A network asset query method, device, electronic device and storage medium

Abstract

The present invention provides a network asset query method, device, electronic device and storage medium. The method comprises: when receiving a query statement to be processed, segmenting the query statement to be processed into basic phrases, and writing the basic phrases into a phrase array in a segmentation order; the basic phrases include a key-value pair string and an operator; performing suffix expression conversion on the phrase array according to a preset priority of the operator to obtain a suffix expression array; converting the suffix expression array using a preset template to obtain a target query statement, and using the target query statement to query network assets in a target platform; segmenting the query statement to be processed to obtain a corresponding phrase array, converting the phrase array into a suffix expression form that can be efficiently converted by an electronic device through a suffix expression conversion method, and converting the suffix expression array into a query statement recognizable by the target platform using a preset template, which can effectively improve the query statement conversion efficiency and network asset query efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a network asset query method, device, electronic equipment and storage medium. Background Art

[0002] Network assets are usually hosts, network devices (such as routers), security devices (such as firewalls) in the network, and can also be software deployed on these devices, such as operating systems, services, applications, etc. At present, the query statistics of network assets usually rely on the network asset information data service platform. However, each platform has its own unique search grammar system, and the grammar rules of each platform are not universal. This leads to the need to manually write corresponding query statements for each platform when searching for network assets, which is cumbersome and inefficient. Summary of the invention

[0003] The purpose of the present invention is to provide a network asset query method, device, electronic device and storage medium, which can efficiently convert the query statement to be processed into a query statement recognizable by the target platform, thereby effectively improving the query statement conversion efficiency and network asset query efficiency.

[0004] In order to solve the above technical problems, the present invention provides a network asset query method, comprising:

[0005] When receiving a query statement to be processed, the query statement to be processed is segmented into basic phrases, and the basic phrases are written into a phrase array in the order of segmentation; the basic phrases include a key-value pair string and an operator;

[0006] Performing suffix expression conversion on the phrase array according to the preset priority of the operator to obtain a suffix expression array;

[0007] The suffix expression array is converted using a preset template to obtain a target query statement, and the target query statement is used to perform a network asset query in a target platform.

[0008] Optionally, segmenting the query statement to be processed into basic phrases includes:

[0009] The first character in the query statement to be processed is set as the character to be processed, and whether the character to be processed is the operator is determined;

[0010] If yes, segment the left and right sides of the character to be processed;

[0011] The next character in the query statement to be processed is set as the character to be processed, and the step of determining whether the character to be processed is the operator is entered until all characters in the query statement to be processed are processed to obtain the basic phrase.

[0012] Optionally, before segmenting the left side and the right side of the character to be processed, the method further includes:

[0013] Determine whether the character preceding the character to be processed is a preset escape character;

[0014] If not, the step of segmenting the left side and the right side of the character to be processed is performed.

[0015] Optionally, the operator includes a logical operator, a left priority operator and a right priority operator, and the phrase array is converted into a suffix expression according to the preset priority of the operator to obtain a suffix expression array, including:

[0016] Creating the suffix expression array and cache stack;

[0017] Setting the first element of the phrase array as an element to be processed, and determining the type of the element to be processed;

[0018] When the element to be processed is the key-value pair string, writing the element to be processed to the end of the suffix expression array;

[0019] When the element to be processed is the logical operator, determine the type of the top element of the cache stack; when the top element is an empty element or the left priority operator, push the element to be processed into the cache stack; when the top element is the logical operator, search from the top element to the bottom of the stack for the first logical operator with a priority less than the preset priority of the element to be processed, pop out all elements from the top element to the element before the first logical operator in sequence and write them to the end of the suffix expression array, and push the element to be processed into the cache stack;

[0020] When the element to be processed is the left priority operator, pushing the element to be processed into the cache stack;

[0021] When the element to be processed is the right-priority operator, search for the first left-priority operator from the top element of the stack to the bottom of the stack, pop out all elements from the top element of the stack to the element before the first left-priority operator in sequence and write them to the end of the suffix expression array, and remove the first left-priority operator and the element to be processed;

[0022] After completing the processing of the element to be processed, determining whether the element to be processed is the last element in the phrase array;

[0023] If yes, all elements in the cache stack are popped out in sequence and written to the end of the suffix expression array;

[0024] If not, the next element of the phrase array is set as the element to be processed, and the step of determining the type of the element to be processed is entered.

[0025] Optionally, the converting the suffix expression array by using a preset template to obtain a target query statement includes:

[0026] Set the first element of the suffix expression array as the element to be converted, and determine the type of the element to be converted;

[0027] When the element to be converted is the key-value pair string, searching the preset template for a first template corresponding to the key-value pair string, writing the key-value data in the element to be converted into the first template to obtain a first converted element, and pushing the first converted element into the cache stack;

[0028] When the element to be converted is the logical operator, searching the preset template for a second template corresponding to the logical operator, popping the first two stack elements of the cache stack, writing the stack elements into the second template to obtain a second converted element, and pushing the second converted element into the cache stack;

[0029] After completing the processing of the element to be converted, determining whether the element to be converted is the last element in the suffix expression array;

[0030] If yes, pop the top element in the cache stack to obtain the target query statement;

[0031] If not, the next element of the suffix expression array is set as the element to be converted, and the step of determining the type of the element to be converted is entered.

[0032] Optionally, the using the target query statement to query the network assets in the target platform includes:

[0033] Sending the target query statement to the target platform to query network assets, and receiving asset information returned by the target platform;

[0034] Convert the asset information into JSON format, and convert the target field in the asset information into a preset field according to a preset mapping relationship to obtain an asset information entry;

[0035] Set asset information items with the same network information as items to be processed; the network information is IP, port number and transport layer protocol;

[0036] Extracting the characteristic data value corresponding to each of the items to be processed, and using the characteristic data value to calculate the asset index value corresponding to each of the items to be processed;

[0037] The pending entry with the highest asset indicator value is saved.

[0038] Optionally, extracting the characteristic data value corresponding to each of the items to be processed, and calculating the asset index value corresponding to each of the items to be processed using the characteristic data value, includes:

[0039] Extracting characteristic data values ​​contained in each of the items to be processed; the characteristic data values ​​include the number of asset tags, the length of response data, and the time when the asset was collected;

[0040] The asset index value is obtained by performing a weighted calculation on the number of asset tags, the length of the response data and the asset collection time.

[0041] The present invention also provides a network asset query device, comprising:

[0042] A word segmentation module, for, when receiving a query statement to be processed, segmenting the query statement to be processed into basic phrases, and writing the basic phrases into a phrase array in a segmentation order; the basic phrases include a key-value pair string and an operator;

[0043] A first conversion module, configured to convert the phrase array into a suffix expression according to a preset priority of the operator to obtain a suffix expression array;

[0044] The second conversion module is used to convert the suffix expression array by using a preset template to obtain a target query statement, and use the target query statement to perform a network asset query in a target platform.

[0045] The present invention also provides an electronic device, comprising:

[0046] Memory for storing computer programs;

[0047] The processor is used to implement the steps of the network asset query method as described above when executing the computer program.

[0048] The present invention also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the network asset query method as described above are implemented.

[0049] The present invention provides a network asset query method, comprising: when receiving a query statement to be processed, segmenting the query statement to be processed into basic phrases, and writing the basic phrases into a phrase array in a segmentation order; the basic phrases include a key-value pair string and an operator; performing a suffix expression conversion on the phrase array according to a preset priority of the operator to obtain a suffix expression array; converting the suffix expression array using a preset template to obtain a target query statement, and using the target query statement to perform a network asset query in a target platform.

[0050] It can be seen that when the present invention receives a query statement to be processed, it will first perform word segmentation processing on it to obtain the corresponding basic phrases, and write the basic phrases into the corresponding phrase array in the word segmentation order, so that the query statement to be processed can be split into multiple key-value pair strings and operators; further, the present invention will convert the phrase array into a suffix expression according to the preset priority to obtain a suffix expression array, which can convert complex query statements to be processed into a simple suffix expression form that can be quickly parsed and executed by the electronic device, laying the foundation for statement conversion; finally, the present invention will use a preset template to convert the suffix expression array to obtain a target query statement that can be queried on the target platform, that is, it can convert a single query statement to be processed into a target query statement that can be recognized and processed by each platform, which can avoid the inefficiency caused by manually writing query statements for multiple platforms, and thus improve the efficiency of network asset query. The present invention also provides a network asset query device, an electronic device and a storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0052] Figure 1 A flowchart of a network asset query method provided by an embodiment of the present invention;

[0053] Figure 2 This is a structural block diagram of a network asset query device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] In the related art, the query statistics of network assets usually rely on the network asset information data service platform. However, each platform has its own unique search grammar system, and the grammar rules of each platform are not universal. This results in the need to manually write corresponding query statements for each platform when searching for network assets, which is cumbersome and inefficient. In view of this, the present invention provides a network asset query method that can efficiently convert the query statement to be processed into a query statement that can be recognized by the target platform, thereby effectively improving the query statement conversion efficiency and network asset query efficiency. Please refer to Figure 1 , Figure 1 A flowchart of a network asset query method provided by an embodiment of the present invention, the method may include:

[0056] S101. When receiving a query statement to be processed, segment the query statement to be processed into basic phrases, and write the basic phrases into a phrase array in a segmentation order; the basic phrases include a key-value pair string and an operator.

[0057] In the field of network asset management, query statements are generally composed of basic phrases such as key-value pairs, logical operators, and priority operators. For example, in the query statement "port:80&protocol:tcp", "port:80" and "protocol:tcp" are key-value pairs, and "&" is a logical operator; the priority operator includes a left priority operator and a right priority operator, wherein the left priority operator is generally a left bracket "(", and the right priority operator is generally a right bracket ")". In the query statements of each platform, these basic phrases are important information that constitutes the query statement, so the embodiment of the present invention will perform word segmentation and extraction on these basic phrases for subsequent conversion processing. It can be understood that the word segmentation operation needs to traverse each character in the query statement to be processed, determine whether the character is a specific character or belongs to a specific string, and segment it accordingly. In order to improve the convenience of operation, in the embodiment of the present invention, considering that the operator is a single character, segmentation can be performed based on the operator. Specifically, the characters in the query statement to be processed can be traversed, and it can be determined whether the character is an operator. If so, the left and right sides of the character are segmented.

[0058] In one possible case, the query statement to be processed is segmented into basic phrases, including:

[0059] Step 11: Set the first character in the query statement to be processed as the character to be processed, and determine whether the character to be processed is an operator; if so, proceed to step 12; if not, proceed to step 13;

[0060] Step 12: Segment the left and right sides of the character to be processed, and proceed to step 13;

[0061] Step 13: Set the next character in the query statement to be processed as the character to be processed, and enter the step of determining whether the character to be processed is an operator, until all characters in the query statement to be processed are processed to obtain a basic phrase.

[0062] For example, when the input query statement is "port:80&protocol:tcp", the basic phrases after word segmentation are "port:80", "&", and "protocol:tcp". Of course, special symbols that are the same as operators may appear in the key-value pair string. For example, when a certain data is "x&y", the "&" in the string will be recognized as a logical operator. To avoid the above situation, the determination of preset escape characters can also be added, where the escape characters are used to distinguish special characters from logical operators. Specifically, when the character to be processed is determined to be a logical operator, it can be further determined whether the previous character of the character is an escape character. If so, the character to be processed is corrected to an ordinary character. Otherwise, it continues to be recognized as a logical operator.

[0063] In a possible case, before segmenting the left and right sides of the characters to be processed, the following may also be included:

[0064] Step 21: Determine whether the character preceding the character to be processed is a preset escape character; if so, proceed to step 13; if not, proceed to step 22;

[0065] Step 22: Execute the step of segmenting the left side and the right side of the character to be processed.

[0066] For example, the preset escape character may be "\". In this case, for the key-value pair string "data:x\&y", the "&" will not be judged as a logical operator, but as a common character. Of course, the preset escape character may also be other characters, which can be set according to actual application requirements.

[0067] S102. Convert the phrase array into a suffix expression according to the preset priority of the operator to obtain a suffix expression array.

[0068] Suffix expressions, also known as Reverse Polish Notation (RPN), are mainly used to convert human-understandable expressions into computer-understandable expressions. Since suffix expressions can convert complex logical expressions into a form that can be efficiently parsed and recognized by computers, and can retain the priority relationship in the source expression, the embodiment of the present invention uses suffix expressions as the intermediate result of converting the query statement to be processed into the target query statement.

[0069] Specifically, in order to retain the priority relationship in the source formula, in the suffix expression conversion, stack writing and popping operations are usually performed according to the preset priority of the operator to move the operator in the source formula to the end of the formula. Similarly, the present invention also performs stack writing and popping operations according to the priority relationship between the logical operator and the priority operator to move the operator in the source formula to the end of the formula and move the key-value pair string to the front of the formula.

[0070] In a possible case, the operators include logical operators, left priority operators, and right priority operators. The phrase array is converted into a suffix expression according to the preset priorities of the operators to obtain a suffix expression array, which may include:

[0071] Step 31: Create a suffix expression array and a cache stack;

[0072] Step 32: Set the first element of the phrase array as the element to be processed, determine the type of the element to be processed, and proceed to step 33, step 34, step 37 or step 38 according to the type;

[0073] Step 33: When the element to be processed is a key-value pair string, write the element to be processed to the end of the suffix expression array;

[0074] Step 34: When the element to be processed is a logical operator, determine the type of the top element of the cache stack, and proceed to step 35 or step 36;

[0075] Step 35: When the top element of the stack is a null element or a left priority operator, the element to be processed is pushed into the cache stack;

[0076] Step 36: When the top element of the stack is a logical operator, search from the top element of the stack to the bottom of the stack for the first logical operator with a preset priority lower than that of the element to be processed, pop out all elements from the top element of the stack to the element before the first logical operator in sequence and write them to the end of the suffix expression array, and push the element to be processed into the cache stack;

[0077] Step 37: When the element to be processed is a left-priority operator, the element to be processed is pushed into the cache stack;

[0078] Step 38: When the element to be processed is a right-precedence operator, search for the first left-precedence operator from the top element of the stack to the bottom of the stack, pop out all elements from the top element to the element before the first left-precedence operator in sequence and write them to the end of the suffix expression array, and remove the first left-precedence operator and the element to be processed;

[0079] Step 39: After completing the processing of the element to be processed, determine whether the element to be processed is the last element in the phrase array; if so, proceed to step 40; if not, proceed to step 41;

[0080] Step 40: Pop all elements in the cache stack in sequence and write them to the end of the suffix expression array;

[0081] Step 41: Set the next element of the phrase array as the element to be processed, and proceed to the step of determining the type of the element to be processed.

[0082] For example, the phrase array "port:80", "|", "data:a", "&", "ip:1.1.1.1" becomes "data:a", "ip:1.1.1.1", "&", "port:80", "|" after the above conversion.

[0083] It should be noted that the embodiment of the present invention does not limit the specific form of the cache stack, and reference may be made to the relevant stack technology. The embodiment of the present invention does not limit the specific operation mode of stack push and stack pop, and reference may also be made to the relevant stack technology.

[0084] S103: Using a preset template to convert the suffix expression array to obtain a target query statement, and using the target query statement to perform a network asset query in the target platform.

[0085] After obtaining the suffix expression array, it can be converted into a target query statement. Specifically, since the logical expression syntax of each platform is different, for example, some platforms represent logical operators in symbolic form, such as "&", some platforms represent logical operators in string form, such as "AND", and some platforms represent logical operators in function form; of course, the representation of key-value pairs is also different. Therefore, in an embodiment of the present invention, a preset template is used to convert the key-value pair string and logical operator in the suffix expression array originally obtained. Specifically, when a key-value pair string is extracted from the suffix expression, the template corresponding to the key-value pair is queried, and the key value data (i.e., Key and Value) of the key-value pair string are filled into the template to obtain the converted string, and it is pushed into the stack for temporary storage; when a logical operator is extracted from the suffix expression, the template corresponding to the logical operator is queried, the first two stack elements are popped out of the stack, and the stack elements are filled into the template of the logical operator to obtain the converted string, and it is pushed into the stack for temporary storage. After these operations, when the processing of the last element in the suffix expression array is completed, only one element will remain in the stack, which is the target query statement required by the embodiment of the present invention.

[0086] In one possible case, the suffix expression array is converted using a preset template to obtain a target query statement, including:

[0087] Step 51: Set the first element of the suffix expression array as the element to be converted, determine the type of the element to be converted, and proceed to step 52 or step 53 according to the type;

[0088] Step 52: when the element to be converted is a key-value pair string, searching for a first template corresponding to the key-value pair string in the preset template, writing the key value data in the element to be converted into the first template to obtain a first converted element, and pushing the first converted element into the cache stack;

[0089] Step 53: when the element to be converted is a logical operator, search for a second template corresponding to the logical operator in the preset template, pop the first two stack elements of the cache stack, write the stack elements into the second template to obtain a second converted element, and push the second converted element into the cache stack;

[0090] Step 54: After completing the processing of the element to be converted, determine whether the element to be converted is the last element in the suffix expression array; if so, proceed to step 55; if not, proceed to step 56;

[0091] Step 55: Pop the top element in the cache stack to obtain the target query statement;

[0092] Step 56: Set the next element of the suffix expression array as the element to be converted, and enter the step of determining the type of the element to be converted.

[0093] For example, the suffix expression array "data:a", "ip:1.1.1.1", "&", "port:80", "|" will become "ip=1.1.1.1AND data=a OR port=80" after conversion. The above method can theoretically support infinite levels of logical combination and nesting, and can define multiple target grammar rules at the same time to input one query grammar to obtain multiple target query statements.

[0094] It should be noted that the embodiments of the present invention do not limit the specific form of the preset template, and reference may be made to related technologies for network asset query and the preset template may be set according to actual application requirements.

[0095] After obtaining the target query statement, the statement can be used to query in the target platform. Specifically, in order to unify the format of the query results and retain high-value asset information, the embodiment of the present invention will convert the asset information returned by the target platform into the same format and perform deduplication processing. Specifically, considering that the JSON format (JavaScript Object Notation, JS object notation) can effectively regularize data, when the asset information is obtained, the information will be uniformly converted into the JSON format to obtain the asset information entry. Since there may be differences in the fields with the same meaning in the asset information provided by each platform, in order to unify the text content, the target field in the asset information can also be converted into a preset field according to the preset mapping relationship. Thereafter, the embodiment of the present invention will query the network information in the asset information entry, and set the asset information entry with the same network information as the pending entry, wherein the network information includes IP, port number and transport layer protocol, because the same network asset may be registered on different platforms. In order to avoid repeated statistics of the same asset information, such asset information entries will be screened. Specifically, the characteristic data value of each pending entry can be extracted, and the value is used to calculate the asset index value for each pending entry, and finally the pending entry with the largest asset index value is retained.

[0096] In one possible scenario, a target query statement is used to query network assets in a target platform, including:

[0097] Step 61: Send a target query statement to the target platform to query network assets, and receive asset information returned by the target platform;

[0098] Step 62: convert the asset information into JSON format, and convert the target field in the asset information into a preset field according to a preset mapping relationship to obtain an asset information entry;

[0099] Step 63: Set the asset information items with the same network information as items to be processed; the network information includes IP, port number and transport layer protocol;

[0100] Step 64: extracting the characteristic data value corresponding to each item to be processed, and using the characteristic data value to calculate the asset index value corresponding to each item to be processed;

[0101] Step 65: Save the pending entry with the highest asset index value.

[0102] It should be noted that the embodiments of the present invention do not limit the specific content of the characteristic data value, and can be set according to the specific content in the asset information. For example, the characteristic data value can include the number of asset tags, the length of the response data, and the asset collection time. The embodiments of the present invention also do not limit the calculation method of the asset index value. For example, the characteristic data values ​​can be simply summed to obtain the asset index value, or the characteristic data values ​​can be weighted summed to obtain the asset index value. Considering that weighted summation can further improve the accuracy of the asset index value, the embodiments of the present invention will calculate the asset index value by weighted summation. It should be noted that the embodiments of the present invention do not limit the preset weight corresponding to each characteristic data value, and can be set according to actual application requirements.

[0103] In one possible case, extracting the characteristic data value corresponding to each item to be processed, and using the characteristic data value to calculate the asset index value corresponding to each item to be processed, includes:

[0104] Step 71: extracting characteristic data values ​​contained in each entry to be processed; the characteristic data values ​​include the number of asset tags, the length of response data, and the asset collection time;

[0105] Step 72: Perform weighted calculation on the number of asset tags, response data length and asset collection time to obtain the asset index value.

[0106] Based on the above embodiments, when receiving a query statement to be processed, the present invention will first perform word segmentation processing on it to obtain the corresponding basic phrases, and write the basic phrases into the corresponding phrase array in the word segmentation order, so that the query statement to be processed can be split into multiple key-value pair strings and operators; further, the present invention will perform suffix expression conversion on the phrase array according to the preset priority to obtain a suffix expression array, which can convert complex query statements to be processed into a simple suffix expression form that can be quickly parsed and executed by the electronic device, laying the foundation for statement conversion; finally, the present invention will use a preset template to convert the suffix expression array to obtain a target query statement that can be queried on the target platform, that is, it can convert a single query statement to be processed into a target query statement that can be recognized and processed by each platform, which can avoid the inefficiency caused by manually writing query statements for multiple platforms, and thus improve the efficiency of network asset query.

[0107] The network asset query device, electronic device and storage medium provided in the embodiments of the present invention are introduced below. The network asset query device, electronic device and storage medium described below can be referenced to the network asset query method described above.

[0108] Please refer to Figure 2 , Figure 2 A structural block diagram of a network asset query device provided by an embodiment of the present invention, the device may include:

[0109] The word segmentation module 201 is used for, when receiving a query statement to be processed, segmenting the query statement to be processed into basic phrases, and writing the basic phrases into a phrase array in the order of word segmentation; the basic phrases include a key-value pair string and an operator;

[0110] A first conversion module 202, configured to convert the phrase array into a suffix expression according to a preset priority of the operator to obtain a suffix expression array;

[0111] The second conversion module 203 is used to convert the suffix expression array using a preset template to obtain a target query statement, and use the target query statement to perform a network asset query in the target platform.

[0112] Optionally, the word segmentation module 201 may include:

[0113] A judgment submodule is used to set the first character in the query statement to be processed as the character to be processed, and to judge whether the character to be processed is an operator;

[0114] A segmentation submodule is used for segmenting the left and right sides of the character to be processed if yes;

[0115] The first setting submodule is used to set the next character in the query statement to be processed as the character to be processed, and enter the step of determining whether the character to be processed is an operator, until all characters in the query statement to be processed are processed to obtain a basic phrase.

[0116] Optionally, the word segmentation module 201 may further include:

[0117] The transfer character judgment submodule is used to judge whether the character before the character to be processed is a preset escape character;

[0118] The segmentation submodule is also used to execute the step of segmenting the left side and the right side of the character to be processed if no.

[0119] Optionally, the operator includes a logical operator, a left priority operator, and a right priority operator. The first conversion module 202 may include:

[0120] Create submodules for creating postfix expression arrays and cache stacks;

[0121] The second setting submodule is used to set the first element of the phrase array as the element to be processed and determine the type of the element to be processed;

[0122] The first processing submodule is used for writing the element to be processed to the end of the suffix expression array when the element to be processed is a key-value pair string;

[0123] The second processing submodule is used to determine the type of the top element of the cache stack when the element to be processed is a logical operator; when the top element is a null element or a left priority operator, push the element to be processed into the cache stack; when the top element is a logical operator, search from the top element to the bottom of the stack for the first logical operator with a priority less than the preset priority of the element to be processed, pop all elements from the top element to the element before the first logical operator in sequence and write them to the end of the suffix expression array, and push the element to be processed into the cache stack;

[0124] A third processing submodule is used for pushing the element to be processed into a cache stack when the element to be processed is a left priority operator;

[0125] The fourth processing submodule is used for searching the first left-priority operator from the top element of the stack to the bottom of the stack when the element to be processed is a right-priority operator, popping out all elements from the top element of the stack to the element before the first left-priority operator and writing them to the end of the suffix expression array in sequence, and removing the first left-priority operator and the element to be processed;

[0126] A first end judgment submodule is used to judge whether the element to be processed is the last element in the phrase array after completing the processing of the element to be processed;

[0127] The first pop-up submodule is used to pop all elements in the cache stack in sequence and write them to the end of the suffix expression array;

[0128] The third setting submodule is used for setting the next element of the phrase array as the element to be processed if no, and entering the step of determining the type of the element to be processed.

[0129] Optionally, the second conversion module 203 may include:

[0130] The fourth setting submodule is used to set the first element of the suffix expression array as the element to be converted and determine the type of the element to be converted;

[0131] A fifth processing submodule, for searching a first template corresponding to the key-value pair string in a preset template when the element to be converted is a key-value pair string, writing the key-value data in the element to be converted into the first template to obtain a first converted element, and pushing the first converted element into a cache stack;

[0132] a sixth processing submodule, for searching a second template corresponding to the logical operator in the preset template when the element to be converted is a logical operator, popping the first two stack elements of the cache stack, writing the stack elements into the second template to obtain a second converted element, and pushing the second converted element into the cache stack;

[0133] The second end judgment submodule is used to judge whether the element to be converted is the last element in the suffix expression array after completing the processing of the element to be converted;

[0134] The second pop-up submodule uses if yes, to pop the top element in the cache stack to obtain the target query statement;

[0135] The fifth setting submodule is used to set the next element of the suffix expression array as the element to be converted if no, and enter the step of determining the type of the element to be converted.

[0136] Optionally, the second conversion module 203 may include:

[0137] The query submodule is used to send a target query statement to the target platform to query the network assets and receive the asset information returned by the target platform;

[0138] The conversion submodule is used to convert the asset information into JSON format, and convert the target field in the asset information into the preset field according to the preset mapping relationship to obtain the asset information entry;

[0139] The pending item setting submodule is used to set the asset information items with the same network information as pending items; the network information is IP, port number and transport layer protocol;

[0140] A calculation submodule, used to extract the characteristic data value corresponding to each item to be processed, and calculate the asset index value corresponding to each item to be processed using the characteristic data value;

[0141] The saving submodule is used to save the pending entries with the highest asset index values.

[0142] Optionally, the computing submodule includes:

[0143] An extraction unit, used to extract characteristic data values ​​contained in each entry to be processed; the characteristic data values ​​include the number of asset tags, the length of response data and the time of asset collection;

[0144] The calculation unit is used to perform weighted calculation on the number of asset tags, the length of response data and the asset collection time to obtain the asset index value.

[0145] An embodiment of the present invention further provides an electronic device, including:

[0146] Memory for storing computer programs;

[0147] The processor is used to implement the steps of the above-mentioned network asset query method when executing the computer program.

[0148] Since the embodiments of the electronic device part correspond to the embodiments of the network asset query method part, please refer to the description of the embodiments of the network asset query method part for the embodiments of the electronic device part, which will not be repeated here.

[0149] An embodiment of the present invention further provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the network asset query method of any of the above embodiments are implemented.

[0150] Since the embodiments of the storage medium part correspond to the embodiments of the network asset query method part, please refer to the description of the embodiments of the network asset query method part for the embodiments of the storage medium part, which will not be repeated here.

[0151] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0152] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0153] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0154] The above is a detailed introduction to a network asset query method, device, electronic device and storage medium provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A network asset query method, characterized in that: include: When receiving a query statement to be processed, the query statement to be processed is segmented into basic phrases, and the basic phrases are written into a phrase array in the order of segmentation; the basic phrases include a key-value pair string and an operator; Performing suffix expression conversion on the phrase array according to the preset priority of the operator to obtain a suffix expression array; The suffix expression array is converted by using a preset template to obtain a target query statement, and the target query statement is used to query network assets in a target platform; The using the target query statement to query the network assets in the target platform includes: Sending the target query statement to the target platform to query network assets, and receiving asset information returned by the target platform; Convert the asset information into JSON format, and convert the target field in the asset information into a preset field according to a preset mapping relationship to obtain an asset information entry; Set asset information items with the same network information as items to be processed; the network information is IP, port number and transport layer protocol; Extracting the characteristic data value corresponding to each of the items to be processed, and using the characteristic data value to calculate the asset index value corresponding to each of the items to be processed; The pending entry with the highest asset indicator value is saved.

2. The network asset query method according to claim 1, characterized in that: The step of segmenting the query statement to be processed into basic phrases includes: The first character in the query statement to be processed is set as the character to be processed, and whether the character to be processed is the operator is determined; If yes, segment the left and right sides of the character to be processed; The next character in the query statement to be processed is set as the character to be processed, and the step of determining whether the character to be processed is the operator is entered until all characters in the query statement to be processed are processed to obtain the basic phrase.

3. The network asset query method according to claim 2, characterized in that: Before segmenting the left side and the right side of the character to be processed, the method further includes: Determine whether the character preceding the character to be processed is a preset escape character; If not, the step of segmenting the left side and the right side of the character to be processed is performed.

4. The network asset query method according to claim 1, characterized in that: The operators include logical operators, left priority operators and right priority operators. The phrase array is converted into a suffix expression according to the preset priorities of the operators to obtain a suffix expression array, including: Creating the suffix expression array and cache stack; Setting the first element of the phrase array as an element to be processed, and determining the type of the element to be processed; When the element to be processed is the key-value pair string, writing the element to be processed to the end of the suffix expression array; When the element to be processed is the logical operator, determine the type of the top element of the cache stack; when the top element is an empty element or the left priority operator, push the element to be processed into the cache stack; when the top element is the logical operator, search from the top element to the bottom of the stack for the first logical operator with a priority less than the preset priority of the element to be processed, pop out all elements from the top element to the element before the first logical operator in sequence and write them to the end of the suffix expression array, and push the element to be processed into the cache stack; When the element to be processed is the left priority operator, pushing the element to be processed into the cache stack; When the element to be processed is the right-priority operator, search for the first left-priority operator from the top element of the stack to the bottom of the stack, pop out all elements from the top element of the stack to the element before the first left-priority operator in sequence and write them to the end of the suffix expression array, and remove the first left-priority operator and the element to be processed; After completing the processing of the element to be processed, determining whether the element to be processed is the last element in the phrase array; If yes, all elements in the cache stack are popped out in sequence and written to the end of the suffix expression array; If not, the next element of the phrase array is set as the element to be processed, and the step of determining the type of the element to be processed is entered.

5. The network asset query method according to claim 4, characterized in that: The step of converting the suffix expression array using a preset template to obtain a target query statement includes: Set the first element of the suffix expression array as the element to be converted, and determine the type of the element to be converted; When the element to be converted is the key-value pair string, searching the preset template for a first template corresponding to the key-value pair string, writing the key-value data in the element to be converted into the first template to obtain a first converted element, and pushing the first converted element into the cache stack; When the element to be converted is the logical operator, searching the preset template for a second template corresponding to the logical operator, popping the first two stack elements of the cache stack, writing the stack elements into the second template to obtain a second converted element, and pushing the second converted element into the cache stack; After completing the processing of the element to be converted, determining whether the element to be converted is the last element in the suffix expression array; If yes, pop the top element in the cache stack to obtain the target query statement; If not, the next element of the suffix expression array is set as the element to be converted, and the step of determining the type of the element to be converted is entered.

6. The network asset query method according to claim 1, characterized in that: The extracting the characteristic data value corresponding to each of the items to be processed, and using the characteristic data value to calculate the asset index value corresponding to each of the items to be processed, includes: Extracting characteristic data values ​​contained in each of the items to be processed; the characteristic data values ​​include the number of asset tags, the length of response data, and the time when the asset was collected; The asset index value is obtained by performing a weighted calculation on the number of asset tags, the length of the response data and the asset collection time.

7. A network asset query device, characterized in that: include: A word segmentation module, for, when receiving a query statement to be processed, segmenting the query statement to be processed into basic phrases, and writing the basic phrases into a phrase array in a segmentation order; the basic phrases include a key-value pair string and an operator; A first conversion module, configured to convert the phrase array into a suffix expression according to a preset priority of the operator to obtain a suffix expression array; A second conversion module, configured to convert the suffix expression array using a preset template to obtain a target query statement, and use the target query statement to perform a network asset query in a target platform; The second conversion module includes: The query submodule is used to send a target query statement to the target platform to query the network assets and receive the asset information returned by the target platform; The conversion submodule is used to convert the asset information into JSON format, and convert the target field in the asset information into the preset field according to the preset mapping relationship to obtain the asset information entry; The pending item setting submodule is used to set the asset information items with the same network information as pending items; the network information is IP, port number and transport layer protocol; A calculation submodule, used to extract the characteristic data value corresponding to each item to be processed, and calculate the asset index value corresponding to each item to be processed using the characteristic data value; The saving submodule is used to save the pending entries with the highest asset index values.

8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the network asset query method according to any one of claims 1 to 6 when executing the computer program.

9. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the network asset query method according to any one of claims 1 to 6 are implemented.

Images