A method, system, device, and medium for real-time information asset processing

Abstract

This invention provides a real-time information asset processing method, system, device, and medium. The method mainly includes the following steps: constructing several candidate asset models and setting attribute values ​​for the candidate asset models; determining the model relationships between the candidate asset models and constructing a candidate asset model group based on the model relationships; constructing an asset adapter, acquiring target information assets through the asset adapter, and inputting the target information assets into the candidate asset model group; constructing asset relationships between target information assets based on the model relationships between the candidate asset model groups; visualizing the asset relationships, and / or visualizing the target information assets based on the asset relationships. This method can obtain more complete, detailed, and timely asset information, providing support for associated risk calculation and context enrichment, and improving the management efficiency of information assets. It can be widely applied in the field of computer information technology.

Description

Technical Field

[0001] The present invention relates to the field of computer information technology, and in particular to a real-time information asset processing method, system, device and medium. Background Art

[0002] Timely, accurate and detailed asset management capabilities are prerequisites for enterprise IT operation and maintenance and security governance; however, some current enterprises still encounter difficulties in the most basic asset management link.

[0003] Assets, especially information assets, play an important role in today's IT management and security governance. Precise asset management can reduce a large amount of operation and maintenance costs, boost the organizational business efficiency, and provide technical support for the governance of potential security hazards.

[0004] Traditional asset management can only manage information such as IP addresses, databases, servers, and hardware devices, and is not good at managing information assets in a wider range. Traditional asset management is mainly based on account books, and asset maintenance is carried out through paper documents, Excel spreadsheets or CMDB (Configuration Management Database). However, there are often a large number of problems in the use of such systems, such as: incomplete asset inventory (a large number of assets slipping through the net or not being controlled), incomplete asset information (missing or incomplete attributes), untimely update of asset information (data from last month or even half a year ago), lack of an effective asset management system (traditional Excel and poorly maintained CMDB), etc. The backward asset control concepts and means can no longer meet the real-time and dynamically updated enterprise information computing environment today, and cannot support the security operation goals of dynamic adaptive security governance. Summary of the Invention

[0005] In view of this, in order to at least partially solve one of the above technical problems, an object of an embodiment of the present invention is to provide a more comprehensive and efficient real-time information asset processing method; the embodiment also provides a system, device and storage medium capable of implementing this method.

[0006] On the one hand, the technical solution of the present application provides a real-time information asset processing method, including the following steps:

[0007] Construct a number of candidate asset models and set the attribute values of the candidate asset models;

[0008] Determine the model relationships between a number of the candidate asset models, and construct a candidate asset model group according to the model relationships;

[0009] Construct an asset adapter, obtain target information assets through the asset adapter, and input the target information assets into the candidate asset model group;

[0010] Based on the model relationships between the candidate asset model groups, the asset relationships between the target information assets are constructed.

[0011] The asset relationships are visualized, and / or the target information assets are visualized based on the asset relationships.

[0012] In one feasible embodiment of the present application, the step of constructing an asset adapter, obtaining target information assets through the asset adapter, and inputting the target information assets into the candidate asset model group includes:

[0013] The target information assets are detected and acquired by scanning through a third-party port.

[0014] And / or, call the listening port or network traffic analysis results to capture data packets and obtain the target information assets;

[0015] And / or, read the basic data from the existing asset management system to obtain target asset information.

[0016] In one feasible embodiment of the present application, the step of constructing an asset adapter, obtaining target information assets through the asset adapter, and inputting the target information assets into the candidate asset model group further includes:

[0017] The target information asset is formatted to obtain the first intermediate information;

[0018] Key fields are extracted from the first intermediate information. Based on the extracted key fields, a target asset model is obtained by matching the candidate asset model group. The first intermediate information is then input into the target asset model.

[0019] In one feasible embodiment of the present application, the step of visualizing the asset relationship and / or visualizing the target information asset based on the asset relationship includes:

[0020] Obtain query information, and extract asset feature information based on the query information;

[0021] The target information asset is obtained by performing precise text matching and / or fuzzy text matching based on the asset characteristics, and the asset relationships to which the target information asset belongs are visualized.

[0022] In one feasible embodiment of the present application, the query information includes at least one query condition;

[0023] The step of visualizing the asset relationships and / or visualizing the target information assets based on the asset relationships further includes:

[0024] Obtain a combination of several query conditions, and match the combined query conditions to obtain the target information asset.

[0025] In one feasible embodiment of the present application, the method further includes the following steps:

[0026] The asset relationships are stored in the form of a relationship graph to construct a relationship graph database;

[0027] Obtain snapshot information of the relational graph database at at least one time point, and integrate several snapshot information to obtain an asset snapshot.

[0028] In one feasible embodiment of the present application, the method further includes the following steps:

[0029] Obtain historical modification information of the target information asset based on the asset snapshot;

[0030] An asset trajectory is generated based on several historical modification information, and the asset trajectory is then visualized.

[0031] On the other hand, the technical solution of this application also provides a real-time information asset processing system, which includes:

[0032] A model building unit is used to build several candidate asset models and set the attribute values ​​of the candidate asset models;

[0033] Determine the model relationships between several candidate asset models, and construct a candidate asset model group based on the model relationships;

[0034] An information acquisition unit is used to construct an asset adapter, acquire target information assets through the asset adapter, and input the target information assets into the candidate asset model group;

[0035] The relationship analysis unit is used to construct the asset relationship between the target information assets based on the model relationship between the candidate asset model groups.

[0036] A visualization unit is used to visualize the asset relationships and / or visualize the target information assets based on the asset relationships.

[0037] On the other hand, the present application also provides a real-time information asset processing device, which includes:

[0038] At least one processor;

[0039] At least one memory for storing at least one program;

[0040] When the at least one program is executed by the at least one processor, the at least one processor performs a real-time information asset processing method as described in any one of the first aspects.

[0041] On the other hand, the present application also provides a storage medium storing a processor-executable program, which, when executed by a processor, is used to perform a real-time information asset processing method as described in any one of the first aspects.

[0042] The advantages and beneficial effects of the present invention will be set forth in part in the following description, and the rest will become apparent from the specific embodiments thereof:

[0043] The real-time information asset processing method provided in this application completes asset entry and update through an asset adapter, enabling the acquisition of more complete, detailed, and timely asset information. The method supports associated risk calculation and context enrichment through asset models, asset topology relationships, and customized model attributes. Furthermore, it visualizes the asset relationships between target information assets and the target information assets themselves, enabling more intuitive and accurate information asset management and improving management efficiency. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 A flowchart illustrating the steps of a real-time information asset processing method provided in this application embodiment;

[0046] Figure 2 A schematic diagram of the switch asset model provided in the embodiments of this application;

[0047] Figure 3 This is a schematic diagram of asset relationships based on a relationship diagram in the embodiments of this application;

[0048] Figure 4 This is a schematic diagram of the structure of a real-time information asset processing system provided in an embodiment of this application. Detailed Implementation

[0049] The embodiments of the present invention are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0050] Traditional information asset processing methods often suffer from incomplete asset inventory, untimely asset information updates, and a lack of effective asset management systems. This makes it difficult to obtain the context of a network IP address, pinpoint the port on the switch the server is connected to, or identify the asset owner. In some scenarios, this can lead to terminal loss. To address this, this application provides a real-time information asset processing method that supports real-time context enhancement. This method enables IT, operations, and security departments to create the most comprehensive, accurate, and timely information asset map, facilitating digital system operations and security management.

[0051] In the first aspect, the technical solution of this application proposes a real-time information asset processing method, such as... Figure 1 As shown, the method may include steps S100-S500:

[0052] S100. Construct several candidate asset models and set the attribute values ​​of the candidate asset models;

[0053] Specifically, in this embodiment, different candidate asset models and model definitions can be created through a human-computer interaction interface. The asset model in this embodiment typically refers to a comprehensive tender document for a certain type of asset, including but not limited to IP addresses, servers, company domains, SSL certificates, and employees. Each asset model in this embodiment can have different attribute fields; for example, employee attributes include name, gender, contact information, department, email, etc. Furthermore, when defining or creating this candidate asset model, the embodiment needs to set attribute values ​​for it. The attribute values ​​support data types such as text, numbers, enumerations, and arrays.

[0054] Traditional asset management primarily focuses on inventorying and managing mainstream assets such as IP addresses, hosts, and databases, rarely addressing the broader range of information asset types. ISO 27001 provides a very broad definition of information assets. A typical enterprise information asset includes: business data, software, programs, documents, personnel, organization, network, security, policies, configurations, services, databases, computing resources, virtualization resources, containers, message queues, third-party components, etc. Therefore, this implementation proposes and implements a custom asset model. Through this model, users can define different asset types, such as personnel, laptops, Wi-Fi SSIDs, and software serial numbers. Furthermore, users are allowed to establish model relationships between asset models, including relationships such as open, listen, contain, contained in, running on, bound, used, connected, and based on, and users can extend these relationships themselves. Typical model relationships include: Nginx running on a CentOS operating system, a switch located in the company's server room, employees maintaining a database, a website using a domain name, and the domain name being bound to a certificate, etc.

[0055] S200. Determine the model relationships between several candidate asset models, and construct a candidate asset model group based on the model relationships;

[0056] Specifically, in this embodiment, during the model creation process, relationships between different models can be established. For example, a server may be managed by a specific employee, or an application service may run on a specific host. This embodiment establishes relationships between asset models, supporting one-to-one, one-to-many, and many-to-many relationships. After defining one or more asset models and establishing model relationships, the embodiment can manage the models using asset model groups.

[0057] S300. Construct an asset adapter, obtain the target information asset through the asset adapter, and input the target information asset into the candidate asset model group;

[0058] Specifically, in this embodiment, IT activity information from different systems is received actively and passively. Extracting the desired asset information from this information typically requires formatting, regular expression matching, and field mapping. To facilitate easier use of the asset management system and achieve a ready-to-use experience, this embodiment provides an asset adapter. This adapter comprises dozens of built-in general data parsing and asset mapping logics that can directly extract asset information from IT activities or logs, perform matching, and then complete asset model mapping. Currently, it supports direct collection and intelligent identification of information such as IP, MAC, domain name, email, URL, MAC address, user, security group, hostname, database name, and network segment from platforms including firewalls, operating systems, antivirus software, web servers, databases, access control systems, HIDS, and situational awareness systems. Of course, in addition to using the system's default adapter, users can also develop their own adapters to meet more customized asset identification needs.

[0059] S400. Based on the model relationships between candidate asset model groups, construct the asset relationships between target information assets;

[0060] Specifically, in this embodiment, after the assets are entered, the relationship between the assets can be constructed based on the asset model relationship; and the asset information, as well as the asset relationship information determined by the relationship between the assets, can be stored through a graph database and a relational database.

[0061] S500, Visualize the asset relationships and / or visualize the target information assets based on the asset relationships;

[0062] Specifically, in this embodiment, the embodiment can provide an online browsing interface based on a B / S architecture, allowing users to query, modify, and delete asset information; and can provide a visual interface to graphically display assets and the relationships between them. The embodiment can also provide a query input box, supporting users to precisely or vaguely query specific asset information.

[0063] In some feasible implementations, the step S300 of constructing an asset adapter, obtaining the target information asset through the asset adapter, and inputting the target information asset into the candidate asset model group may include steps S310-S320:

[0064] S310. Scan and detect target information assets by calling third-party ports, services, and device scanners;

[0065] S320, and / or by calling the listening port or network traffic analysis results to capture data packets and obtain target information assets;

[0066] S330, and / or read the basic data of the existing asset management system to obtain the target information asset.

[0067] Specifically, in this embodiment, an information collection engine can be provided, responsible for actively or passively collecting information asset information. Active collection methods include, but are not limited to: proactively probing the customer's internal information assets by scheduling third-party port scans, network asset scans, security vulnerability scans, network management tools, etc. Passive collection includes, but is not limited to: passively receiving activity records of the customer's internal information systems through technologies such as Kafka, syslog, network packet capture, and database monitoring. It should be noted that this is a scalable information collection engine; the specific collection methods are not limited to those described, and users can further extend its capabilities.

[0068] More specifically, the information collection in this embodiment supports two methods: periodic proactive collection and real-time passive collection. Proactive collection refers to retrieving asset information by calling data from built-in or existing asset discovery, detection, and inventory systems within the customer network. Examples include API linkage with the CDDB system, SSH linkage with firewall devices, SNMP linkage with gateway systems, RPC linkage with existing asset management platforms, and JDBC linkage with host management databases. Passive technology refers to receiving activity records from external information systems within the customer network through methods such as listening, packet capture, and triggers, thereby extracting key information from these records to achieve asset identification. For example, a switch log might describe employee A accessing the company network via 802.1x, obtaining the IP address 192.168.0.2, with a corresponding MAC address of 78:2B:47:FC:BB:EF. This activity record can then identify personnel assets, IP assets, and MAC assets.

[0069] In some feasible embodiments, the step S300, which involves constructing an asset adapter, acquiring the target information asset through the asset adapter, and inputting the target information asset into the candidate asset model group, may also include steps S330-S340:

[0070] S330. Format the target information asset to obtain the first intermediate information;

[0071] S340. Extract key fields from the first intermediate information, and based on the extracted key fields, match the target asset model from the candidate asset model group, and input the first intermediate information into the target asset model.

[0072] Specifically, in this embodiment, the embodiment uses an asset adapter that supports future dynamic expansion to accept the collection and entry of subsequent asset information. In this embodiment, the asset adapter is mainly used to format and identify event / activity information received by the information collection engine. By formatting and extracting key fields from the event information, it identifies and adapts them to the specified asset model. For example, asset information such as employee name, IP address, and MAC address can be parsed from the 802.1x access authentication log of the switch and mapped to the corresponding asset model.

[0073] In some feasible implementations, the step S500 of visualizing asset relationships and / or visualizing target information assets based on asset relationships may include steps S510-S520:

[0074] S510. Obtain query information and extract asset feature information based on the query information;

[0075] S520. Based on the asset characteristics, perform precise text matching and / or fuzzy text matching to obtain the target information asset, and visualize the asset relationships to which the target information asset belongs.

[0076] Specifically, in this embodiment, the management interface is based on a B / S architecture, allowing users to query asset information by inputting asset characteristic information or combinations of conditions. The query methods provided in this embodiment include: exact text matching and fuzzy text matching. In addition to displaying an asset list, the query results can also display asset details and the relationships between assets.

[0077] In some feasible implementations, the query information in the method includes at least one query condition; furthermore, step S500 may also include step S530:

[0078] S530. Obtain a combination of several query conditions, and match the combined query conditions to obtain the target information asset.

[0079] Specifically, in this embodiment, including both exact and fuzzy text matching, the embodiment can also combine conditions for querying via an interactive interface, i.e., a query method based on DSL (domain-specific language). In this embodiment, operators or users can freely issue and combine query conditions arbitrarily. After data querying, in addition to visualization, it can also be exported as structured JSON data for easy use by other systems. For example, the query conditions could be: "IDC=Shandong&VPC=Development&Operating System=CentOS&Version>=7.2&Server running Nginx&Nginx version>1.4&(Server owner=wuzhizhineng | Server maintenance manager=Jason)". The method of matching by combining query conditions in this embodiment is beneficial for managing and displaying the topological relationships between assets, therefore it fully supports users combining DSL query statements to achieve asset querying.

[0080] In some feasible implementations, the method may further include steps S410-S420:

[0081] S410. Store the asset relationships in the form of a relationship diagram to construct a relationship diagram database;

[0082] In this embodiment, the relationships between asset models and asset entities are stored in a graph-based manner, which can be implemented using a graph database or a relational database. This database supports user operations such as querying, updating, deleting, and exporting assets.

[0083] More specifically, traditional asset management systems register and attach information (such as tags, attributes, and groupings) for individual assets, lacking information on the relationships between assets. This invention is based on graph-based asset management. Therefore, in addition to storing the information fields of individual assets, it also needs to store the relationships between assets. For example, employee A uses laptops A and B; laptop B is connected to Wi-Fi SSID:office; laptop B's IP address includes 192.168.0.2, etc. Such relationships between assets are not supported by traditional asset management systems; therefore, this invention stores them using a graph-based approach. The database can be a graph database like Neo4J, or a custom implementation based on a relational database.

[0084] S420. Obtain snapshot information from the relational graph database at at least one time point, and integrate several snapshot information to obtain an asset snapshot;

[0085] Specifically, in the embodiments, the embodiments can generate corresponding snapshot information for the data content or status information in the relational graph database at any time, and use the snapshot information at any time to trace back the information assets or determine the changes of the information assets within a target time period.

[0086] In some feasible embodiments, the method may further include steps S430-S440:

[0087] S430. Obtain historical modification information of the target asset based on the asset snapshot;

[0088] S440. Generate an asset trajectory based on several historical modification information and visualize the asset trajectory.

[0089] Specifically, in this embodiment, the relevant attributes of an asset can change, such as the IP address of a laptop computer. The embodiment provides the ability to query snapshot information of an asset at any point in time, and also supports querying the entire change history of a specific asset, i.e., the asset's trajectory.

[0090] Refer to the instruction manual appendix Figure 3 The complete implementation process of the technical solution in this application is as follows:

[0091] A client's network server room has a switch with the IP address 172.16.0.1. The switch's two gigabit ports (G0 / 1 and G0 / 2) are connected to the company's web server and email server, respectively. The web server and email server are maintained by employee A. The IP address of the web server is 192.168.0.1, and the IP address of the email server is 192.168.0.2.

[0092] To maintain information assets in this scenario, staff can create multiple asset models through the asset management system interface, such as... Figure 2 As shown, they are: switch, switch port, server, IP address, and employee.

[0093] Create an asset model for the switch, with attributes including: vendor name, device name, software version, switch port, IP address, etc.

[0094] Create an asset model for the switch's network ports, with attributes including: interface name, whether it is disabled, speed, etc.

[0095] Create an asset model for the server service, with attributes including: server name, IP address, operating system, etc.

[0096] Create an asset model for employees, with attributes including: employee ID, employee name, department, contact information, etc.

[0097] Create a model for IP addresses, with attributes including: IP address, IP type (v4 or v6), subnet mask, etc.;

[0098] Next, enter another important step, which is to define the asset management connection for the asset model. For example, one switch may have multiple network interfaces, so the relationship between the switch and the network interface is one-to-one; one employee may have multiple servers, so the relationship between the employee and the server is one-to-many; and the relationship between the server and the IP address may be many-to-many. Users can build asset model relationships that meet their own management needs and management methods according to the situation.

[0099] Next, asset information can be entered in two ways.

[0100] The first is the active method. IT or security personnel manually enter asset information such as employees, servers, IPs, network interfaces, and switches through the management interface; they can also batch import asset information through existing CMDBs or Excel sheets; they can also scan the network through a network or security scanner to discover assets and then import them into the asset management system.

[0101] The second is the passive method. Discover assets through passive information collection. For example: collect the network access logs of the switch's 802.1x, receive such IT activity logs in ways such as syslog and Kafka, format them, and identify information such as IPs and ports reflected in the logs, so as to complete asset entry.

[0102] The first and second methods can be used separately or mixed. In particular, the second method is an almost real-time information collection that can meet the needs of real-time asset management.

[0103] The information collected by the above two methods is parsed and identified by the asset adapter to complete the entry and update of asset information.

[0104] On the asset management interface, provide a convenient query method. Such as Figure 3 As shown, when the asset information collection is completed, users can query the desired asset information through the management interface, by entering: IP address, device name, employee name, etc. The query supports both precise matching and fuzzy matching.

[0105] Based on higher requirements, users can also use the DSL method for querying, such as: "IP=192.168.0.2 AND owner=A", and even be compatible with natural language-based queries, such as: "Query all Windows servers under employee A".

[0106] On the other hand, the technical solution of this application also provides a real-time information asset processing system, which includes:

[0107] The model building unit is used to build several candidate asset models and set the attribute values ​​of the candidate asset models;

[0108] Determine the model relationships between several candidate asset models, and construct a candidate asset model group based on the model relationships;

[0109] The information acquisition unit is used to construct an asset adapter, acquire the target information asset through the asset adapter, and input the target information asset into the candidate asset model group;

[0110] The relationship analysis unit is used to construct the asset relationships between target information assets based on the model relationships between candidate asset model groups.

[0111] A visualization unit is used to visualize asset relationships and / or visualize target information assets based on asset relationships.

[0112] like Figure 4 As shown in the embodiment, the information asset management system supporting real-time context enhancement, in addition to the aforementioned units, may also include modules such as an information collection engine, an asset model adapter, a model manager, an asset query and display system, an asset relationship graph database, an asset activity trajectory, an asset information historical snapshot, asset governance, an asset management dashboard, and an asset management API interface. The system constructs a model for defining information assets, allowing asset models to define multiple attributes, establish relationships between asset models, support real-time collection of asset information in an active or passive manner, create and update assets based on information activities or collected data, display the relationships between assets in a visual manner, provide asset snapshots and asset historical activity trajectories at any point in time, and provide interactive functions to external systems through operation interfaces, DSLs, and APIs. It is an information asset management system supporting real-time context enhancement.

[0113] The embodiment constructs an information asset management system that supports real-time context enhancement, enabling IT, operations and maintenance, and security departments of enterprises and institutions to achieve the most comprehensive, accurate, and timely information asset map, thereby facilitating digital system operations and security management.

[0114] On the other hand, the technical solution of this application also provides a real-time information asset processing device; which includes:

[0115] At least one processor; at least one memory for storing at least one program; when the at least one program is executed by the at least one processor, the at least one processor performs a real-time information asset processing method as described in the first aspect.

[0116] This invention also provides a storage medium storing a corresponding executable program, which is executed by a processor to implement a real-time information asset processing method as described in the first aspect.

[0117] From the above specific implementation process, it can be concluded that the technical solution provided by the present invention has the following advantages or strengths compared with the prior art:

[0118] 1) The technical solution of this application integrates more complete, more detailed and more timely asset information. The asset adapter completes asset entry and update through active, passive and manual methods, even for those temporary assets that have just been launched.

[0119] 2) The technical solution of this application can provide a visualized asset model and asset topology relationship, with customizable model attributes. The asset relationship supports one-to-one, one-to-many, and many-to-many relationships, providing support for associated risk calculation and context enrichment.

[0120] 3) The technical solution of this application uses massive data input for accurate asset updates, receives information from various systems within the customer's network, updates asset information in real time and accurately, and provides change history and information snapshots for any asset.

[0121] It should be noted that in all specific embodiments of this application, all data processing activities related to user identity or personal characteristics, such as user information, user behavior data, historical data, and location information, will be conducted in accordance with the principles of legality, legitimacy, and necessity. All data collection, use, storage, and processing will be subject to compliance with applicable national and regional laws, regulations, and industry standards, and informed consent from users will be obtained in a clear and explicit manner before processing. For the processing of sensitive personal information, separate consent from users will be obtained through prominent means such as pop-up prompts and independent confirmation pages. If any processing conflicts with laws and regulations, the laws and regulations will prevail, and necessary data processing will only be carried out within the scope permitted by laws and regulations, ensuring that all data-based applications, analyses, and technical implementations are conducted within the scope permitted by laws and regulations.

[0122] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.

[0123] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0124] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0125] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0126] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0127] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A method for processing real-time information assets, characterized in that, Includes the following steps: Construct several candidate asset models and set the attribute values ​​of the candidate asset models; Determine the model relationships between several candidate asset models, and construct a candidate asset model group based on the model relationships; Constructing an asset adapter, obtaining target information assets through the asset adapter, and inputting the target information assets into the candidate asset model group, including: The target information assets are detected and acquired by scanning through a third-party port. And / or, call the listening port or network traffic analysis results to capture data packets and obtain the target information assets; And / or, read the basic data of the existing asset management system to obtain the target asset information; The target information asset is formatted to obtain the first intermediate information; Key fields are extracted from the first intermediate information. Based on the extracted key fields, the target asset model is obtained by matching the candidate asset model group. The first intermediate information is then input into the target asset model. The asset adapter, which supports future dynamic expansion, accepts the collection and input of subsequent asset information. The asset adapter is used to format and identify the event / activity information received by the information collection engine. By formatting and extracting key fields from the event information, it identifies and adapts the information to the specified asset model. Based on the model relationships between the candidate asset model groups, the asset relationships between the target information assets are constructed. The asset relationships are visualized, and / or the target information assets are visualized based on the asset relationships; The asset relationships are stored in the form of a relationship graph to construct a relationship graph database; Obtain snapshot information of the relational graph database at at least one time point, and integrate several snapshot information to obtain an asset snapshot; Obtain historical modification information of the target information asset based on the asset snapshot; An asset trajectory is generated based on several historical modification information, and the asset trajectory is then visualized.

2. The real-time information asset processing method according to claim 1, characterized in that, The step of visualizing the asset relationships and / or visualizing the target information assets based on the asset relationships includes: Obtain query information, and extract asset feature information based on the query information; The target information asset is obtained by performing precise text matching and / or fuzzy text matching based on the asset characteristics, and the asset relationships to which the target information asset belongs are visualized.

3. The real-time information asset processing method according to claim 2, characterized in that, The query information includes at least one query condition; The step of visualizing the asset relationships and / or visualizing the target information assets based on the asset relationships further includes: Obtain a combination of several query conditions, and match the combined query conditions to obtain the target information asset.

4. A real-time information asset processing system, characterized in that, The system includes: The model building unit is used to build several candidate asset models, set the attribute values ​​of the candidate asset models, determine the model relationships between the candidate asset models, and build a candidate asset model group based on the model relationships. An information acquisition unit, configured to construct an asset adapter, acquire target information assets through the asset adapter, and input the target information assets into the candidate asset model group, includes: The target information assets are detected and acquired by scanning through a third-party port. And / or, call the listening port or network traffic analysis results to capture data packets and obtain the target information assets; And / or, read the basic data of the existing asset management system to obtain the target asset information; The target information asset is formatted to obtain the first intermediate information; Key fields are extracted from the first intermediate information. Based on the extracted key fields, the target asset model is obtained by matching the candidate asset model group. The first intermediate information is then input into the target asset model. The asset adapter, which supports future dynamic expansion, accepts the collection and input of subsequent asset information. The asset adapter is used to format and identify the event / activity information received by the information collection engine. By formatting and extracting key fields from the event information, it identifies and adapts the information to the specified asset model. The relationship analysis unit is used to construct the asset relationship between the target information assets based on the model relationship between the candidate asset model groups. A visualization unit is used to visualize the asset relationships and / or visualize the target information assets based on the asset relationships; The asset relationships are stored in the form of a relationship graph to construct a relationship graph database; Obtain snapshot information of the relational graph database at at least one time point, and integrate several snapshot information to obtain an asset snapshot; Obtain historical modification information of the target information asset based on the asset snapshot; An asset trajectory is generated based on several historical modification information, and the asset trajectory is then visualized.

5. A real-time information asset processing device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs a real-time information asset processing method as described in any one of claims 1-3.

6. A storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to run a real-time information asset processing method as described in any one of claims 1-3.

Images