A network asset detection method based on traffic fingerprint

Abstract

The present application provides a network asset detection method based on traffic fingerprint, which relates to the field of computer technology. The method includes: first sending a preset data packet to the device where the target network of the network asset to be determined is located, so that the device where the target network is located can return the feedback information of the network asset to be determined; and, receiving the traffic information of the network asset to be determined collected by the detection point on the device where the target network is located; then generating a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information; when the first traffic fingerprint and the second traffic fingerprint are different, inputting the first traffic fingerprint and the second traffic fingerprint into the preset neural network respectively, so that the preset neural network outputs the first prediction result and the second prediction result respectively; finally, determining the asset type of the network asset to be determined according to the first prediction result and the second prediction result, and the above method improves the accuracy of network asset identification.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network asset detection method based on traffic fingerprint. Background Art

[0002] Network assets include network devices such as host devices, routers, and security devices, as well as operating systems, services, and applications. With the development of computer network technology, there are more and more network assets. Network asset detection is one of the important prerequisites for achieving data governance and has application value in data security-related work.

[0003] In traditional network asset detection, manual statistics is the most primitive asset detection method, which has the disadvantages of high cost and low efficiency. In order to improve the detection efficiency, the relevant technology provides three methods. The first is an automatic statistical method based on the client, but this method requires the installation of the client on each device, which has the defects of strong invasiveness and may affect the normal flow of business in the business system. The second is based on the Simple Network Management Protocol (SNMP), using agent software embedded in the network facilities to collect network communication information and statistical data on network devices, but each target device needs to open the SNMP protocol, the process is cumbersome and security problems frequently occur. The third is to discover assets by combining different open source port scanners. This method is relatively common. Commonly used tools include Nmap, Masscan, Zmap, etc. These scanner tools have their own advantages and disadvantages and need to be used in combination. The detection efficiency of operating systems, services and applications has been improved to a certain extent, but in specific business scenarios, its performance is poor and the detection accuracy is low.

[0004] Therefore, the existing technology has the technical problem of low accuracy in network asset detection. Summary of the invention

[0005] The present application provides a network asset detection method based on traffic fingerprinting, which is used to solve the technical problem of low accuracy of network asset detection in the prior art.

[0006] According to a first aspect of the present application, a network asset detection method based on traffic fingerprint is provided, comprising:

[0007] Sending a preset data packet to a device where a target network of the network asset to be determined is located, so that the device where the target network is located can transmit feedback information of the network asset to be determined based on the preset data packet; and, receiving traffic information of the network asset to be determined collected by a detection point on the device where the target network is located;

[0008] Generating a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information;

[0009] When the first traffic fingerprint is different from the second traffic fingerprint, the first traffic fingerprint and the second traffic fingerprint are respectively input into a preset neural network, so that the preset neural network outputs a first prediction result and a second prediction result respectively; wherein the preset neural network is trained by a known traffic fingerprint and an asset type associated with the known traffic fingerprint, the first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint;

[0010] The asset type of the to-be-determined network asset is determined according to the first prediction result and the second prediction result.

[0011] Optionally, the generating a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information includes:

[0012] Preprocessing the feedback information to generate a first traffic fingerprint;

[0013] The flow information is screened to obtain a screening result, and the screening result is preprocessed to generate a second flow fingerprint.

[0014] Optionally, preprocessing the feedback information to generate a first traffic fingerprint includes:

[0015] Extracting features from the feedback information to obtain at least one type of information feature;

[0016] Extracting a target field from the information feature, and performing numerical calculations based on the target field to obtain a numerical feature;

[0017] For each type of information feature, encode the information feature according to an encoding method corresponding to the type to obtain an encoded information feature;

[0018] All types of the encoded information features and numerical features are combined into a feature vector, and the feature vector is used as the first traffic fingerprint.

[0019] Optionally, when the type includes an enumeration type and a character type, for each type of information feature, the information feature is encoded according to an encoding method corresponding to the type to obtain the encoded information feature, including:

[0020] For the enumerated information feature, the enumerated information feature is encoded according to the one-hot encoding method corresponding to the enumerated type to obtain the encoded enumerated feature;

[0021] For the character-type information features, the enumeration-type information features are encoded according to the effect encoding method corresponding to the character type to obtain the encoded character-type features.

[0022] Optionally, the network asset detection method based on traffic fingerprint further includes:

[0023] Construct an initial neural network consisting of an input layer, a hidden layer, and an output layer;

[0024] A known traffic fingerprint and an asset type associated with the known traffic fingerprint are obtained, and the acquired known traffic fingerprint and the asset type associated with the known traffic fingerprint are used as training data to train the initial neural network. During the training process, a preset loss function is used to calculate the loss function value between the prediction result output by the initial neural network and the asset type associated with the known traffic fingerprint, until a preset stop training condition is reached to obtain a preset neural network.

[0025] Optionally, the preset loss function is a loss function including a regularization term, using the following formula:

[0026]

[0027] Wherein, L is the function value of the loss function, y is the real label value, which is used to indicate the asset type associated with the known traffic fingerprint. is the predicted probability value, which is used to represent the predicted result output by the initial neural network, and F is the regularization term.

[0028] Optionally, the network asset detection method based on traffic fingerprint further includes:

[0029] When the first traffic fingerprint is the same as the second traffic fingerprint, inputting the first traffic fingerprint or the second traffic fingerprint into a preset neural network so that the preset neural network outputs a first prediction result or a second prediction result;

[0030] The asset type of the to-be-determined network asset is determined according to the first prediction result or the second prediction result.

[0031] According to a second aspect of the present application, a network asset detection device based on traffic fingerprint is provided, comprising:

[0032] A sending and receiving module, used to send a preset data packet to a device where a target network of a network asset to be determined is located, so that the device where the target network is located can return feedback information of the network asset to be determined based on the preset data packet; and, to receive traffic information of the network asset to be determined collected by a detection point on the device where the target network is located;

[0033] A generating module, configured to generate a first flow fingerprint and a second flow fingerprint respectively according to the feedback information and the flow information;

[0034] An input module, used for inputting the first traffic fingerprint and the second traffic fingerprint into a preset neural network respectively when the first traffic fingerprint is different from the second traffic fingerprint, so that the preset neural network outputs a first prediction result and a second prediction result respectively; wherein the preset neural network is trained by a known traffic fingerprint and an asset type associated with the known traffic fingerprint, the first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint;

[0035] A determination module is used to determine the asset type of the to-be-determined network asset according to the first prediction result and the second prediction result.

[0036] According to a third aspect of the present application, there is provided an electronic device, comprising: at least one processor and a memory;

[0037] The memory stores computer-executable instructions;

[0038] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the network asset detection method based on traffic fingerprint as described in the first aspect above.

[0039] According to a fourth aspect of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the network asset detection method based on traffic fingerprint as described in the first aspect above.

[0040] According to a fifth aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the network asset detection method based on traffic fingerprint described in the first aspect.

[0041] The present application provides a network asset detection method based on traffic fingerprint, which first sends a preset data packet to a device where a target network of a network asset to be determined is located, so that the device where the target network is located can transmit feedback information of the network asset to be determined based on the preset data packet; and, receives traffic information of the network asset to be determined collected by a detection point on the device where the target network is located; then, based on the feedback information and the traffic information, generates a first traffic fingerprint and a second traffic fingerprint respectively; when the first traffic fingerprint is different from the second traffic fingerprint, inputs the first traffic fingerprint and the second traffic fingerprint into a preset neural network respectively, so that the preset neural network outputs a first prediction result and a second prediction result respectively; wherein the preset neural network is trained by using a known traffic fingerprint and an asset type associated with the known traffic fingerprint, the first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint; finally, based on the first prediction result and the second prediction result, determines the asset type of the network asset to be determined.

[0042] The present application provides two detection methods: an active scanning and identification method based on sending preset data packets and a passive traffic analysis method based on detection points, and effectively combines these two detection methods with a preset neural network, that is, the first traffic fingerprint corresponding to the feedback information detected by the active scanning and identification method and the second traffic information corresponding to the traffic information collected by the passive traffic analysis method are both used as inputs of the preset neural network, and then the network assets are determined through the trained preset neural network, thereby improving the efficiency of network asset identification and the accuracy of network asset identification.

[0043] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0045] Figure 1 A flow chart of a network asset detection method based on traffic fingerprint provided in an embodiment of the present application;

[0046] Figure 2 for Figure 1 Schematic diagram of the process of S102;

[0047] Figure 3 A flowchart of another network asset detection method based on traffic fingerprint provided in an embodiment of the present application;

[0048] Figure 4 A flow chart of another network asset detection method based on traffic fingerprint provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of a network asset detection device based on traffic fingerprint provided in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0051] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0052] Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0053] In traditional network asset detection, manual statistics is the most primitive asset detection method, which has the disadvantages of high cost and low efficiency. In order to improve the detection efficiency, the relevant technology provides three methods. The first is an automatic statistical method based on the client, but this method requires the installation of the client on each device, which has the defects of strong invasiveness and may affect the normal flow of business in the business system. The second is based on the Simple Network Management Protocol (SNMP), using agent software embedded in the network facilities to collect network communication information and statistical data on network devices, but each target device needs to open the SNMP protocol, the process is cumbersome and security problems frequently occur. The third is to discover assets by combining different open source port scanners. This method is relatively common. Commonly used tools include Nmap, Masscan, Zmap, etc. These scanner tools have their own advantages and disadvantages and need to be used in combination. The detection efficiency of operating systems, services and applications is improved to a certain extent, but in specific business scenarios, its performance is poor and the detection accuracy is low. Therefore, the prior art has the technical problem of low accuracy of network asset detection.

[0054] In order to solve the above technical problems, the overall inventive concept of the present application is to provide a method applied in the computer field for improving the accuracy of determining network resources.

[0055] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0056] Embodiment 1:

[0057] Figure 1 A flow chart of a network asset detection method based on traffic fingerprinting provided in an embodiment of the present application. Figure 1 As shown, the method of this embodiment includes the following steps S101 to S104, wherein:

[0058] S101: Send a preset data packet to a device where a target network of a network asset to be determined is located, so that the device where the target network is located can transmit feedback information of the network asset to be determined based on the preset data packet; and receive traffic information of the network asset to be determined collected by a detection point on the device where the target network is located.

[0059] In an embodiment of the present application, a preset data packet can be sent through a detector to a device where a target network of a network asset to be determined is located. The target network is the network to be detected. The preset data packet is a pre-constructed data packet, which mainly includes the following three categories: ICMP (Internet Control Message Protocol, Network Control Message Protocol) data packet, TCP (Transmission Control Protocol, Transmission Control Protocol) data packet and UDP (User Datagram Protocol, User Datagram Protocol) data packet. Among them, ICMP data packets include computer command Echo, timestamp Timestamp data packets, etc., and TCP data packets include request synchronization (synchronize, SYN) packets / confirm synchronization (ACKnowledge Character, ACK) packets in the request three-way handshake, etc.

[0060] For example, the TCP protocol is divided into four layers, each layer contains different protocols and has different functions. Among them, the SNMP protocol is the application layer protocol in the TCP protocol. This embodiment can use the TCP protocol and UDP protocol of the transport layer. The ICMP protocol in the IP protocol family of the network layer does not involve the application layer. The TCP protocol provides appropriate mechanisms when establishing a connection (three-way handshake) and disconnecting (four-way handshake). When an error occurs in the UDP protocol, the ICMP protocol in the lower network layer returns a message corresponding to the cause of the error.

[0061] When the preset data packets have the above three categories, the feedback information includes: the first category of feedback information returned based on ICMP data packets, the second category of feedback information returned based on TCP data packets, and the third category of feedback information returned based on UDP data packets.

[0062] The first category of feedback information may refer to fields in the ICMP header structure, such as type Type and code Code; the second category of feedback information may refer to fields in the TCP header structure; the third category of feedback information may refer to fields in UDP data packets and information used to reflect checksum integrity. Optionally, the fields in the above TCP header structure, for example: TCP field flags TCP Flags, TCP header TCP Options, congestion notification, initial window, etc. The second category of feedback information and the third category of feedback information respectively include IP field flags IP Flags and IP header IP Options in the IPV4 header structure added by TCP and UDP data packets during network transmission.

[0063] In step S101, this embodiment provides two detection methods: an active scanning and identification method based on sending a preset data packet and a passive traffic analysis method based on a detection point. Among them, the active scanning and identification method mainly relies on the communication with the target network to obtain feedback information, that is, by using the interaction of the network protocol in the above pre-constructed data packet and the characteristics of error feedback, it can accurately obtain the feedback information of the network asset to be determined, and provide data support for generating the first traffic fingerprint in S102.

[0064] S102: Generate a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information.

[0065] The first traffic fingerprint is composed of a combination of different types of encoded information features and numerical features. The specific description of the encoded information features, numerical features and the generation process of the first traffic fingerprint are specifically described in Example 2 and will not be repeated here.

[0066] In practical applications, the generated first traffic fingerprint and second traffic fingerprint are both fingerprints to be identified, which are calculated and converted based on the returned feedback information and traffic information, respectively. All known traffic fingerprints in the training set are determined before the preset neural network is pre-trained. Since the preset neural network can learn potential features from all known traffic fingerprints, whether it is the first traffic fingerprint or the second traffic fingerprint, the result of identifying whether it is a known traffic fingerprint can only be obtained through the output of the preset neural network. In other words, in practical applications, the preset neural network can distinguish whether the traffic fingerprint to be identified exists in the known traffic fingerprints in the training set, and whether the asset type corresponding to the traffic fingerprint to be identified exists in the asset type corresponding to the known traffic fingerprint.

[0067] S103: When the first traffic fingerprint and the second traffic fingerprint are different, the first traffic fingerprint and the second traffic fingerprint are respectively input into a preset neural network, so that the preset neural network outputs a first prediction result and a second prediction result respectively.

[0068] Among them, the preset neural network is trained through known traffic fingerprints and asset types associated with the known traffic fingerprints. The first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint.

[0069] In practice, due to network unreliability, for example, problems such as link failure, packet loss, frame loss, errors, etc. may occur, and even due to the heavy business load of the device where the target network is located, the response may be slow or the data packet may be discarded. Therefore, in the case of the above-mentioned unreliable network, it is easy to cause a field in the generated fingerprint to be missing or deviate from the true value, so the formed traffic fingerprint is prone to errors. In this case, the embodiment of the present application can improve the recognition accuracy of traffic fingerprints by comparing the traffic fingerprints corresponding to the two detection methods, thereby improving the accuracy of network asset detection.

[0070] In the embodiment of the present application, a known traffic fingerprint can be associated with an asset type of a network asset, but a network asset can correspond to multiple known traffic fingerprints. In the process of forming the first traffic fingerprint and the second traffic fingerprint, the network assets associated with the first traffic fingerprint and the second traffic fingerprint formed are uncertain and need to be determined by a preset neural network. Optionally, the expression type of each traffic fingerprint is a one-dimensional feature vector.

[0071] This application uses traffic fingerprints to associate network assets, which is convenient and efficient, and solves the complex situation that the existing asset fingerprint generation method needs to obtain various information from multiple parties (including but not limited to: manufacturer name, model, series, version number, fixed open ports, enabled service version, common open protocols, request protocol banner, certificate and other information).

[0072] S104: Determine the asset type of the network asset to be determined according to the first prediction result and the second prediction result.

[0073] When the first traffic fingerprint is different from the second traffic fingerprint, if the first prediction result is the same as the second prediction result, then the asset type of the to-be-determined network asset is determined.

[0074] The embodiment of the present application provides a network asset detection method based on traffic fingerprint, which combines an active scanning and identification method with a passive traffic analysis method to achieve detection and discovery of network resources, wherein the active scanning and identification method is to obtain feedback information by sending a preset data packet to the device where the target network is located, and then generate a corresponding first traffic fingerprint, and the passive traffic analysis method is to deploy a detection point on the device where the target network is located, passively collect traffic information passing through the detection point, and then generate a corresponding second traffic fingerprint. Finally, when the first traffic fingerprint and the second traffic fingerprint are different, the first traffic fingerprint and the second traffic fingerprint are respectively used as inputs and input into a preset neural network, so that the preset neural network predicts the network asset to be determined corresponding to the traffic fingerprint, and finally determines the asset type. Without affecting the normal operation of the device where the target network is located, this method improves the efficiency of network asset identification and the accuracy of network asset identification by combining two detection methods and a preset neural network.

[0075] Based on the above embodiments, the technical solution of the present application is described in more detail below in combination with several specific embodiments.

[0076] Embodiment 2:

[0077] exist Figure 1 Based on the embodiment shown, this embodiment focuses on Figure 1 Refine S102 in.

[0078] like Figure 2 As shown, S102 includes the following steps S201-S202, wherein:

[0079] S201: Preprocess the feedback information to generate a first traffic fingerprint.

[0080] It should be understood that preprocessing includes feature extraction and numerical calculation, which are described in detail in S2011 to S2012 below and will not be repeated here.

[0081] S202: Filter the traffic information to obtain a filtering result, and pre-process the filtering result to generate a second traffic fingerprint.

[0082] In the embodiment of the present application, the process of generating the first traffic fingerprint based on the feedback information obtained by the active scanning and identification method is similar to the process of generating the second traffic fingerprint based on the traffic information obtained by the passive traffic analysis method of the detection point, except that S202 has an additional screening operation before performing the preprocessing. Since the amount of traffic information collected by the detection point is relatively large, the embodiment of the present application can be screened according to the same source IP, source port, target IP and / or target port as the screening condition.

[0083] By executing S201 and S202, the embodiment of the present application can ensure that the first traffic fingerprint and the second traffic fingerprint are both expressed in numerical form, thereby ensuring the validity of the input data of the preset neural network.

[0084] In a possible implementation, S201, preprocessing the feedback information to generate a first traffic fingerprint includes the following steps S2011 to S2014, wherein:

[0085] S2011: Extract features from the feedback information to obtain at least one type of information feature.

[0086] In the embodiment of the present application, the types of information features include: enumeration type and character type.

[0087] S2012: extracting a target field from the information feature, and performing numerical calculations based on the target field to obtain a numerical feature.

[0088] It should be understood that the type of the numerical feature is a digital type. Since the information feature is the information feature of the preset data packet, the target field is the field of the preset data packet. S1012 is to extract the corresponding field for numerical calculation, and determine the result of the numerical calculation as a numerical feature, and the numerical feature is used as a part of the first traffic fingerprint.

[0089] The numerical features obtained through calculation include: the timestamp increment rate in the TCP option, the greatest common divisor of the TCP initial sequence number, the calculation rate of the TCP initial sequence number, the predictability index of the TCP initial sequence number, the difference calculation between the IP and the identification ID, the initial lifetime value TTL of the IP, etc.

[0090] S2013: For each type of information feature, encode the information feature according to a coding method corresponding to the type to obtain the encoded information feature.

[0091] In the embodiment of the present application, the encoding method corresponding to the enumeration type is the one-hot encoding method, and the encoding method corresponding to the character type is the effect encoding method, which is described in detail below and will not be repeated here. It should be understood that since the preset neural network accepts numerical input, the two different types of information features cannot meet the input conditions of the preset neural network, so it is necessary to encode the two types of information features separately, and the numerical features can meet the input conditions of the preset neural network, so the embodiment of the present application does not need to process the numerical features.

[0092] S2014: All types of encoded information features and numerical features are combined into a feature vector, and the feature vector is used as the first traffic fingerprint.

[0093] It should be noted that one type of information feature or numerical feature cannot constitute a complete first traffic fingerprint alone, but can only be combined with other parts as part of the first traffic fingerprint to form the first traffic fingerprint. Since the types of information features include enumeration type and character type, and the type of numerical feature is digital type, the first traffic fingerprint includes the above three types of features.

[0094] The embodiments of the present application perform encoding processing in a corresponding manner for different types of information features, thereby improving the effectiveness of the processing and ensuring that valid data is provided for the preset neural network.

[0095] In a possible implementation, when the type includes an enumeration type and a character type, S2013, for each type of information feature, encodes the information feature according to a coding method corresponding to the type to obtain the encoded information feature, including: (1) for the information feature of the enumeration type, encodes the information feature of the enumeration type according to a one-hot coding method corresponding to the enumeration type to obtain the encoded enumeration type feature; (2) for the information feature of the character type, encodes the information feature of the enumeration type according to an effect coding method corresponding to the character type to obtain the encoded character type feature.

[0096] In an embodiment of the present application, enumerated information features can be one-hot encoded. Taking the one-hot encoding of the enumerated feature TCP Flags as an example, the following explanation is given: the possible values ​​of the TCP Flags field are: 8 values: 'C', 'E', 'U', 'A', 'P', 'R', 'S' and 'F'; among them, 'C' can be encoded as [1, 0, 0, 0, 0, 0, 0], 'E' can be encoded as [0, 1, 0, 0, 0, 0, 0], and so on, until all fields are encoded. It should be understood that the Flags field does not necessarily have only one value, such as: the Flags field includes both 'A' and 'S', in which case 'A' and 'S' can be encoded together as [0, 0, 0, 1, 0, 0, 1, 0].

[0097] In the embodiment of the present application, character-type information features can be effect-encoded. Taking character-type features (information used to reflect the integrity of the checksum) as an example, the following explanation is given: if the character representation is complete, it is recorded as 1, if the character representation is incomplete, it is recorded as 0; if the corresponding field returns lost, it is recorded as -1, and finally the character-type information features, enumeration-type information features and numerical features are combined into a one-dimensional feature vector Nx1. In summary, a traffic fingerprint contains all the features of character-type information features, enumeration-type information features and numerical features, and all features are combined to form a traffic fingerprint, corresponding to a network asset.

[0098] The embodiment of the present application performs encoding processing in corresponding manners for two different types of information features, thereby improving the effectiveness of feature processing and ensuring that valid data is provided for the preset neural network.

[0099] Embodiment 3:

[0100] Figure 3 A flow chart of another network asset detection method based on traffic fingerprint provided in an embodiment of the present application. Figure 3 As shown, the method of this embodiment includes:

[0101] S301: Construct an initial neural network including an input layer, a hidden layer and an output layer.

[0102] In the embodiment of the present application, the initial neural network may refer to the initial artificial neural network (ANN). The embodiment of the present application does not specifically limit the number of hidden layers. The size of the input layer can be the feature dimension, that is, the number of neurons in the input layer can be set to the dimension N of the feature vector corresponding to the first traffic fingerprint or the second traffic fingerprint. The output layer may refer to the Softmax output layer. The levels of the initial neural network can be connected in a fully connected manner, and Relu is used as the activation function.

[0103] The calculation formula for the output of each layer of the initial neural network to a neuron in the next layer is as follows:

[0104] H=W T X+b

[0105] Among them, W is the weight matrix, X is the output of the previous layer, and b is the bias matrix.

[0106] The result output of each neuron needs to go through nonlinear mapping. In this embodiment of the application, the Relu activation function is used as an example to set the following nonlinear mapping function:

[0107] f(x) = max(0, x)

[0108] Among them, x is the input of the neuron. When the input is less than 0, the result output of the neuron is 0; when the input is greater than 0, the result output of the neuron is equal to the input.

[0109] In the Softmax output layer, the output calculation formula for each node is:

[0110]

[0111] Among them, Z i is the output of the initial neural network.

[0112] S302: Obtain a known traffic fingerprint and an asset type associated with the known traffic fingerprint, and use the acquired known traffic fingerprint and the asset type associated with the known traffic fingerprint as training data to train the initial neural network, and use a preset loss function during the training process to calculate the loss function value between the prediction result output by the initial neural network and the asset type associated with the known traffic fingerprint, until a preset stop training condition is reached to obtain a preset neural network.

[0113] Before training the initial neural network, training data can be obtained first. That is, the traffic fingerprints of different network assets need to be collected in advance for training, and the asset types of network assets need to be encoded in advance according to the collected classification forms, for example: different network assets are encoded as 0, 1, 2, ... 10, etc.

[0114] During the initial neural network training process, loss function back propagation and parameter optimization can be used. In order to prevent the model from overfitting during the training process and to make the neural network model still close to the effect of the complex model, a regularization term can be introduced. In one possible implementation, the preset loss function is a loss function containing a regularization term, using the following formula:

[0115]

[0116] Among them, L is the function value of the loss function, y is the actual label value, which is used to represent the asset type associated with the known traffic fingerprint. is the predicted probability value It is used to represent the prediction result of the initial neural network output, and F is the regular term.

[0117] When the regularization term is L1 regularization term, F = a∑|w| 2 , so the preset loss function is a loss function containing the L1 regular term, which can be replaced by the following formula:

[0118]

[0119] Among them, a∑|w| 2 is the L1 regular term, α is a constant whose value can be 0.1, and w is an element in the weight matrix in the preset logistic regression model.

[0120] In addition, the preset loss function may also be a loss function including an L2 regularization term, so the embodiment of the present application does not specifically limit the specific form of the regularization term.

[0121] After the initial neural network is trained, a preset neural network is obtained. When performing asset discovery, the embodiment of the present application only needs to input the traffic fingerprint into the preset neural network, and can effectively identify the network assets to be determined without affecting the normal operation of the device where the target network is located. In addition, the embodiment of the present application can regularly update the preset neural network to improve the accuracy of the prediction.

[0122] Embodiment 4:

[0123] Figure 4 A flow chart of another network asset detection method based on traffic fingerprint provided in an embodiment of the present application. Figure 4 As shown, the method of this embodiment includes the following steps S401 to S404, wherein:

[0124] S401: Send a preset data packet to the device where the target network of the network asset to be determined is located, so that the device where the target network is located can return feedback information of the network asset to be determined based on the preset data packet; and receive traffic information of the network asset to be determined collected by the detection point on the device where the target network is located.

[0125] It should be understood that the specific implementation of S401 is different from Figure 1 The S101 in is similar and will not be described here.

[0126] S402: Generate a first traffic fingerprint and a second traffic fingerprint according to the feedback information and the traffic information. Figure 1 The S102 in FIG. 1 is similar to that in FIG. 1 and will not be described in detail here.

[0127] S403: When the first traffic fingerprint and the second traffic fingerprint are the same, the first traffic fingerprint or the second traffic fingerprint is input into a preset neural network, so that the preset neural network outputs a first prediction result or a second prediction result. The preset neural network is a trained artificial neural network.

[0128] S404: Determine the asset type of the network asset to be determined according to the first prediction result or the second prediction result.

[0129] If the first traffic fingerprint corresponding to the feedback information obtained by the active scanning and identification method is the same as the second traffic fingerprint corresponding to the traffic information obtained by the passive traffic analysis method, you only need to enter one of the traffic fingerprints without repeating the operation, thus saving prediction time.

[0130] The embodiment of the present application realizes network asset detection by introducing an artificial neural network. This method is different from the traditional method that only relies on specific feature matching (for example, through regular matching, or through the hash of a static file and the MD5 signature digest algorithm matching), and it solves the flexibility problem of traffic fingerprint recognition and the identification problem of network assets to a large extent.

[0131] Figure 5 This is a schematic diagram of the structure of a network asset detection device based on traffic fingerprint provided in an embodiment of the present application. The device of this embodiment can be in the form of software and / or hardware. Figure 5 As shown, the network asset detection device based on traffic fingerprint provided in this embodiment includes: a sending and receiving module 51, a generating module 52, an input module 53 and a determining module 54. Among them:

[0132] The sending and receiving module 51 is used to send a preset data packet to the device where the target network of the network asset to be determined is located, so that the device where the target network is located can return feedback information of the network asset to be determined based on the preset data packet; and receive the traffic information of the network asset to be determined collected by the detection point on the device where the target network is located.

[0133] The generating module 52 is used to generate a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information.

[0134] The input module 53 is used to input the first traffic fingerprint and the second traffic fingerprint into the preset neural network respectively when the first traffic fingerprint is different from the second traffic fingerprint, so that the preset neural network outputs the first prediction result and the second prediction result respectively; wherein the preset neural network is trained by using known traffic fingerprints and asset types associated with the known traffic fingerprints, the first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint.

[0135] The determination module 54 is used to determine the asset type of the network asset to be determined according to the first prediction result and the second prediction result.

[0136] In a possible implementation, the generating module 52 is further configured to:

[0137] The feedback information is preprocessed to generate a first traffic fingerprint.

[0138] The flow information is screened to obtain a screening result, and the screening result is preprocessed to generate a second flow fingerprint.

[0139] In a possible implementation, the generating module 52 is further configured to:

[0140] Feature extraction is performed on the feedback information to obtain at least one type of information feature.

[0141] The target field is extracted from the information feature, and numerical calculation is performed based on the target field to obtain the numerical feature.

[0142] For each type of information feature, the information feature is encoded according to a coding method corresponding to the type to obtain the encoded information feature.

[0143] All types of encoded information features and numerical features are combined into a feature vector, and the feature vector is used as the first traffic fingerprint.

[0144] In a possible implementation, when the type includes an enumeration type and a character type, the generating module 52 is further used to:

[0145] For the enumerated information features, the enumerated information features are encoded according to the one-hot encoding method corresponding to the enumerated type to obtain the encoded enumerated features.

[0146] For the character-type information features, the enumeration-type information features are encoded according to the effect encoding method corresponding to the character type to obtain the encoded character-type features.

[0147] In a possible implementation, the network asset detection device based on traffic fingerprint is further used to:

[0148] Construct an initial neural network consisting of an input layer, a hidden layer, and an output layer.

[0149] The known traffic fingerprint and the asset type associated with the known traffic fingerprint are obtained, and the acquired known traffic fingerprint and the asset type associated with the known traffic fingerprint are used as training data to train the initial neural network. During the training process, a preset loss function is used to calculate the loss function value between the prediction result output by the initial neural network and the asset type associated with the known traffic fingerprint, until the preset stopping training condition is reached to obtain the preset neural network.

[0150] In a possible implementation, the preset loss function is a loss function including a regularization term, using the following formula:

[0151]

[0152] Among them, L is the function value of the loss function, y is the actual label value, which is used to represent the asset type associated with the known traffic fingerprint. is the predicted probability value, which is used to represent the predicted result of the initial neural network output, and F is the regular term.

[0153] In a possible implementation, the network asset detection device based on traffic fingerprint is further used to:

[0154] When the first traffic fingerprint is the same as the second traffic fingerprint, the first traffic fingerprint or the second traffic fingerprint is input into the preset neural network so that the preset neural network outputs the first prediction result or the second prediction result.

[0155] The asset type of the to-be-determined network asset is determined according to the first prediction result or the second prediction result.

[0156] The network resource determination device provided in this embodiment can be used to execute the network resource determination method provided in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be described in detail here.

[0157] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0158] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0159] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device includes a receiver 60, a transmitter 61, at least one processor 62 and a memory 63. The electronic device composed of the above components can be used to implement the above-mentioned several specific embodiments of the present application, which will not be described in detail here.

[0160] The embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, each step of the method in the above embodiment is implemented.

[0161] An embodiment of the present application also provides a computer program product, including a computer program, which implements each step of the method in the above embodiment when executed by a processor.

[0162] Various embodiments of the systems and techniques described above in the present application can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0163] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or electronic device.

[0164] In the context of the present application, a computer-readable storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0165] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0166] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data electronic device), or a computing system that includes middleware components (e.g., an application electronic device), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0167] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps disclosed in this application can be performed in parallel, sequentially or in different orders, as long as the desired results of the technical solution disclosed in this application can be achieved, and this document does not limit this.

[0168] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of this application should be included in the protection scope of this application.

Claims

1. A network asset detection method based on traffic fingerprint, characterized in that: include: Sending a preset data packet to a device where a target network of the network asset to be determined is located, so that the device where the target network is located returns feedback information of the network asset to be determined based on the preset data packet; and, receiving flow information of the to-be-determined network asset collected by a detection point on a device where the target network is located; Generating a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information; When the first traffic fingerprint is different from the second traffic fingerprint, the first traffic fingerprint and the second traffic fingerprint are respectively input into a preset neural network, so that the preset neural network outputs a first prediction result and a second prediction result respectively; wherein the preset neural network is trained by a known traffic fingerprint and an asset type associated with the known traffic fingerprint, the first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint; Determining the asset type of the to-be-determined network asset according to the first prediction result and the second prediction result; Wherein, generating a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information includes: preprocessing the feedback information to generate a first traffic fingerprint; Screening the flow information to obtain a screening result, and preprocessing the screening result to generate a second flow fingerprint; Preprocessing the feedback information to generate a first traffic fingerprint includes: extracting features from the feedback information to obtain at least one type of information feature; Extracting a target field from the information feature, and performing numerical calculations based on the target field to obtain a numerical feature; For each type of information feature, encode the information feature according to an encoding method corresponding to the type to obtain an encoded information feature; All types of the encoded information features and numerical features are combined into a feature vector, and the feature vector is used as the first traffic fingerprint.

2. The method according to claim 1, characterized in that: When the type includes an enumeration type and a character type, for each type of information feature, encoding the information feature according to an encoding method corresponding to the type to obtain an encoded information feature, including: for an enumeration type information feature, encoding the enumeration type information feature according to a one-hot encoding method corresponding to the enumeration type to obtain an encoded enumeration type feature; With respect to the information features of the character type, the information features of the character type are encoded according to the effect encoding method corresponding to the character type to obtain the encoded character type features.

3. The method according to claim 1, characterized in that Also includes: Construct an initial neural network consisting of an input layer, a hidden layer, and an output layer; A known traffic fingerprint and an asset type associated with the known traffic fingerprint are obtained, and the acquired known traffic fingerprint and the asset type associated with the known traffic fingerprint are used as training data to train the initial neural network. During the training process, a preset loss function is used to calculate the loss function value between the prediction result output by the initial neural network and the asset type associated with the known traffic fingerprint, until a preset stop training condition is reached to obtain a preset neural network.

4. The method according to claim 3, characterized in that The preset loss function is a loss function including a regularization term, and adopts the following formula: Among them, L is the function value of the loss function, y is the true label value, which is used to represent the asset type associated with the known traffic fingerprint, is the predicted probability value, which is used to represent the prediction result output by the initial neural network, and F is the regularization term.

5. The method according to claim 1, characterized in that Also includes: When the first traffic fingerprint is the same as the second traffic fingerprint, inputting the first traffic fingerprint or the second traffic fingerprint into a preset neural network so that the preset neural network outputs a first prediction result or a second prediction result; The asset type of the to-be-determined network asset is determined according to the first prediction result or the second prediction result.

6. A network asset detection device based on traffic fingerprint, characterized in that: include: A sending and receiving module, used for sending a preset data packet to a device where a target network of a network asset to be determined is located, so that the device where the target network is located can return feedback information of the network asset to be determined based on the preset data packet; and, receiving flow information of the to-be-determined network asset collected by a detection point on a device where the target network is located; A generating module, configured to generate a first flow fingerprint and a second flow fingerprint respectively according to the feedback information and the flow information; Generating a first traffic fingerprint and a second traffic fingerprint respectively according to the feedback information and the traffic information includes: preprocessing the feedback information to generate a first traffic fingerprint; Screening the flow information to obtain a screening result, and preprocessing the screening result to generate a second flow fingerprint; Preprocessing the feedback information to generate a first traffic fingerprint includes: extracting features from the feedback information to obtain at least one type of information feature; Extracting a target field from the information feature, and performing numerical calculations based on the target field to obtain a numerical feature; For each type of information feature, encode the information feature according to an encoding method corresponding to the type to obtain an encoded information feature; Combining all types of the encoded information features and numerical features into a feature vector, and using the feature vector as the first traffic fingerprint; An input module, used for inputting the first traffic fingerprint and the second traffic fingerprint into a preset neural network respectively when the first traffic fingerprint is different from the second traffic fingerprint, so that the preset neural network outputs a first prediction result and a second prediction result respectively; wherein the preset neural network is trained by a known traffic fingerprint and an asset type associated with the known traffic fingerprint, the first prediction result is the asset type associated with the first traffic fingerprint, and the second prediction result is the asset type associated with the second traffic fingerprint; A determination module is used to determine the asset type of the to-be-determined network asset according to the first prediction result and the second prediction result.

7. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the network asset detection method based on traffic fingerprint as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the network asset detection method based on traffic fingerprint as described in any one of claims 1 to 5.

Images