fields (i.e., the candidate network asset fields corresponding to the non-important network asset identifiers) and the combination order of the other fields are sequentially combined according to the end position marked by the previous field and the start position marked by the next field.

[0134] For example, for the combination of the main field and the main field, the combination calculation principle is as follows:

[0135] Suppose two main fields are and The order of the marked fields when the two main fields are combined needs to meet the condition

[0136] Based on the above assumptions, the two marked characters corresponding to the two main fields are combined two by two. Suppose the number of combinations that meet the above combination order condition is C. Then, for each combination, the combination probability P comb is calculated as follows:

[0137]

[0138] wherein represents the co-occurrence probability when the two main field marking results are and This is obtained by statistical analysis of the network asset database. represents the conditional probability that the field takes the value This is obtained by statistical analysis of the network asset database; comb = 1,..., C. The meaning is the same as above.

[0139] For the combination of the main field and the other field, or the combination of the other field and the other field, the combination condition is wherein f1 represents any field (main field and other field), and f2 represents the other field immediately after f1. Then, the combination probability P c , c = 1,..., O is calculated as follows:

[0140]

[0141] wherein the probability meaning is referred to the explanation of the main field combination probability calculation.

[0142] It should be noted here that f2 cannot be a main field, i.e., the main field must be placed in front when performing two-field combination calculation.

[0143] Thirdly, in the embodiments of this application, the combination probability results are calculated by selecting the field with the highest combination probability and marking it as a combination. For ease of calculation, the logarithm of the probability value is taken here. Of course, other methods can also be used for calculation. The objective function is:

[0144]

[0145] Where, path represents all field combinations other than the main field in the string-network asset tag sequence (original character tag sequence) that meet the above two combination conditions. Each field appears only once in each sequence, and the main field must precede all other fields; f i with f j A field cannot be a primary field simultaneously; if only one primary field exists, it is not counted. Partial; the Path sequence must begin with the primary field.

[0146] The calculation process involved in the first to third aspects mentioned above will be explained in detail below with examples.

[0147] See Figure 6 As shown, the original string represents the text data to be processed, and the asset field label represents the candidate network assets, i.e., the string-network asset label sequence.

[0148] exist Figure 6 The system includes three network asset identifiers: “Field1”, “Field2”, and “Field3”. Each network asset identifier includes one or more candidate network asset fields.

[0149] As shown in Table 3, the network asset identifier “Field1” includes three candidate network asset fields.

[0150]

[0151] Table 3

[0152] As shown in Table 4, the network asset identifier "Field2" includes two candidate network asset fields.

[0153]

[0154] Table 4

[0155] As shown in Table 5, the network asset identifier "Field3" includes one candidate network asset field.

[0156]

[0157] Table 5

[0158] exist Figure 6In the middle, if "Field1" and "Field2" are assumed to be the main fields, and "Field3" is the other field, the combination probability of the main fields is calculated first, and the combination can be seen in Table 6 as follows.

[0159] Number Field 1 Field 2 Combination Probability comb 1 S 1 S 2 S 2 S 3 P comb1 ]]> comb 2 S 1 S 2 S 4 S 5 S 6 P comb2 ]]> comb 3 S 3 S 4 S 5 S 4 S 5 S 6 P comb3 ]]> comb 4 S 2 S 3 S 3 S 4 S 5 P comb4 ]]> comb 5 S 2 S 3 S7 P comb5 ]]> comb 6 S 4 S 5 S 6 S7 P comb6 ]]>

[0160] Table 6

[0161] It is worth noting that the order of Field1 and Field2 in Table 6 only represents the order of combination in the original character, and is irrelevant to the naming of the main field.

[0162] Here, the three fields form a path that meets the condition and The path can be seen in Table 7 as follows.

[0163] Path Number Path Combination P comb ]]> P c ]]> 1 (S 1 S 2 ) (S 2 S 3 ) (S 4 ) P comb1 ]]> P c {(S2S3 | Field2), (S4 | Field3)} 2 (S 2 S 3 ) (S 4 ) (S 7 ) P comb5 ]]> P c {(S2S3 | Field2), (S4 | Field3)}

[0164] Table 7

[0165] It is worth noting that the order of Field1, Field2 and Field3 in Table 7 only represents the order of combination in the original character, and is irrelevant to the naming of the field.

[0166] Based on the two paths listed in Table 7 above, the maximum probability value of each path is calculated, and the path combination with the maximum probability value is selected. For example, if the probability value of path1 is greater than path2, then the target network asset is determined to be "S1S2", "S2S3" and "S4".

[0167] In Figure 6 , it is assumed that there is only one main field "Field2", and "Field1" and "Field3" are other fields, and the specific calculation is divided into two parts of main field combination and path combination.

[0168] In the calculation of the main field combination, because there is only one main field "Field2", P comb part is 0 and is not calculated.

[0169] In the calculation of the path combination, the three fields form a path that meets the condition and The path can be seen in Table 8 as follows.

[0170]

[0171] Table 8

[0172] It is worth noting that the order of Field1, Field2 and Field3 in Table 8 only represents the order of combination in the original character, and is irrelevant to the naming of the field.

[0173] Based on the two paths listed in Table 8 above, the maximum probability value of each path is calculated, and the path combination with the maximum probability value is selected. For example, if the probability value of path 1 is greater than that of path 2, the target network assets are determined to be "S2S3", "S4", and "S7".

[0174] In addition, in the embodiments of the present application, the asset portfolio correction model can also extract the target network assets based on the distance minimization target weighted by the combination probability. Based on the network asset identifiers in the network asset database, the combination probability and the combination distance of the candidate network assets are calculated, and the distance weighted by the combination probability of the candidate network assets is calculated according to the combination probability and the combination distance. In the calculated multiple distances, the candidate asset corresponding to the minimum distance is selected as the target network asset.

[0175] It is worth noting that the combination probability represents the conditional probability of different candidate network asset combinations, the combination distance represents the character distance of different candidate network asset distributions in the text data, and the distance weighted by the combination probability represents the probability of different candidate network asset combinations.

[0176] Specifically, the distance minimization target weighted by the combination probability is based on the combination probability. Here, "combination probability weighting" refers to the conditional probability between field values, and "distance" refers to the distance between different field characters. Generally, the greater the conditional probability, the greater the probability of field combination, and the greater the distance, the greater the distance between the corresponding fields in the original string, i.e., the smaller the probability of combination.

[0177] Therefore, the probability of field combination can be determined by calculating the "distance weighted by the combination probability": the greater the distance weighted by the combination probability, the smaller the probability of combination; the smaller the distance weighted by the combination probability, the greater the probability of combination.

[0178] For example, the combination probability weighted value P of two fields combined together is calculated, the distance D1 of the two fields combined together is calculated, and the distance D weighted by the combination probability of the two fields is calculated by the formula:

[0179] D = (1-P) x D1

[0180] As shown in the above formula, P can be calculated by the formula for calculating the combination probability based on the probability maximization target as above, or by other ways of calculating conditional probability.

[0181] Further, referring to Table 8, there are two paths, and the distance weighted by the combination probability of each path is calculated. In the calculated two distances, the fields in the path corresponding to the minimum distance are selected as the target network assets.

[0182] It is worth noting that the specific calculation method of the above example is one possible implementation calculation method in the embodiments of the present application, and there are other methods for calculating the probability-weighted distance, which are not specifically described here.

[0183] Through the above method of calculating the probability value, the structured network asset data is extracted from the unstructured network asset data or text data. Based on the method provided in the embodiments of the present application, the dependence on matching rules in the prior art is changed, the types and range of identifiable network assets are expanded, the cost of network asset identification is reduced, and the identification capability of network assets is improved.

[0184] Based on the above scheme, in the embodiments of the present application, the data in the network asset database can also be periodically iterated or updated during the generation of the target network asset.

[0185] Specifically, on the one hand, the data in the network asset database can be periodically iterated and updated, and the updating process is basically the same as the process of initially forming the network asset database; on the other hand, the data in the network asset database can be corrected and updated according to the feedback information of the target network asset. Based on the updated network asset database, the structured network asset data output is formed, which can adapt to various different downstream tasks and improve the efficiency of the corresponding security management activities.

[0186] In summary, through the method provided in the embodiments of the present application, the following technical effects can be achieved:

[0187] 1. By any combination of character recognition segmentation, fuzzy recognition and similarity error correction, the extraction of candidate network assets can be realized, the dependence on matching rules in traditional technology is changed, the types and range of identifiable network assets are expanded, the accuracy of identifying network assets is effectively improved, and the cost of identifying network assets is reduced.

[0188] 2. Through the machine learning model, the automatic extraction and prediction of candidate network assets are realized, which not only eliminates the dependence on matching rules, but also improves the range and types of extractable network assets, and effectively reduces the cost of manually setting matching rules to extract network assets.

[0189] 3. Through the method of calculating the probability value, the conversion of unstructured network asset data or text data to structured network asset data is realized, and the identification capability of network assets is improved.

[0190] 4. By periodically updating the network asset database, the structured network asset data output based on the updated network asset database can adapt to various different downstream tasks and improve the efficiency of the corresponding security management activities.

[0191] Based on the same inventive concept, the application further provides a network asset identification device for identifying network assets in text data, solving the problem of low accuracy in identifying network assets in the prior art, effectively improving the accuracy of identifying network assets, expanding the types and range of identifiable network assets, and reducing the cost of identifying network assets. Referring to Figure 7 The device comprises:

[0192] The acquisition module 701 acquires text data to be processed.

[0193] The extraction module 702 extracts sub-data from the text data as candidate network assets, wherein the sub-data is data matching network asset data in a network asset database.

[0194] The calculation module 703 calculates the probability values between the candidate network assets, selects the probability values that meet the preset conditions, and takes the candidate network assets corresponding to the probability values as target network assets.

[0195] In a possible design, the extraction module 702 is specifically configured for one or more of the following cases:

[0196] The sub-data matching the network asset data is extracted from the text data as candidate network assets through character comparison.

[0197] The sub-data matching the network asset data is extracted from the text data as candidate network assets through fuzzy recognition.

[0198] The sub-data matching the network data is extracted from the text data as candidate network assets through similarity calculation.

[0199] In a possible design, the extraction module 702 is specifically configured to extract the sub-data in the text data as candidate network assets based on a machine learning model, wherein the machine learning model is used to determine the candidate network assets in the text data; and based on the machine learning model, the missing data in the text data is predicted and the missing data is taken as a candidate network asset.

[0200] In a possible design, the calculation module 703 is specifically configured to calculate the probability values of combinations of the candidate network assets based on network asset identifiers in the network asset database, wherein the probability values represent the probabilities of different candidate network asset combinations being combined together; and among the calculated multiple probability values, the candidate network assets corresponding to the maximum probability value are selected as target network assets.

[0201] In one possible design, the calculation module 703 is specifically used to calculate the combination probability and combination distance of the candidate network assets based on the network asset identifiers in the network asset database, wherein the combination probability represents the conditional probability of different candidate network assets being combined together, and the combination distance represents the character distance of the distribution of different candidate network assets in the text data; calculate the combination probability-weighted distance of the candidate network assets based on the combination probability and the combination distance, wherein the combination probability-weighted distance represents the probability of different candidate network assets being combined together; and select the candidate asset corresponding to the smallest distance from the calculated multiple distances as the target network asset.

[0202] In one possible design, the network asset database is updated in one of the following ways: updating the network asset database based on feedback information from the target network asset, wherein the feedback information represents user feedback on the target network asset; or updating the network asset database at a preset time based on business data or open-source data.

[0203] Based on the above-mentioned device, network assets in text data can be identified, which solves the problem of low accuracy in identifying network assets in the prior art, effectively improves the accuracy of identifying network assets, expands the types and scope of identifiable network assets, and reduces the cost of identifying network assets.

[0204] Based on the same inventive concept, this application also provides an electronic device that can realize the function of the aforementioned network asset identification device. (Refer to...) Figure 8 The electronic device includes:

[0205] At least one processor 801 and a memory 802 connected to at least one processor 801. In this embodiment, the specific connection medium between the processor 801 and the memory 802 is not limited. Figure 8 The example shown is the connection between processor 801 and memory 802 via bus 800. Bus 800 is... Figure 8 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 800 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 8 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 801 can also be called a controller; there is no restriction on the name.

[0206] In the embodiments of the present application, the memory 802 stores instructions executable by the at least one processor 801, and the at least one processor 801 can execute the network asset identification method discussed above by executing the instructions stored in the memory 802. The processor 801 can implement Figure 7 the functions of various modules of the apparatus shown.

[0207] The processor 801 is the control center of the apparatus, and can connect all parts of the apparatus through various interfaces and lines. The processor 801 can monitor the whole apparatus by running or executing the instructions stored in the memory 802 and calling the data stored in the memory 802, so as to process data and implement various functions of the apparatus.

[0208] In a possible design, the processor 801 can include one or more processing units, and the processor 801 can integrate an application processor and a modem processor. The application processor can mainly process the operating system, user interface, and application programs, and the modem processor can mainly process wireless communication. It can be understood that the modem processor can also not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 can be implemented on the same chip, and in some embodiments, they can also be implemented on separate chips respectively.

[0209] The processor 801 can be a general-purpose processor, for example, a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the network asset identification method disclosed in conjunction with the embodiments of the present application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0210] The memory 802, as a non-volatile computer readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 can include at least one type of storage medium, for example, can include flash memory, hard disk, multimedia card, card type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. The memory 802 is any other medium capable of carrying or storing desired program codes in the form of instructions or data structures and capable of being accessed by a computer, but is not limited thereto. The memory 802 in the embodiments of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and / or data.

[0211] By designing and programming the processor 801, the code corresponding to the network asset identification method introduced in the foregoing embodiments can be fixed into the chip, so that the chip can execute the steps of the network asset identification method of the embodiments shown in the running time. Figure 2 How to design and program the processor 801 is a technology known to those skilled in the art, which will not be described here.

[0212] Based on the same inventive concept, the embodiments of the present application also provide a storage medium storing computer instructions, when the computer instructions run on a computer, the computer instructions make the computer execute the network asset identification method discussed above.

[0213] In some possible implementations, various aspects of the network asset identification method provided by the present application can also be implemented in the form of a program product, which includes program codes, when the program product runs on a device, the program codes are used to make the control device execute the steps in the network asset identification method according to various exemplary embodiments of the present application described above in the specification.

[0214] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0215] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0216] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0217] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0218] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method of network asset identification, characterized by, The method comprises: acquiring text data to be processed; extracting sub-data from the text data as candidate network assets, wherein the sub-data is data matching network asset data in a network asset database; calculating probability values between the candidate network assets, selecting a probability value satisfying a preset condition, and taking the candidate network asset corresponding to the probability value as a target network asset; wherein the calculated probability values between the candidate network assets are combination probability values of the candidate network assets or distances weighted by combination probabilities of the candidate network assets, and the combination probability values and the distances weighted by the combination probabilities both represent probabilities of different candidate network assets being combined together.

2. The method of claim 1, wherein, The extraction of the sub-data from the text data as the candidate network assets comprises one or more of the following cases: extracting sub-data matching the network asset data from the text data as the candidate network assets through character comparison; extracting sub-data matching the network asset data from the text data as the candidate network assets through fuzzy recognition; extracting sub-data matching the network asset data from the text data as the candidate network assets through similarity calculation.

3. The method of claim 1, wherein, The extraction of the sub-data from the text data as the candidate network assets comprises: extracting sub-data in the text data as the candidate network assets based on a machine learning model, wherein the machine learning model is used to determine the candidate network assets in the text data; predicting missing data in the text data based on a machine learning model and taking the missing data as a candidate network asset.

4. The method of any one of claims 1-3, wherein, The calculation of the probability values between the candidate network assets and the selection of the probability value satisfying the preset condition to take the candidate network asset corresponding to the probability value as the target network asset comprise: calculating combination probability values of the candidate network assets based on network asset identifiers in the network asset database; selecting a candidate network asset corresponding to a maximum probability value from the calculated multiple probability values as the target network asset.

5. The method of any one of claims 1-3, wherein, The calculation of the probability values between the candidate network assets and the selection of the probability value satisfying the preset condition to take the candidate network asset corresponding to the probability value as the target network asset comprise: calculating combination probabilities and combination distances of the candidate network assets based on network asset identifiers in the network asset database, wherein the combination probability represents a conditional probability of different candidate network assets being combined together, and the combination distance represents character distances of different candidate network assets distributed in text data; calculating distances weighted by the combination probabilities of the candidate network assets according to the combination probabilities and the combination distances; selecting a candidate asset corresponding to a minimum distance from the calculated multiple distances as the target network asset.

6. The method of any one of claims 1-3, wherein, The network asset database has the following multiple specific updating modes: updating the network asset database according to feedback information of the target network asset, wherein the feedback information represents feedback of a user to the target network asset. At a preset time, based on business data or open source data, the network asset database is updated.

7. An apparatus for network asset identification, the apparatus comprising: The device comprises: An acquisition module acquires text data to be processed; An extraction module extracts sub-data from the text data as candidate network assets, wherein the sub-data is data matching network asset data in a network asset database; A calculation module calculates probability values between the candidate network assets, selects a probability value satisfying a preset condition, and takes the candidate network asset corresponding to the probability value satisfying the preset condition as a target network asset; wherein the calculated probability values between the candidate network assets are combination probability values of the candidate network assets or are combination probability weighted distances of the candidate network assets, and the combination probability values of the candidate network assets or the combination probability weighted distances both represent probabilities of different candidate network asset combinations.

8. The apparatus of claim 7, wherein, The calculation module is specifically configured to calculate combination probability values of the candidate network assets based on network asset identifiers in the network asset database, and select a candidate network asset corresponding to a maximum probability value from the calculated probability values as the target network asset.

9. An electronic device, comprising: It comprises: A memory for storing a computer program; A processor for executing the computer program stored on the memory to implement the method steps of any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the method steps of any one of claims 1-6.

Images