Port service detection method, device, equipment and computer-readable storage medium

Abstract

The present application provides a port service detection method, apparatus, device and computer-readable storage medium; the method includes: respectively creating detection tasks corresponding to each target port of a target server; using a parallel processing method for at least some detection tasks to execute each detection task and obtain at least two detection results; respectively creating matching tasks corresponding to each detection result, the matching task being used to instruct to match the service characteristics in the detection result with preset service characteristics; using a parallel processing method for at least some matching tasks to execute each matching task and obtain corresponding matching results; and determining the service provided by the corresponding target port based on the matching results. The present application can shorten the port service detection time, improve the overall detection execution efficiency and the accuracy of port service detection.

Description

Technical Field

[0001] The present application relates to Internet security technology, and in particular to a port service detection method, apparatus, device, and computer-readable storage medium. Background Art

[0002] A port is a potential communication channel, and thus an intrusion channel. Improper port usage can easily expose important server services, leading to server intrusion and network asset hacker attacks. Generally, server ports are probed to obtain information about the services provided by the probed ports, and the security of the server is determined based on the services provided by the ports.

[0003] Related art port probing involves scanning ports on the target machine's corresponding Internet Protocol (IP) address, sequentially executing pre-loaded service fingerprints for each port. Because fingerprints are executed serially during port probing, if the number of fingerprints continues to increase, the entire port probing time will increase linearly, impacting overall performance. Summary of the Invention

[0004] The embodiments of the present application provide a port service detection method, apparatus, device, and computer-readable storage medium, which can shorten the port service detection time, improve the overall detection execution efficiency, and improve the accuracy of port service detection.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present invention provides a method for detecting a port service, including:

[0007] Creating a probe task corresponding to each target port of the target server respectively, wherein the probe task is used to instruct to send a service probe to the corresponding target port;

[0008] executing each of the detection tasks in parallel, obtaining at least two detection results, the detection results including service characteristics for responding to the service probe;

[0009] Creating matching tasks corresponding to the respective detection results, wherein the matching tasks are used to instruct matching of service features in the detection results with preset service features;

[0010] executing each of the matching tasks in parallel to obtain corresponding matching results;

[0011] The service provided by the corresponding target port is determined based on the matching result.

[0012] The present invention provides a port service detection device, including:

[0013] A first creation module is used to create a detection task corresponding to each target port of the target server, wherein the detection task is used to instruct to send a service probe to the corresponding target port;

[0014] a detection module configured to execute each of the detection tasks in a manner that processes at least some of the detection tasks in parallel, and obtain at least two detection results, wherein the detection results include a service feature for responding to the service probe;

[0015] A second creation module is used to create a matching task corresponding to each of the detection results, wherein the matching task is used to instruct to match the service characteristics in the detection result with the preset service characteristics;

[0016] a matching module, configured to execute each matching task in a manner that processes at least some matching tasks in parallel, and obtain corresponding matching results;

[0017] The determination module is configured to determine the service provided by the corresponding target port based on the matching result.

[0018] In the above solution, the first creation module is further used to obtain each open port of the target server as the target port;

[0019] Creating a task scheduling coroutine corresponding to each of the target ports to obtain a task scheduling coroutine group;

[0020] A detection task corresponding to each of the target ports is created through the task scheduling coroutine group.

[0021] The step of creating a detection task corresponding to each target port through the task scheduling coroutine group includes:

[0022] Each task scheduling coroutine in the task scheduling coroutine group independently performs the following operations:

[0023] The task scheduling coroutine obtains the port information of the corresponding target port;

[0024] The port information and the service probe are packaged to obtain a detection task corresponding to the target port.

[0025] In the above solution, the detection module is further used to create a network communication coroutine pool, and the network communication coroutine pool includes at least two network communication coroutines;

[0026] The detection tasks are executed in parallel through the at least two network communication coroutines.

[0027] In the above solution, the device further includes a rate limiting module, which is used to obtain the task execution frequency of each network communication coroutine during the process of executing each detection task in parallel through the at least two network communication coroutines;

[0028] The task execution frequency is the frequency of sending service probes to the corresponding target port;

[0029] When the task execution frequency reaches a task execution frequency threshold, the task execution frequency of the corresponding network communication coroutine is controlled.

[0030] In the above solution, the second creation module is further used to package each of the detection results and the detection tasks corresponding to the detection results through the at least two network communication coroutines to obtain a matching task corresponding to each of the detection results.

[0031] In the above solution, the matching module is further used to create a feature matching coroutine pool, and the feature matching coroutine pool includes at least two feature matching coroutines;

[0032] The matching tasks are executed in parallel through the at least two feature matching coroutines.

[0033] In the above solution, the device further includes an audit module, which is configured to, after determining the service provided by the target port based on the matching result through the matching module,

[0034] Performing a security audit on the service provided by the target port to obtain security audit information, wherein the security audit information is used to indicate the security of the service provided by the target port;

[0035] In the above solution, the device further includes an output module for outputting the security audit information and port service information obtained by the audit module.

[0036] In the above solution, the device further includes a loading module, which, before creating the detection tasks corresponding to the target ports of the target server through the first creation module,

[0037] The loading module is used to construct a service fingerprint in a structured format, wherein the service fingerprint in the structured format includes: a service probe field and a service feature field;

[0038] Accordingly, the matching module obtains corresponding matching results after executing each matching operation, including:

[0039] The service feature in each of the detection results is matched with the content in the service feature field of the service fingerprint to obtain a corresponding matching result.

[0040] An embodiment of the present application provides an electronic device, including:

[0041] a memory for storing executable instructions;

[0042] The processor is configured to implement the port service detection method provided in the embodiment of the present application when executing the executable instructions stored in the memory.

[0043] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for causing a processor to execute instructions to implement the port service detection method provided in the embodiment of the present application.

[0044] The embodiments of the present application have the following beneficial effects:

[0045] The embodiment of the present application creates a detection task corresponding to each target port of the target server, and adopts a parallel processing method for at least some of the detection tasks to execute each detection task, obtain at least two detection results, and then creates a matching task corresponding to each detection result, and adopts a parallel processing method for at least some of the matching tasks to execute each matching task. Since the detection result includes service features for responding to the service probe, the process of executing each matching task is to match the service features in the detection result with the preset service features, and finally determine the service provided by the target port, thereby shortening the port service detection time and improving the overall detection execution efficiency based on the parallel processing of the detection task and the parallel processing of the matching task. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is an optional structural diagram of the port service detection system architecture provided in an embodiment of the present application;

[0047] Figure 2 is a structural diagram of an electronic device 400 provided in an embodiment of the present application;

[0048] Figure 3 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0049] Figure 4 This is an optional schematic diagram of the service fingerprint pattern provided in the embodiment of the present application;

[0050] Figure 5 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0051] Figure 6 This is an optional structural diagram of the port service detection method provided in an embodiment of the present application;

[0052] Figure 7This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0053] Figure 8 This is an optional structural diagram of the port service detection device provided in an embodiment of the present application;

[0054] Figure 9 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0055] Figure 10 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0056] Figure 11 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0057] Figure 12 This is an optional schematic diagram of the relevant service fingerprint format provided in the embodiment of the present application;

[0058] Figure 13 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0059] Figure 14 This is an optional flow chart of the port service detection method provided in an embodiment of the present application;

[0060] Figures 15A-15D This is a comparison chart of the execution efficiency of the port service detection method provided in the embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0062] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0063] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0065] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0066] 1) Service discovery refers to the use of detection technology to discover publicly available services on servers on the network. Since services are bound to IP addresses and ports, service discovery involves detecting open ports on IP addresses, as well as information such as the type and version of the service running on those ports.

[0067] 2) Service fingerprint, which describes the characteristics returned by different services for a specific request content. In some embodiments, it can be recorded in a text file. Specifically, a service fingerprint can include a probe and a feature list;

[0068] Among them, the probe is the content to be sent to the unknown service. After obtaining the probe response, if the response content hits a certain feature, it can be considered that the target is the service corresponding to this feature; the feature list includes multiple (i.e. at least two) features, and the features describe the necessary conditions to determine whether the target belongs to a specific service.

[0069] 3) YAML is a highly readable and easy-to-edit general data structure serialization format, commonly used to describe data structures, configuration files and other data information.

[0070] The inventors found that most of the relevant port detection technical solutions are to perform port scanning on the target server, detect the actual open ports, and then execute the pre-loaded service fingerprints on each port in sequence. If the service bound to the port hits a certain fingerprint, the hit result is returned.

[0071] Based on this, the inventors discovered that the related art serially executes service fingerprints during port service detection. If the number of service fingerprints continues to increase, the entire port service detection time will increase linearly, which will affect the overall detection performance. Furthermore, the detection task cannot be accurately rate-limited during the detection process, which poses the risk of sending fingerprint probes too frequently and affecting the normal service of the target port. Secondly, the format of the related service fingerprint files is disorganized, with all service fingerprints grouped together, without a unified and easy-to-manage fingerprint description scheme.

[0072] Based on this, embodiments of the present application provide a port service detection method, apparatus, device, and computer-readable storage medium, which can shorten the port service detection time and improve the overall detection efficiency.

[0073] First, the port service detection system provided by the embodiment of the present application is described. Figure 1 An optional schematic diagram of the port service detection system 100 provided in the embodiment of the present application, see Figure 1 In order to support an exemplary application of port service detection, the target server 600 (target server 600-1 and target server 600-2 are shown as examples) is connected to the detection server 200 through the network 300. The network 300 can be a wide area network or a local area network, or a combination of the two, and a wireless link is used to realize data transmission.

[0074] In some embodiments, the detection server 200 and the target server 600 can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The management terminal 500 can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to this. The management terminal and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present application.

[0075] The management terminal 500 is used to send a port service detection request to the detection server 200, and the detection request carries at least parameters such as the IP address of the target server requested for detection. The detection server 200 is used to respond to the detection request sent by the management terminal 500, parse the IP address parameters of the target server carried in the detection request; based on the IP address obtained by parsing, obtain multiple port information of the target server 600 as the target port, and create detection tasks corresponding to each target port respectively, wherein the detection task is used to indicate the sending of a service probe to the corresponding target port; adopt a parallel processing method for at least some detection tasks to execute each detection task and obtain at least two detection results, wherein the detection result includes a service feature for responding to the service probe; create a matching task corresponding to each detection result respectively, and the matching task is used to indicate matching the service feature in the detection result with the preset service feature; adopt a parallel processing method for at least some matching tasks to execute each matching task and obtain the corresponding matching result; determine the service provided by the corresponding target port based on the matching result;

[0076] And based on the services provided by the determined target port, the corresponding detection results are returned to the management terminal.

[0077] The management terminal 500 is further configured to receive the detection results returned by the detection server 200 and perform a security audit on the service provided by the port based on the detection results.

[0078] Next, the electronic device for implementing the above-mentioned port service detection method provided by the embodiment of the present application is described. Figure 2 , Figure 2 This is a schematic diagram of the structure of the electronic device 400 provided in the embodiment of the present application. In practical applications, the electronic device 400 can be implemented as Figure 1 The target server 600, the detection server 200 or the management terminal 500 in the electronic device is Figure 1 Taking the detection server 200 shown as an example, an electronic device that implements the port service detection method of the embodiment of the present application is described. Figure 2 The electronic device 400 shown includes: at least one processor 410, a memory 450, at least one network interface 420 and a user interface 430. The various components in the electronic device 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 440 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 440 is not shown in FIG. Figure 2 Various buses are labeled as bus system 440 .

[0079] The processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0080] The user interface 430 includes one or more output devices 431 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0081] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, etc. The memory 450 may optionally include one or more storage devices that are physically remote from the processor 410.

[0082] The memory 450 includes volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 450 described in the embodiments of the present application is intended to include any suitable type of memory.

[0083] In some embodiments, the memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplified below.

[0084] Operating system 451, including system programs for processing various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, and driver layer, which are used to implement various basic services and process hardware-based tasks;

[0085] A network communication module 452 for reaching other computing devices via one or more (wired or wireless) network interfaces 420 , exemplary network interfaces 420 including Bluetooth, WiFi, and USB;

[0086] a presentation module 453 for enabling presentation of information via one or more output devices 431 (e.g., a display screen, a speaker, etc.) associated with the user interface 430 (e.g., a user interface for operating peripheral devices and displaying content and information);

[0087] The input processing module 454 is configured to detect one or more user inputs or interactions from one of the one or more input devices 432 and to translate the detected inputs or interactions.

[0088] In some embodiments, the port service detection device provided in the embodiments of the present application can be implemented in software. Figure 2 The port service detection device 455 stored in the memory 450 is shown. The port service detection device 455 can be software in the form of a program or plug-in, and includes the following software modules: a first creation module 4551, a detection module 4552, a second creation module 4553, a matching module 4554, and a determination module 4555. These modules are logical and can be arbitrarily combined or further separated according to the functions implemented. The functions of each module will be described below.

[0089] In other embodiments, the port service detection device provided in the embodiments of the present application can be implemented in hardware. As an example, the port service detection device provided in the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the port service detection method provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0090] Next, the port service detection method provided in the embodiment of the present application will be described in combination with the exemplary application and implementation of the detection server provided in the embodiment of the present application.

[0091] See also Figure 3 , Figure 3 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, which will be combined with Figure 3 The steps shown are explained.

[0092] Step 101: The detection server creates detection tasks corresponding to the target ports of the target server respectively. The detection tasks are used to instruct to send service probes to the corresponding target ports.

[0093] Here, the detection task corresponds to the target port one by one. The detection server creates a detection task for each acquired target port. The detection task at least includes the service probe and the port information of the target port.

[0094] In actual implementation, before creating a probe task corresponding to each target port of the target server, the probe server will first load all service fingerprint files into memory, parse the service fingerprint information, obtain the service probe from the service fingerprint information, and assemble the service probe and the port information of the target port into a probe task. The probe content to be sent is determined based on the service probe, and the target port to receive the service probe is determined based on the port information. Based on this, the port information at least includes the port identifier (i.e., port number) and IP address.

[0095] The service fingerprint describes the characteristics returned by different port services for a specific request content, and is generally stored in the form of a file. Specifically, a structured service fingerprint is pre-built, and the structured service fingerprint includes: a service probe field and a service characteristic field.

[0096] In actual implementation, service fingerprints can be serialized and stored in YAML format. Figure 4 This is an optional schematic diagram of the service fingerprint pattern provided in the embodiment of the present application, which will be combined with Figure 4 Describe the service fingerprint.

[0097] For example, see Figure 4 The service fingerprint is expressed in YAML format. The key fields include the service probe field qcontent (number 2) and the feature field allmathes (number 4). The feature field is usually a collection of multiple service features. In addition, the service fingerprint also includes a fingerprint priority field probeindex (number 1). The priority field is used to indicate that the port service provided by the target port can match the service features in multiple service fingerprints, and the service feature with the highest fingerprint priority is determined to be the service provided by the target port. The port number field ports (number 3) is used to represent the list of ports that receive service probes. For example, a ports value of 1-65535 indicates that all ports can receive service probes. Among them, the feature field allmathes (number 4) is a collection of multiple service features. Each service feature contains multiple fields to describe the service feature information of a specific service. For example, servicename (number 5) is the service name corresponding to the service feature; mcontent (number 6) is the condition for matching the service feature, described using a regular expression; fallback (number 7), when not empty, indicates that if the probe result returned by the target port does not match the service feature in the current service fingerprint, a secondary match is performed against the service feature in the service fingerprint specified by fallback. Therefore, the fallback value is generally the name of the service file; pcremod (number 8) is the matching mode, version (number 10) is the service version information, and information (number 11) is additional information about the service feature. The structured service fingerprint format based on YAML is clear and highly readable, making it easy to modify, expand, and manage.

[0098] To illustrate creating a detection task, in some embodiments, see Figure 5 , Figure 5 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, based on Figure 3 , step 101 can also be implemented as follows:

[0099] Step 1011: The detection server obtains each open port of the target server as a target port;

[0100] Here, the target port is a port that is actually currently open to the outside world in the target server, and when executing the corresponding service, it can represent the specific information of the network communication service executed by the port.

[0101] In actual implementation, the target server can directly detect its own port information and actively send the port information to the detection server, so that the detection server can accurately detect the open ports of the target server directly based on the received port information without having to detect all ports, thereby improving detection efficiency.

[0102] Step 1012: Create a task scheduling coroutine corresponding to each target port to obtain a task scheduling coroutine group;

[0103] Here, the task scheduling coroutines correspond to the target ports one-to-one, that is, the number of task scheduling coroutines is consistent with the number of target ports.

[0104] Step 1013: Create a detection task corresponding to each target port through the task scheduling coroutine group.

[0105] Here, creating a detection task through a task scheduling coroutine group actually means that the task scheduling coroutine in the task scheduling coroutine group creates a detection task corresponding to the target port.

[0106] In some embodiments, each task scheduling coroutine independently creates a detection task. Specifically, the task scheduling coroutine obtains port information of a corresponding target port; packages the port information with a service probe to obtain a detection task corresponding to the target port.

[0107] In actual implementation, when each task scheduling coroutine creates a detection task, they are independent of each other and do not affect each other.

[0108] For example, see Figure 6 , Figure 6It is an optional structural diagram of the port service detection method provided by the embodiment of the present application. The task scheduling coroutine packages the port information and the service probe to create a detection task. For example, a port detection collects n port information and pre-loads m service fingerprints from the fingerprint file directory into the memory. At this time, n task scheduling coroutines are created. Each task scheduling coroutine packages a port information and m service probes (there are m service fingerprints, because each service fingerprint corresponds to a service probe, and the number of service probes is the same as the number of service fingerprints) to create a detection task. Therefore, the number of detection tasks is consistent with the number of target ports. A total of n detection tasks will be created, each of which carries m service probes, that is, each target port receives a detection task carrying m service probes.

[0109] In some embodiments, all service fingerprints are loaded into the memory at one time, and the service probes and target port information corresponding to all service fingerprints are packaged into a detection task. The batch parallel processing method can solve the problem of linear time extension in related detection technologies because all service probes are stored in one file and the service probes can only be obtained sequentially each time.

[0110] In actual implementation, service probes are processed in batches and in parallel. The following situations exist: a single service probe is sent to a batch of target ports at the same time; a batch of service probes are sent to one target port at the same time.

[0111] For example, see Figure 7 , Figure 7 A schematic diagram of a port service probe provided in an embodiment of the present application. Service probe 1 can be sent simultaneously to three ports of target server A and three ports of target server B, meaning one service probe is sent to a group of ports simultaneously. Service probe 1 and service probe 2 can be sent simultaneously to port 1 of target server A, meaning a group of service probes are sent to a single target port simultaneously.

[0112] Step 102: Execute each detection task in a manner that processes at least some detection tasks in parallel, and obtain at least two detection results, where the detection results include service characteristics for responding to the service probe.

[0113] Here, at least some of the detection tasks are processed in parallel to execute each detection task. It can be understood that a port detection process will create multiple detection tasks that are consistent with the number of target ports. In order to improve the efficiency of executing detection tasks, parallel processing is usually adopted to execute detection tasks. However, due to limitations of actual network bandwidth, server throughput and other conditions, not all detection tasks can be executed at one time. In actual applications, batch parallel processing is adopted, that is, some detection tasks are processed at a time.

[0114] In some embodiments, when at least some detection tasks are processed in parallel, before executing each detection task, the task scheduling coroutine outputs the created detection task to a detection task queue, where it queues for processing. When the detection task is executed, the detection task is dequeued from the detection task queue. Specifically, each task scheduling coroutine outputs each detection task to the detection task queue, which is used to cache detection tasks awaiting execution.

[0115] For example, see Figure 6 Among them, the detection task corresponding to the target port created by the task scheduling coroutine will first be queued into the detection task queue and wait for execution.

[0116] In some embodiments, see Figure 8 , Figure 8 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, based on Figure 3 , step 102 can also be implemented as follows:

[0117] Step 1021: Create a network communication coroutine pool, which includes at least two network communication coroutines;

[0118] Here, the network communication coroutine pool includes at least two network communication coroutines, each of which will execute the same number of detection tasks in parallel. Each network communication coroutine is independent and does not interfere with each other, and each executes its own business logic. Once an idle network communication coroutine in the network communication coroutine pool is available, it will continuously attempt to obtain waiting detection tasks from the detection task queue.

[0119] Step 1022: Execute each detection task in parallel through at least two network communication coroutines.

[0120] Here, the network communication coroutine obtains the probe task waiting to be executed, parses the port information in the probe task, and determines the target port for receiving the service probe based on the IP address and port number in the port information. After the network communication coroutine issues a probe task, it will continuously try to obtain the next pending probe task from the probe task queue. After the probe task is executed, the network communication coroutine will receive the probe result returned by the target port (that is, the response data sent by the target port to the received service probe), where the probe result includes service feature information indicating the service provided by the target port.

[0121] The number of probe results received by a probe task is equal to the number of service probes included in the probe task. For example, if a probe task contains m service probes, the target port will reply with m response data for each of the m service probes.

[0122] In some embodiments, to prevent the network communication coroutine pool from sending probe tasks to each target port too quickly, thereby affecting the normal execution of the target port's service, a rate limit control is performed before sending each probe task. Specifically, during the process of executing each probe task in parallel through at least two network communication coroutines, the task execution frequency of each network communication coroutine is obtained; the task execution frequency is the frequency of sending service probes to the corresponding target port; when the task execution frequency reaches the task execution frequency threshold, the task execution frequency of the corresponding network communication coroutine is controlled.

[0123] The task execution frequency threshold is explained. In some embodiments, the task execution frequency threshold is determined based on the processing capability of the corresponding target port for the detection task. The processing capability can be understood as the maximum concurrent number of service probes that the target port can respond to while ensuring normal service of the target port within a preset time. The task execution frequency of the corresponding network communication coroutine is controlled to ensure that the task execution frequency is lower than the task execution frequency threshold.

[0124] In actual implementation, the dimension of speed limit can be the IP address (target IP) or target port of the target server. The target IP is speed-limited from an overall perspective to ensure that the detection frequency of the target IP is not too high, thereby ensuring the execution of normal services on the target IP. For example, assuming that the target IP can only process m detection tasks per second, but through the network communication coroutine pool, one can issue m+n detection tasks, then n detection tasks will enter waiting for processing, waiting for the next second to be processed. In addition, precise speed limit can also be performed for a single target port. The embodiment of the present application does not specifically limit the method of speed limit.

[0125] Step 103: creating matching tasks corresponding to the respective detection results. The matching tasks are used to instruct to match the service features in the detection results with preset service features.

[0126] Here, the matching task includes a detection result, which is response data returned by the target port to the service probe and carries service characteristics of the service provided by the target port.

[0127] The creation of matching tasks corresponding to each detection result is explained. In some embodiments, the matching task includes at least the detection result returned after the target port receives the service probe and the corresponding detection task. Specifically, through at least two network communication coroutines, each detection result and the detection task corresponding to the detection result are packaged to obtain a matching task corresponding to each detection result.

[0128] In some embodiments, after a matching task is created, it is not executed immediately and needs to wait for resources. Based on this, the network communication coroutine will output the created matching task to the matching task queue, where it will be queued for processing. When the matching task is executed, the matching task is dequeued from the matching task queue. Specifically, each matching task is output to the matching task queue through each network communication coroutine. The matching task queue is used to cache matching tasks waiting to be executed.

[0129] For example, see Figure 6 The network communication coroutine sends a probe task carrying m service probes to the target port. The target port responds to each service probe for the probed service and returns the corresponding probe results. The number of probe results returned by a probe task is equal to the number of service probes carried in the probe task. The network communication coroutine packages the probe results with the probe task to obtain a matching task. The matching task is then output to the matching task queue for execution.

[0130] Step 104: Execute each matching task in a manner that processes at least some matching tasks in parallel to obtain corresponding matching results.

[0131] Here, at least some matching tasks are processed in parallel to execute each matching task. This can be understood as packaging each detection result and each detection task through a network communication coroutine pool to create multiple matching tasks. In order to improve the efficiency of executing matching tasks, matching tasks are usually executed in parallel. However, due to limitations such as actual network bandwidth and server throughput, not all matching tasks can be executed at once. In actual applications, matching tasks are executed in batches in parallel, that is, some matching tasks are executed at a time.

[0132] In some embodiments, when at least some matching tasks are processed in parallel, before executing each matching task, the network communication coroutine outputs the created matching task to a matching task queue for processing. When the matching task is executed, the matching task is dequeued from the matching task queue. Specifically, each matching task is output to the matching task queue through each network communication coroutine, and the matching task queue is used to cache matching tasks waiting to be executed.

[0133] The parallel processing of partial matching tasks is described. In some embodiments, see Figure 9 , Figure 9 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, based on Figure 3 , step 104 can also be implemented as follows:

[0134] Step 1041: Create a feature matching coroutine pool, which includes at least two feature matching coroutines;

[0135] Here, the feature matching coroutine pool includes at least two feature matching coroutines. Each feature matching coroutine is independent and does not interfere with each other, and each executes its own feature matching business logic. Once an idle feature matching coroutine in the feature matching coroutine pool is available, it will continuously attempt to obtain matching tasks waiting for execution from the matching task queue.

[0136] Step 1042: Execute each matching task in parallel through at least two feature matching coroutines to obtain corresponding matching results.

[0137] Here, at least two feature matching coroutines in the feature matching coroutine pool obtain at least two matching tasks waiting to be executed, ensuring the parallel execution of matching tasks and improving matching efficiency. After the feature matching coroutine completes the current matching task, it will continuously attempt to obtain the next matching task to be processed from the matching task queue.

[0138] The execution of the matching task by the feature matching coroutine is explained. In some embodiments, the feature matching coroutine parses the detection results in the matching task, obtains the service feature information of the service provided by the target port, and matches it with all service features in the feature field of the service fingerprint where the pre-loaded service probe is located. Specifically, the coroutines in the feature matching coroutine pool respectively match the service features in each detection result with the preset service features to obtain at least two feature matching results; wherein the preset service features are each service feature in the feature field in the service fingerprint corresponding to the service probe.

[0139] In other embodiments, the specific information in the preset service features is usually in the form of regular expressions. The detection results in the matching task are parsed to obtain the service feature information of the service provided by the target port, and the service feature information is matched with the regular expressions in the preset service feature information. Specifically, the regular expressions corresponding to the service features contained in the feature field in the service fingerprint are obtained; and the service features in each detection result are matched with each regular expression.

[0140] For example, see Figure 10 , Figure 10This is an optional flow chart of the port service detection method provided by the embodiment of the present application, wherein the service fingerprint probe1 is in YAML format, wherein 2 represents the service probe field qcontent, and 3 represents the feature field allmatches, which includes the service feature name service name as http, and the condition mcomtent (i.e., a string of regular expressions) corresponding to the http service feature. The service probe qcontent is sent to port 80 of the target server with an IP address of 127.0.0.1. The port returns response data for the service probe. The response data includes the service feature 8 of the Nginx service provided by port 80. The service feature 8 is matched with the service feature preset in mcontent (i.e., matched with the regular expression represented by mco ntent). If they match, it means that the service provided by port 80 is the nginx service.

[0141] Step 105: Determine the service provided by the corresponding target port based on the matching result.

[0142] Here, the matching results are explained. In some embodiments, a detection task can carry multiple service probes, and a detection result will be returned for each service probe. The matching task obtains the corresponding matching result based on each detection result. That is, the service feature information of the service provided by a target port can be matched with the feature fields in multiple service fingerprints to obtain a batch of matching results. As for which matching result to use, it is determined by the priority field of the service fingerprint, that is, the matching result with a higher priority is selected according to the priority of the service fingerprint to which the service probe belongs. For example, if the two detection results obtained by target port 1 match the feature fields in the service fingerprint, the service provided by port 1 is finally determined according to the priority of the service fingerprint. Port 1 has matching result 1 for service fingerprint 1 and matching result 2 for service fingerprint 2. If the priority of service fingerprint 1 is higher than that of service fingerprint 2, the service provided by target port 1 is determined according to matching result 1.

[0143] In some embodiments, after determining the service provided by the corresponding target port based on the matching result, the service information of the target port will be returned to the task scheduling coroutine, and the task scheduling coroutine will perform a security audit on the service provided by the target port, and further determine whether there are loopholes in the service corresponding to the target port, or whether the service provided by the target port is a high-risk service. Among them, security audit refers to the process of reviewing existing records in accordance with the specified security policy to discover system loopholes and intrusion behaviors. Here, it refers to judging whether there are security loopholes in the service provided by the target port through the security policy. Specifically, a security audit is performed on the service provided by the target port to obtain security audit information, and the security audit information is used to indicate the security of the service provided by the target port.

[0144] In actual implementation, it is necessary to set a specified security policy to conduct a security audit on the target port service. To determine whether a port service is high-risk or has vulnerabilities, the security policy is first set. The security policy is a means of determining whether the service provided by the target port has vulnerabilities or whether it is a high-risk service. For example, the version information, name, identifier and other information of the service provided by the target port are detected and matched with preset keywords. The preset keywords are used to indicate that the service provided by the port has vulnerabilities or is a high-risk service. If the relevant information of the service provided by the port contains the preset keywords, it is considered that the service provided by the port has vulnerabilities, and these preset keywords can be identified as a security policy.

[0145] In actual implementation, a security audit can also be conducted by setting up a service blacklist, matching the detected service version information, name, identification, and other information with the corresponding information in the blacklist (i.e., the list of services with security risks) to determine whether the service has security risks based on the matching results.

[0146] In summary, in the embodiment of the present application, different target ports can be detected at the same time, and a single target port can receive multiple service probes at the same time. After obtaining a batch of matching results, the matching result with a high priority is selected according to the priority of the service fingerprint. This method of sending service probes in batches and concurrently can shorten the detection time and improve program performance. In addition, the embodiment of the present application abstracts the port service detection process by designing pooling technologies such as the network communication coroutine pool and the feature matching coroutine pool. The network communication coroutine pool and the feature matching coroutine pool contain the same processing coroutine, thereby maximizing resource utilization. Furthermore, in order to prevent the detection frequency from being too fast, the embodiment of the present application introduces speed limit processing, which can perform quasi-speed limit on a single detection target to prevent affecting the normal service of the target port. Finally, in order to solve the problem of the traditional service fingerprint format being messy, the embodiment of the present application provides a formatted fingerprint format based on YAML. The service fingerprint structure in the YAML format is clear and readable, making it easy to modify and manage.

[0147] Next, we will continue to introduce the port service detection method provided by the embodiment of the present application. Figure 11 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, see Figure 11 The port service detection method provided in the embodiment of the present application is collaboratively implemented by the target server, the detection service server and the management terminal.

[0148] Step 201: The management terminal sends a port service detection request to the detection server.

[0149] Here, the management terminal sends a probe request to the detection server. The parameter information carried in the port service probe request includes at least a structured service fingerprint file pre-built by the management terminal and target IP information. The target IP address can be the IP address of a target server for which port service detection is required, or it can be the IP addresses of multiple target servers.

[0150] The service fingerprint file in a structured format is explained. In some embodiments, the service fingerprint file in a structured format can be structured and stored in YAML format. One service probe corresponds to one service fingerprint, and each service fingerprint contains multiple fields such as a priority field (probeindex), a service probe field (qcont ent), and a feature field (allmatches).

[0151] The service fingerprint format in the related art is confusing. For example, see Figure 12 , Figure 12 This is an optional diagram of the service fingerprint format provided by the embodiment of this application. A service fingerprint contains multiple service probes, and the service fingerprint format is confusing. The formatted service fingerprint format based on YAML is used, see Figure 4 , the service fingerprint structure is clear, readable, and easy to modify and manage. The embodiment of the present application does not specifically limit the format of the structured service fingerprint.

[0152] Step 202: The detection server parses the parameter information carried in the detection request based on the received detection request.

[0153] Here, the parameter information carried in the probe request sent by the management terminal includes at least structured service fingerprint information and target IP information. The service fingerprint information can be a single service fingerprint information or a batch of service fingerprint information; the target IP can be the IP address of a single target server or multiple target server IP addresses.

[0154] Before performing port service detection, the detection server will load all service fingerprints into memory and parse the service fingerprints to obtain all service probe contents and the IP information of the target server. In the related art, a service fingerprint contains multiple service probes, see Figure 12The main fields of a service probe include: the service probe field Probe (numbered 1), which includes the service name (such as TCP), the probe name (GetRequest), and the probe content (GET / HTTP / 1.@\r\n\r\n); the port information field ports (numbered 2), which indicates that the probe content is sent only to the port specified by ports; and the feature field match (numbered 3), which simply stacks multiple matches, making the specific content difficult to read. When reading service probes from the service fingerprint file, they can only be read sequentially. As the number of service fingerprints increases, the time required for port service detection increases linearly. Increasing the number of service fingerprints can mean increasing the number of service fingerprint files or increasing the number of service features in the feature field of a single service fingerprint.

[0155] The above-mentioned method of obtaining service probes in parallel solves the problem of linear time extension caused by the traditional method of serially reading service fingerprints to obtain service probes.

[0156] Step 203: The detection server obtains the open port of the target server as the target port based on the parameter information obtained through parsing.

[0157] Here, the detection server establishes a connection with the target IP based on the resolved target IP and obtains the open port of the target IP as the target port.

[0158] The acquisition of the target port is explained. In some embodiments, the target server can actively report its own open port information. The target server detects its own port information. When the target server has a security detection requirement for the service it provides, it reports its own open port information to the detection server, so that the detection server can directly detect the open ports in each target server based on the received port information without having to detect all ports. In other embodiments, the detection server can actively obtain the open port information of the target server. The detection server directly obtains the target port to which the service probe needs to be sent by parsing the value in the port information field ports in the service fingerprint. The embodiments of the present application do not specifically limit the method for obtaining the target port.

[0159] Step 204: The detection server creates a task scheduling coroutine corresponding to each target port to obtain a task scheduling coroutine group.

[0160] Here, the number of task scheduling coroutines is the same as the number of target ports.

[0161] Step 205: Each task scheduling coroutine in the task scheduling coroutine group obtains the port information of the corresponding target port.

[0162] Step 206: The task scheduling coroutine packages the port information and the service probe to obtain a detection task corresponding to the target port.

[0163] Here, the number of service probes included in a probe task is the same as the number of service fingerprints. For example, if there are three service fingerprints, then a probe task will include three service probes. The probe task determines the probe content to be sent based on the service probes and then determines the target port to receive the service probes based on the port information.

[0164] Step 207: Create a network communication coroutine pool including at least two network communication coroutines.

[0165] Step 208: Send the detection task to the target port of the target server in parallel through the network communication coroutine pool.

[0166] Step 209: The target port of the target server responds to receiving the detection task and returns at least two detection results.

[0167] Here, after receiving a service probe in a detection task, the target port responds with response data (i.e., a probe result) for that service probe. The probe result includes the service characteristics used to respond to the service probe. The number of probe results matches the number of service probes, meaning the target port responds for each service pointer.

[0168] Step 210: The detection server packages each detection result and the detection task corresponding to the detection result through at least two network communication coroutines to obtain a matching task corresponding to each detection result.

[0169] Here, the matching tasks include detection results and detection tasks corresponding to the detection results are packaged, wherein the number of matching tasks is consistent with the number of detection results.

[0170] Step 211: Create a feature matching coroutine pool including at least two feature matching coroutines.

[0171] Here, the feature matching coroutine pool is created to improve the feature matching efficiency through pooling technology, thereby improving the overall detection execution efficiency.

[0172] Step 212: The service features in each detection result are matched in parallel with the content in the service feature field of the service fingerprint through the feature matching coroutine pool to obtain corresponding matching results.

[0173] Here, pooling technology is used to perform the matching task, and the service features in the detection results are matched one by one with the service feature fields in each service fingerprint to obtain the matching results.

[0174] In actual implementation, the service feature field in the service fingerprint often exists in the form of a regular expression. The service feature in the detection result is matched with the regular expression. If a match occurs, it indicates that the service belongs to the service corresponding to the regular expression.

[0175] Step 213: Perform a security audit on the service provided by the target port to obtain security audit information.

[0176] Here, a security audit is performed on the service provided by the target port to further determine whether the service provided by the target port is a high-risk service or has vulnerability risks.

[0177] Step 214: Output the port service information and security audit information to the management terminal.

[0178] In summary, the embodiment of the present application proposes a batch concurrent detection scheduling architecture to address the problem of longer detection time due to the expansion of the number of fingerprints. That is, one detection task sends the service probes in all service fingerprints to the target port together, solving the problem of linear time extension caused by traditional serial detection. At the same time, the embodiment of the present application implements pooling technology by creating a task scheduling coroutine group with parallel processing capabilities, a network communication coroutine pool, and a feature matching coroutine pool, further improving the overall detection execution efficiency and shortening the detection time. For the fingerprint storage format, the embodiment of the present application proposes a structured fingerprint format based on YAML. The service fingerprint format has a clear structure, high readability, and is easy to modify, expand, and manage.

[0179] The following describes an exemplary application of the embodiment of the present application in a practical application scenario, using the port service detection method provided in the embodiment as an example and implemented by a detection server.

[0180] See also Figure 13 , Figure 13 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, see Figure 14 , Figure 14 This is an optional flow chart of the port service detection method provided in the embodiment of the present application, which will be combined with Figure 13 The steps shown are explained.

[0181] Step 301: The detection server obtains the open port information of the target server.

[0182] Here, at least one target server refers to a group of target devices that need to be detected. Each server corresponds to an IP. Detecting the target server is actually detecting the port actually opened by each target IP.

[0183] Step 302: For each target IP+target port combination, create a corresponding task scheduling coroutine.

[0184] Here, each task scheduling coroutine is responsible for detecting a port, and the task scheduling coroutine and the target port are one-to-one corresponding. That is, the number of task scheduling coroutines is the same as the number of target ports. Multiple task scheduling coroutines form a task scheduling coroutine group ( Figure 14 The task scheduling coroutine is responsible for detecting the specific information of the services provided by the target port, and also provides functions such as parsing service fingerprint files, managing the detection process, and obtaining detection results.

[0185] Step 303: The task scheduling coroutine packages the service probe and task information into a detection task, and sends the detection task in batches to the detection task queue to wait for execution.

[0186] Here, the task information includes at least the target port information and the task identifier (task ID). The target port information includes at least the target IP address, port number, etc. The service probe is used to indicate the probe content that needs to be sent to the target port. The service probe and the task information constitute a complete detection task, which is sent to the channel in batches by the task scheduling coroutine. Here, the channel can be understood as a detection task queue composed of detection tasks. The task scheduling coroutine continuously inputs the packaged detection tasks into the detection task queue ( Figure 14 detection task queue).

[0187] Because the entire port service detection process is executed by a process (that is, the entire process is executed in memory), all service fingerprints in the fingerprint file directory are loaded into memory before port detection begins. The task scheduling coroutine parses the service fingerprint and obtains the corresponding service probe. The detection task is stored in memory as a structure (struct).

[0188] The service fingerprint is a formatted service fingerprint format based on YAML. The formatted service fingerprint format based on YAML has the advantages of strong readability and easy editing and management.

[0189] For example, see Figure 4 , where probeindex represents the priority of the service fingerprint, qcontent represents the service probe content, and allmatches is a list of features. Each feature contains several fields describing the characteristics of a specific service. For example, servicename is the service name corresponding to the feature, mcountent is the condition for matching the feature, and is described by a regular expression. pcremod is the matching pattern, and version and information are additional information about the feature service.

[0190] Step 304: Execute the detection task concurrently through the network communication coroutine pool.

[0191] Step 305: Determine whether the response data from the target port is received. If the response data is received successfully, proceed to step 306.

[0192] Here, the network communication coroutine retrieves the probe task from the probe task queue, parses the task information in the probe task to determine the target port to receive the probe task, and then sends the service probe in the probe task to the determined target port. After receiving the service probe, the target port will reply with response data (i.e., return the probe result) in response to the service probe.

[0193] After the network communication coroutine finishes executing the current detection task, it will keep trying to get new detection tasks from the detection task queue. Figure 14 The network communication coroutines in the network communication coroutine pool are independent of each other and do not interfere with each other.

[0194] If the network communication coroutine does not receive the response data from the target port, the network communication coroutine sends a detection failure message to the task scheduling coroutine. After the task scheduling coroutine receives the detection task response failure result, it directly outputs the result and the detection process ends.

[0195] Step 306: The network communication coroutine creates a feature matching task based on the detection result returned by the target port, and outputs the feature matching task to the matching task queue.

[0196] Here, the communication network coroutine obtains the response data of the target port, packages the response data and the detection task sent to the target port, and creates a feature matching task corresponding to the target port. Then the feature matching task is output to the matching task queue ( Figure 14 matching task queue), waiting for feature matching coroutine processing.

[0197] It is understandable that after receiving the detection task sent by the network communication coroutine, the target port will reply with corresponding response data, and the response data carries characteristic information that can indicate the service provided by the target port.

[0198] Step 307: Concurrently execute the feature matching tasks in the matching task queue through the feature matching coroutine pool to obtain the execution results of the feature matching tasks.

[0199] Step 308: Determine whether the response data of the target port in the feature matching task matches a service feature in the feature field of the service fingerprint. If the match is successful, execute step 309.

[0200] Here, the feature matches the coroutine pool ( Figure 14The feature matching coroutine in the feature matching coroutine pool obtains the feature matching task to be executed from the channel (i.e., the matching task queue), then loads the feature field corresponding to the service probe in the feature matching task (the feature field is generally a set of multiple service features), and traverses all service features in the feature field to determine whether the response data of the target port matches a certain feature.

[0201] If the match fails, the match failure information is directly sent to the task scheduling coroutine.

[0202] Step 309: Determine the service information provided by the target port, and send the service information provided by the target port to the task scheduling coroutine.

[0203] Step 310: The task scheduling coroutine performs a security audit on the service of the obtained target port.

[0204] Here, the task scheduling coroutine performs a security audit on the services provided by the target port based on the services of the target port. Figure 14 ), further determine whether the service corresponding to the target port has a vulnerability, or whether the service provided by the target port is a high-risk service.

[0205] Among them, it is necessary to set a specified security policy for security auditing of the target port service. To determine whether a port service is high-risk or has vulnerabilities, first set a security policy. The security policy is a means of determining whether the service provided by the target port has vulnerabilities or whether it is a high-risk service. For example, the version information, name, identifier and other information of the service provided by the target port are detected and matched with preset keywords. The preset keywords are used to indicate that the service provided by the port has vulnerabilities or is a high-risk service. If the relevant information of the service provided by the port contains preset keywords, it is considered that the service provided by the port has vulnerabilities, and then these preset keywords can be identified as a security policy.

[0206] Furthermore, the security policy can be understood as a vulnerability set. If the service information provided by the target port belongs to this vulnerability set, it is judged that the service provided by the target port is a high-risk service or has a vulnerability. The vulnerability set is also equivalent to a security policy.

[0207] Step 311: Output the service information and security audit information of the target port.

[0208] Figures 15A-15D This is a comparison chart of the execution efficiency of the port service detection method provided in the embodiment of the present application, see Figure 15A, the speed of the mainstream open source tool (nmap tool) in actual detection, number 1 is the relevant instruction of nmap port detection, number 2 is the detection result output after executing the instruction, number 3 is the execution time required for the instruction to be executed once, see 15B is the speed of the tool implemented in the embodiment of the present application in actual detection, number 1 is the relevant instruction of the tool implemented in the embodiment of the present application for port detection, number 2 is the detection result output after executing the instruction, number 3 is the execution time required for the instruction to be executed once. Figure 15A and Figure 15B It can be seen that the tool implemented in the embodiment of the present application is faster than the mainstream open source tool (nmap tool) in actual detection; see Figure 15C This is the port service detection time of the tool implemented in the embodiment of the present application in the scenario where the service fingerprint does not cover the service detection, see Figure 15D It is the execution time of port service detection by mainstream open source tools (nmap tool) in the scenario where service fingerprint does not cover service detection, which is determined by Figure 15C and Figure 15D It can be seen that in the scenario where the service fingerprint does not cover the service detection, the port service detection time of the embodiment of the present application is much faster than that of the open source solution.

[0209] In summary, in the embodiment of the present application, different target ports can be detected at the same time, and a single target port can receive multiple service probes at the same time. After obtaining a batch of probe results, the scheduling coroutine selects the probe result with a high priority according to the priority of the service fingerprint. This method of sending service probes in batches and concurrently can shorten the detection time and improve program performance. In addition, the embodiment of the present application abstracts the port service detection process by designing pooling technologies such as the network communication coroutine pool and the feature matching coroutine pool. The network communication coroutine pool and the feature matching coroutine pool contain the same processing coroutines. The size of the coroutine pool can be freely set, thereby maximizing resource utilization. Furthermore, in order to solve the problem of the messy format of traditional service fingerprints, the embodiment of the present application provides a formatted fingerprint format based on YAML. The service fingerprint format of YAML format has a clear structure and strong readability, which is convenient for modification and management.

[0210] The following continues to describe the exemplary structure of the port service detection device 455 provided in the embodiment of the present application as a software module. In some embodiments, see Figure 2 , Figure 2 FIG. 4 is an optional schematic diagram of a port service detection device provided in an embodiment of the present application, as shown in FIG. 4 . The software modules stored in the port service detection device 455 of the memory 450 may include:

[0211] A first creation module 4551 is configured to create a detection task corresponding to each target port of the server, wherein the detection task is configured to instruct to send a service probe to the corresponding target port;

[0212] A detection module 4552 is configured to execute each of the detection tasks in parallel, obtaining at least two detection results, the detection results including service characteristics for responding to the service probe;

[0213] A second creation module 4553 is configured to create a matching task corresponding to each of the detection results, wherein the matching task is configured to instruct matching of a service feature in the detection result with a preset service feature;

[0214] A matching module 4554 is configured to execute each matching task in parallel to obtain a corresponding matching result.

[0215] The determination module 4555 is configured to determine the service provided by the corresponding target port based on the matching result.

[0216] In some embodiments, the first creation module is further configured to obtain each open port of the target server as the target port;

[0217] Creating a task scheduling coroutine corresponding to each of the target ports to obtain a task scheduling coroutine group;

[0218] A detection task corresponding to each of the target ports is created through the task scheduling coroutine group.

[0219] The step of creating a detection task corresponding to each target port through the task scheduling coroutine group includes:

[0220] Each task scheduling coroutine in the task scheduling coroutine group independently performs the following operations:

[0221] The task scheduling coroutine obtains the port information of the corresponding target port;

[0222] The port information and the service probe are packaged to obtain a detection task corresponding to the target port.

[0223] In some embodiments, the detection module is further used to create a network communication coroutine pool, wherein the network communication coroutine pool includes at least two network communication coroutines;

[0224] Each of the detection tasks is executed in parallel through the at least two network communication coroutines. In some embodiments, the second creation module is further used to package each of the detection results and the detection tasks corresponding to the detection results through the at least two network communication coroutines to obtain a matching task corresponding to each of the detection results.

[0225] In some embodiments, the matching module is further configured to create a feature matching coroutine pool, wherein the feature matching coroutine pool includes at least two feature matching coroutines;

[0226] The matching tasks are executed in parallel through the at least two feature matching coroutines.

[0227] In some embodiments, the apparatus further includes an audit module configured to, after determining the service provided by the target port based on the matching result through the matching module,

[0228] Performing a security audit on the service provided by the target port to obtain security audit information, wherein the security audit information is used to indicate the security of the service provided by the target port;

[0229] In some embodiments, the device further includes an output module for outputting the security audit information and port service information obtained by the audit module.

[0230] In some embodiments, the device further comprises a loading module, which, before creating the detection tasks corresponding to the target ports of the target server through the first creation module,

[0231] The loading module is used to construct a service fingerprint in a structured format, wherein the service fingerprint in the structured format includes: a service probe field and a service feature field;

[0232] Accordingly, the matching module obtains corresponding matching results after executing each matching operation, including:

[0233] The service feature in each of the detection results is matched with the content in the service feature field of the service fingerprint to obtain a corresponding matching result.

[0234] In some embodiments, the apparatus further includes a rate limiting module configured to obtain, during the process of executing each of the detection tasks in parallel through the at least two network communication coroutines, a task execution frequency of each of the network communication coroutines;

[0235] The task execution frequency is the frequency of sending service probes to the corresponding target port;

[0236] When the task execution frequency reaches a task execution frequency threshold, the task execution frequency of the corresponding network communication coroutine is controlled.

[0237] It should be noted that the description of the port service detection device in the embodiment of the present application is similar to the description of the above-mentioned port service detection method embodiment, and has similar beneficial effects as the port service detection method embodiment, so it will not be repeated.

[0238] An embodiment of the present application provides an electronic device, including:

[0239] a memory for storing executable instructions;

[0240] The processor is configured to implement the port service detection method provided in the embodiment of the present application when executing the executable instructions stored in the memory.

[0241] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for implementing the port service detection method provided in the embodiment of the present application when executed by a processor.

[0242] The present invention provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the port service detection method described above in the present invention.

[0243] The embodiment of the present application provides a computer-readable storage medium storing executable instructions, wherein the executable instructions are stored. When the executable instructions are executed by a processor, the processor will execute the port service detection method provided by the embodiment of the present application, for example, Figure 3 The port service detection method is shown.

[0244] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or various devices including one or any combination of the above memories.

[0245] In some embodiments, executable instructions may be in the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0246] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinating files (e.g., files storing one or more modules, subroutines, or code portions).

[0247] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0248] In summary, the embodiments of the present application can shorten the port service detection time, improve program performance, and maximize resource utilization through pooling technology.

[0249] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, and improvements made within the spirit and scope of the present application are included in the scope of protection of the present application.

Claims

1. A port service detection method, characterized in that: The method comprises: Based on the target server's own port information detected, obtain each open port of the target server; Using each open port of the target server as the target port; Creating a task scheduling coroutine corresponding to each of the target ports to obtain a task scheduling coroutine group; Creating a detection task corresponding to each of the target ports through the task scheduling coroutine group; The detection task is used to instruct to send a single service probe to a group of the target ports at the same time, or to send a group of the service probes to one target port at the same time; Create a network communication coroutine pool, the network communication coroutine pool includes at least two network communication coroutines; execute each of the detection tasks in parallel through the at least two network communication coroutines to obtain at least two detection results, the detection results including service characteristics for responding to the service probe; in the process of executing each of the detection tasks in parallel through the at least two network communication coroutines, obtain the task execution frequency of each of the network communication coroutines respectively; wherein the task execution frequency is the frequency of sending the service probe to the corresponding target port; when the task execution frequency reaches the task execution frequency threshold, control the task execution frequency of the corresponding network communication coroutine; Creating matching tasks corresponding to the respective detection results, wherein the matching tasks are used to instruct matching of service features in the detection results with preset service features; executing each of the matching tasks in batches in a manner that at least some of the matching tasks are processed in parallel to obtain corresponding matching results; Determine the service provided by the corresponding target port based on a matching result of a service fingerprint of the service probe having a high priority in the matching result; Wherein, the service fingerprint is executed serially; A security audit is performed on the service provided by the target port to obtain security audit information, where the security audit information is used to indicate the security of the service provided by the target port.

2. The method according to claim 1, wherein The step of creating a detection task corresponding to each of the target ports through the task scheduling coroutine group includes: Each task scheduling coroutine in the task scheduling coroutine group independently performs the following operations: The task scheduling coroutine obtains the port information of the corresponding target port; The port information and the service probe are packaged to obtain a detection task corresponding to the target port.

3. The method according to claim 1, wherein The creating of matching tasks corresponding to the detection results respectively includes: The detection results and the detection tasks corresponding to the detection results are packaged through the at least two network communication coroutines to obtain matching tasks corresponding to the detection results.

4. The method according to claim 1, wherein The batch-by-batch matching tasks are performed in parallel with at least some of the matching tasks, and the matching tasks are performed in parallel, including: Creating a feature matching coroutine pool, wherein the feature matching coroutine pool includes at least two feature matching coroutines; The matching tasks are executed in parallel through the at least two feature matching coroutines.

5. The method according to claim 1, wherein Before obtaining the open ports of the target server based on the target server's own port information detected, the method further includes: Constructing a service fingerprint in a structured format, wherein the service fingerprint in the structured format includes: a service probe field and a service feature field; Accordingly, executing each matching task to obtain a corresponding matching result includes: The service feature in each of the detection results is matched with the content in the service feature field of the service fingerprint to obtain a corresponding matching result.

6. A port service detection device, characterized in that: The device comprises: The first creation module is configured to obtain the open ports of the target server based on the port information detected by the target server itself; use the open ports of the target server as target ports; create a task scheduling coroutine corresponding to each target port to obtain a task scheduling coroutine group; create a detection task corresponding to each target port through the task scheduling coroutine group; the detection task is used to instruct a single service probe to be sent to a group of target ports at the same time, or a group of service probes to be sent to one target port at the same time; A detection module is used to create a network communication coroutine pool, wherein the network communication coroutine pool includes at least two network communication coroutines; through the at least two network communication coroutines, each of the detection tasks is executed in parallel to obtain at least two detection results, and the detection results include service characteristics for responding to the service probe; in the process of executing each of the detection tasks in parallel through the at least two network communication coroutines, the task execution frequency of each of the network communication coroutines is obtained respectively; wherein the task execution frequency is the frequency of sending the service probe to the corresponding target port; when the task execution frequency reaches the task execution frequency threshold, the task execution frequency of the corresponding network communication coroutine is controlled; A second creation module is used to create a matching task corresponding to each of the detection results, wherein the matching task is used to instruct to match the service characteristics in the detection result with the preset service characteristics; A matching module, configured to execute the matching tasks in batches by processing at least some of the matching tasks in parallel, and obtain corresponding matching results; A determination module, configured to determine the service provided by the corresponding target port based on a matching result of a service fingerprint to which the service probe belongs having a high priority in the matching result, wherein the service fingerprint is executed serially; The audit module is used to perform a security audit on the service provided by the target port to obtain security audit information, where the security audit information is used to indicate the security of the service provided by the target port.

7. An electronic device, characterized in that: The electronic device comprises: a memory for storing computer-executable instructions; The processor is configured to implement the port service detection method according to any one of claims 1 to 5 when executing the executable instructions stored in the memory.

8. A computer-readable storage medium storing executable instructions, characterized in that: When the executable instructions are executed by a processor, the port service detection method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the port service detection method according to any one of claims 1 to 5 is implemented.

Images