Network topology structure generation method, device, electronic device and storage medium

Abstract

The present application provides a method, device, electronic device and storage medium for generating a network topology structure. The network topology structure generating method includes: executing a first scanning task and obtaining a first link scanning result, wherein the first scanning task carries a scanning IP address; determining whether the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, and if the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, adding the information of the gateway node to the first link scanning result, wherein the gateway node is a forwarding node of the scanning IP address; and constructing a first N-fork with the first nmap detection node as the root node based on the first link scanning result. The present application can improve the accuracy of the network topology structure.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for generating a network topology structure. Background Art

[0002] At present, the existing technology can detect the network topology structure based on nmap, and then draw a network topology map based on the detection. However, the existing technology has the disadvantage of low accuracy in drawing the network topology map. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a network topology structure generation method, device, electronic device and storage medium, which are used to improve the accuracy of the network topology map.

[0004] In a first aspect, the present invention provides a method for generating a network topology structure, the method being applied to a first nmap detection node, the method comprising:

[0005] Execute a first scanning task and obtain a first link scanning result, wherein the first scanning task carries a scanning IP address;

[0006] Determine whether the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, if the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, add the information of the gateway node in the first link scanning result, wherein the gateway node is the forwarding node of the scanning IP address;

[0007] Based on the first link scanning result, a first N-ary tree with the first nmap detection node as a root node is constructed.

[0008] In the first aspect of the present application, based on the scanned IP address in the first link scanning result, it is possible to determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and then, when the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, the information of the gateway node can be added to the first link scanning result, wherein the gateway node is the forwarding node of the scanned IP address, thereby obtaining the first N-ary tree.

[0009] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0010] In an optional implementation manner, before constructing a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result, the method further includes:

[0011] Extracting scanning information of two adjacent link nodes based on the first link scanning result, wherein the scanning information of the link nodes includes a ttl field value;

[0012] Calculating a first difference based on the ttl field values ​​of the two adjacent link nodes;

[0013] When the first difference is greater than 1, a virtual node is added to the first link scanning result, wherein the virtual node is a link node that is not scanned by the first nmap detection node.

[0014] In the above optional implementation, based on the first link scanning result, the scanning information of two adjacent link nodes can be extracted, and then based on the ttl field values ​​of the two adjacent link nodes, the first difference can be calculated, so that when the first difference is greater than 1, a virtual node can be added to the first link scanning result, wherein the virtual node is a link node that the first nmap detection node has not scanned, that is, in the above optional implementation, the link nodes that the nmap detection node cannot scan can be judged based on the difference in the ttl field value, thereby supplementing such link nodes in the first link scanning result, thereby making the first link scanning result more accurate.

[0015] In an optional implementation, after constructing a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result, the method includes:

[0016] Determine a node association relationship of each link node in the first N-ary tree;

[0017] Determine a key node in the first N-ary tree and a plurality of non-key nodes connected to the key node based on a node association relationship of each link node in the first N-ary tree;

[0018] Obtaining the ttl field values ​​of two adjacent key nodes;

[0019] Calculating a second difference based on the ttl field values ​​of two adjacent key nodes;

[0020] When the second difference is greater than 1, it is determined that there is a network area boundary between two adjacent key nodes;

[0021] Dividing the first N-ary tree based on the network area boundary to obtain a plurality of network areas, wherein the network area includes one key node and a plurality of non-key nodes connected to the key node;

[0022] The detection accuracy of each of the network areas is calculated.

[0023] In the above optional implementation, by determining the node association relationship of each link node in the first N-ary tree, it is possible to determine the key node in the first N-ary tree and several non-key nodes connected to the key node based on the node association relationship of each link node in the first N-ary tree, and then by obtaining the ttl field value of two adjacent key nodes, it is possible to calculate the second difference based on the ttl field value of the two adjacent key nodes, and then when the second difference is greater than 1, it is possible to determine that there is a network area boundary between the two adjacent key nodes, and then the first N-ary tree can be divided based on the network area boundary to obtain several network areas, wherein the network area includes one key node and several non-key nodes connected to the key node, and then the detection accuracy of each network area can be calculated. Compared with the prior art, this optional implementation can facilitate the user to set a new nmap detection node in a network area with low detection accuracy by dividing the network area and calculating the detection accuracy of the network area, so as to detect and scan the network area with low detection accuracy again.

[0024] In an optional embodiment, the method further comprises:

[0025] Obtaining a second link scanning result, wherein the second link scanning result is obtained by the second nmap detection node executing the second scanning task, or by the first nmap detection node executing the second scanning task;

[0026] Based on the second link scanning result, construct a second N-ary tree;

[0027] Obtaining an IP set of the first N-ary tree and an IP set of the second N-ary tree;

[0028] The first N-ary tree and the second N-ary tree are merged based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree, and the IP set of the second N-ary tree.

[0029] In the above optional implementation, by obtaining the second link scanning result, a second N-ary tree can be constructed based on the second link scanning result, and by obtaining the IP set of the first N-ary tree and the IP set of the second N-ary tree, the first N-ary tree and the second N-ary tree can be merged based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree, and the IP set of the second N-ary tree. Compared with the prior art, by merging the first N-ary tree and the second N-ary tree, the detection can be more comprehensive.

[0030] In an optional implementation, the merging of the first N-ary tree and the second N-ary tree based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree, and the IP set of the second N-ary tree includes:

[0031] Determine a key node with the highest detection accuracy based on the key node detection accuracy of the second N-ary tree and the key node detection accuracy of the first N-ary tree;

[0032] The N-ary tree where the key node with the highest detection accuracy is located is used as the basic N-ary tree, and the other N-ary trees are used as the N-ary trees to be merged;

[0033] Determine whether the IP set of the basic N-ary tree and the IP set of the N-ary tree to be merged have an intersection IP address. If so, based on the first network area detection accuracy of the intersection IP address and the second network area detection accuracy of the intersection IP address, retain the network area with higher detection accuracy in the basic N-ary tree.

[0034] In the above optional implementation, based on the key node detection accuracy of the second N-ary tree and the key node detection accuracy of the first N-ary tree, the key node with the highest detection accuracy can be determined, and then the N-ary tree where the key node with the highest detection accuracy is located can be used as the basic N-ary tree, and other N-ary trees can be used as N-ary trees to be merged, and then by judging whether the IP set of the basic N-ary tree and the IP set of the N-ary tree to be merged have an intersection IP address, if so, it is possible to retain the network area with a higher detection accuracy in the basic N-ary tree based on the first network area detection accuracy of the intersection IP address and the second network area detection accuracy of the intersection IP address. Compared with the prior art, by merging the first N-ary tree and the second N-ary tree, detection can be made more accurate.

[0035] In an optional embodiment, the method further comprises:

[0036] Based on the ttl field value of the intersection IP address, the virtual node in the basic N-ary tree is modified.

[0037] In the above optional implementation, based on the ttl field value of the intersection IP address, the virtual nodes in the basic N-ary tree can be corrected, so that the accuracy of the merged N-ary tree is higher.

[0038] In an optional implementation manner, the calculating the detection accuracy of each of the network areas includes:

[0039] Calculating the key node detection accuracy rate corresponding to each of the network areas and using it as the detection accuracy rate of each of the network areas;

[0040] And, the calculation formula corresponding to the calculation of the key node detection accuracy is:

[0041] ;

[0042] Among them, q represents the real weight of the key node, c1 represents the number of adjacent key nodes of the key node that are real nodes, c2 represents the number of adjacent non-key nodes of the key node that are real nodes, c3 represents the total number of adjacent key nodes of the key node, c4 represents the total number of adjacent nodes of the key node, and S represents the key node detection accuracy.

[0043] In the above optional implementation manner, the key node detection accuracy can be calculated using the above calculation formula.

[0044] In a second aspect, the present invention provides a network topology structure generating device, the device is applied to a first nmap detection node, the device comprising:

[0045] A detection module, used to execute a first scanning task and obtain a first link scanning result, wherein the first scanning task carries a scanning IP address;

[0046] A judgment module, used to judge whether the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, if the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, then add the information of the gateway node in the first link scanning result, wherein the gateway node is a forwarding node of the scanning IP address;

[0047] A construction module is used to construct a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result.

[0048] The device in the second aspect of the present application executes a network topology structure generation method to determine, based on the scanned IP address in the first link scan result, whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and then, if the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, add information of a gateway node to the first link scan result, wherein the gateway node is a forwarding node of the scanned IP address, thereby obtaining a first N-ary tree.

[0049] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0050] In a third aspect, the present invention provides an electronic device, comprising:

[0051] Processor; and

[0052] The memory is configured to store machine-readable instructions, and when the instructions are executed by the processor, the network topology structure generation method as described in any one of the aforementioned implementations is executed.

[0053] The electronic device in the third aspect of the present application can determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address in the first link scan result by executing the network topology structure generation method, and then determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address by determining that the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and can add the information of the gateway node in the first link scan result, wherein the gateway node is the forwarding node of the scanned IP address, thereby obtaining the first N-ary tree.

[0054] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0055] In a fourth aspect, the present invention provides a storage medium storing a computer program, wherein the computer program is executed by a processor as described in any one of the aforementioned embodiments to generate a network topology structure.

[0056] The storage medium in the fourth aspect of the present application can determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address in the first link scan result by executing the network topology structure generation method, and then determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address by determining that the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and can add the information of the gateway node in the first link scan result, wherein the gateway node is the forwarding node of the scanned IP address, thereby obtaining the first N-ary tree.

[0057] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 It is a flowchart of a method for generating a network topology structure disclosed in an embodiment of the present application;

[0060] Figure 2 It is a network topology diagram generated based on a first link result without adding a gateway node disclosed in an embodiment of the present application;

[0061] Figure 3 It is a network topology diagram generated based on the first link result of adding a gateway node provided by an embodiment of the present application;

[0062] Figure 4 is a schematic diagram of a first link scanning result provided in an embodiment of the present application;

[0063] Figure 5 This is a schematic diagram of a first link scanning result without adding gateway node information disclosed in an embodiment of the present application;

[0064] Figure 6 This is a schematic diagram of a first link scanning result in which gateway node information is added, as disclosed in an embodiment of the present application;

[0065] Figure 7 is another schematic diagram of a first link scanning result disclosed in an embodiment of the present application;

[0066] Figure 8 yes Figure 7 A schematic diagram of the first link scan result after correction;

[0067] Fig. 9 is based on Figure 7 A network topology diagram generated by the first link scanning result;

[0068] Fig.10 is based on Figure 8 A network topology diagram generated by the first link scanning result;

[0069] Fig.11 This is a schematic diagram of network area division provided in an embodiment of the present application;

[0070] Fig.12 It is a structural diagram of a basic N-ary tree provided in an embodiment of the present application;

[0071] Fig.13 It is a schematic diagram of the structure of an N-ary tree to be merged provided in an embodiment of the present application;

[0072] Fig.14 It is a schematic diagram of the merging result of the N-ary trees to be merged;

[0073] Fig.15 It is a structural schematic diagram of a network topology structure generating device disclosed in an embodiment of the present application;

[0074] Fig.16 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0075] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0076] Embodiment 1

[0077] See also Figure 1 , Figure 1 1 is a flow chart of a method for generating a network topology structure disclosed in an embodiment of the present application, wherein the method is applied to a first nmap detection node. Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0078] 101. Execute a first scanning task and obtain a first link scanning result, where the first scanning task carries a scanning IP address;

[0079] 102. Determine whether the scanned IP address and the IP address of the first nmap detection node belong to the same network segment address. If the scanned IP address and the IP address of the first nmap detection node belong to the same network segment address, add the information of the gateway node in the first link scanning result, wherein the gateway node is a forwarding node of the scanned IP address;

[0080] 103. Based on the first link scanning result, construct a first N-ary tree with the first nmap detection node as a root node.

[0081] In an embodiment of the present application, based on the scanned IP address in the first link scanning result, it is possible to determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and then to determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and to add the information of the gateway node to the first link scanning result, wherein the gateway node is the forwarding node of the scanned IP address, thereby obtaining the first N-ary tree.

[0082] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0083] In the embodiments of this application, as an example, please refer to Figure 2 , Figure 2 1 is a schematic diagram of a network topology generated based on the first link result without adding a gateway node disclosed in an embodiment of the present application. Figure 2 As shown, the first nmap probe node ( Figure 2 (represented by Nmap server in the figure) when scanning other devices 1, other devices 2, other devices 3, and other devices N in the same network segment, the gateway will not be passed, but the gateway will only be passed when scanning other network segment devices. However, in a real network, other devices 1, other devices 2, other devices 3, and other devices N in the same network segment need to connect to a gateway node for external data communication, that is, in a real network, there is also a gateway node between the first nmap detection node and other devices in the same network segment. However, the first link scanning result before correction cannot reflect a real situation. Based on this, the embodiment of the present application adds the information of the gateway node in the first link scanning result, which can reflect a real situation, thereby making the first link scanning result more accurate, thereby generating a more accurate first N-ary tree, wherein the first link scanning result based on the addition of the gateway node information can be generated. Figure 3 The network topology shown, Figure 3 1 is a schematic diagram of a network topology generated based on the first link result of adding a gateway node provided by an embodiment of the present application. Figure 3As shown, other devices 1, 2, and 3 in the same network segment are associated under the gateway. It should be noted that, when scanning other network segment devices, the gateway passed through can be the same as the gateway corresponding to other devices in the same network segment. Therefore, other network segment devices and other network segment devices can correspond to the same gateway.

[0084] In the embodiment of the present application, the first nmap detection node refers to a terminal device on which the nmap tool is installed. For example, the first nmap detection node may be an Nmap server, wherein nmap (Network Mapper) is a network scanning and sniffing tool under Linux. For other specific descriptions of nmap, please refer to the prior art.

[0085] In the embodiment of the present application, for step 101, the first nmap detection node can construct a first scanning task by executing preset instructions and task parameters. For example, the first scanning task is "nmap -O -traceroute -{scan IP address} -oX {file}". Accordingly, the first link scanning result obtained by executing the first scanning task can be as follows: Figure 4 As shown, Figure 4 is a schematic diagram of a first link scanning result provided by an embodiment of the present application. Figure 4 As shown, the first link scanning result can be used in an XML fragment, wherein, in the XML fragment, each hop tag represents a link node.

[0086] In the embodiment of the present application, the first scanning task may carry multiple scanning IP addresses, for example, the first scanning task may carry 3 scanning IP addresses. Further, the scanning IP address may be an IP address in the same network segment as the first nmap detection node, or may be an IP address outside the network segment where the first nmap detection node is located.

[0087] In the embodiment of the present application, for example, for step 102, please refer to Figure 5 , Figure 6 ,in, Figure 5 is a schematic diagram of a first link scanning result without adding gateway node information disclosed in an embodiment of the present application, Figure 6 1 is a schematic diagram of a first link scanning result in which gateway node information is added according to an embodiment of the present application. Figure 5 and Figure 6 As shown, the first link scan result is modified by adding " <hop ttl="1" ipaddr="1.1.1.1" rtt="0.00" / > " This information identifies the information of the gateway node.

[0088] In an embodiment of the present application, for step 102, a specific method for determining whether the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address is: determine whether the network identifier of the scanning IP address is the same as the network identifier corresponding to the IP address of the first nmap detection node; if they are the same, it can be determined that the scanning IP address and the IP address of the first nmap detection node are in the same network segment address.

[0089] In the embodiment of the present application, with respect to step 103, the first N-ary tree is a network topology diagram, which can be used as a storage structure for the first link scanning result, and has the advantage of being convenient for processing the first link scanning result.

[0090] In an optional implementation manner, before the step of constructing a first N-ary tree with the first nmap detection node as the root node based on the first link scan result, the method of the embodiment of the present application further includes the following:

[0091] Extracting scanning information of two adjacent link nodes based on the first link scanning result, wherein the scanning information of the link nodes includes a ttl field value;

[0092] Calculating a first difference based on the ttl field values ​​of two adjacent link nodes;

[0093] When the first difference is greater than 1, a virtual node is added to the first link scanning result, wherein the virtual node is a link node that is not scanned by the first nmap detection node.

[0094] In the above optional implementation, the scanning information of two adjacent link nodes can be extracted based on the first link scanning result, and then the first difference can be calculated based on the ttl field values ​​of the two adjacent link nodes, so that when the first difference is greater than 1, a virtual node can be added to the first link scanning result, wherein the virtual node is a link node that is not scanned by the first nmap detection node, that is, in the above optional implementation, the link nodes that cannot be scanned by the nmap detection node can be judged based on the difference in the ttl field value, thereby supplementing such link nodes in the first link scanning result, thereby making the first link scanning result more accurate.

[0095] In the above optional implementation, for example, please refer to Figure 7 , Figure 7 is another schematic diagram of a first link scanning result disclosed in an embodiment of the present application, Figure 8 yes Figure 7 Schematic diagram of the revised first link scan result. Figure 7 , Figure 8 As shown, Figure 7The ttl field value of the second label in is 2, and the ttl field value of the third label is 13. Therefore, the difference between the ttl field value of the third label and the ttl field value of the second label is greater than 1. Therefore, it can be determined that there are nodes that cannot be scanned between the third label and the second label, so virtual nodes can be added to represent these nodes that cannot be scanned. It should be noted that due to the limitations of the scanning capability of namp, network devices such as firewalls cannot be accurately detected, resulting in the presence of nodes that cannot be scanned in the first link scanning results.

[0096] Accordingly, if Figure 8 As shown, a virtual node may be added between the third label and the second label, and the address corresponding to the virtual node may be a specified network segment.

[0097] For further information, see Fig. 9 and Fig.10 , Fig. 9 is based on Figure 7 Schematic diagram of network topology generated by the first link scanning result. Fig.10 is based on Figure 8 Schematic diagram of network topology generated by the first link scanning result.

[0098] In an optional implementation manner, after the step of constructing a first N-ary tree with the first nmap detection node as the root node based on the first link scan result, the method of the embodiment of the present application includes the following:

[0099] Determine a node association relationship of each link node in the first N-ary tree;

[0100] Determine a key node in the first N-ary tree and a number of non-key nodes connected to the key node based on the node association relationship of each link node in the first N-ary tree;

[0101] Get the ttl field value of two adjacent key nodes;

[0102] Calculate a second difference based on the ttl field values ​​of two adjacent key nodes;

[0103] When the second difference is greater than 1, it is determined that there is a network area boundary between two adjacent key nodes;

[0104] Dividing the first N-ary tree based on the network area boundary to obtain a plurality of network areas, wherein the network area includes a key node and a plurality of non-key nodes connected to the key node;

[0105] Calculate the detection accuracy of each network area.

[0106] In the above optional implementation, by determining the node association relationship of each link node in the first N-ary tree, it is possible to determine the key node in the first N-ary tree and several non-key nodes connected to the key node based on the node association relationship of each link node in the first N-ary tree, and then by obtaining the ttl field value of two adjacent key nodes, it is possible to calculate the second difference based on the ttl field value of the two adjacent key nodes, and then when the second difference is greater than 1, it is possible to determine that there is a network area boundary between the two adjacent key nodes, and then the first N-ary tree can be divided based on the network area boundary to obtain several network areas, wherein the network area includes a key node and several non-key nodes connected to the key node, and then the detection accuracy of each network area can be calculated. Compared with the prior art, this optional implementation can facilitate the user to set a new nmap detection node in a network area with a low detection accuracy by dividing the network area and calculating the detection accuracy of the network area, so as to detect and scan the network area with a low detection accuracy again.

[0107] In the above optional implementation, specifically, a key node refers to a node connected to multiple nodes, and vice versa. On the other hand, since different network areas will restrict the transmission of network data due to network policy restrictions, resulting in a relatively large change in the TTL field value, network areas can be distinguished based on the difference in TTL field values. If the TTL field value between adjacent key nodes is greater than 1, it means that there are some firewalls or other network policies between adjacent key nodes that cut the network apart, so that it can be determined that there are network area boundaries between adjacent key nodes, and thus it can be determined that adjacent key nodes belong to different network areas. For example, please refer to Fig.11 , Fig.11 This is a schematic diagram of network area division provided in an embodiment of the present application. Fig.11 As shown, since the ttl field value between the Nmap gateway and the virtual key node is greater than 1, the N-ary tree is divided into area 1 and area 2. It should be noted that the virtual key node is a type of key node.

[0108] In an optional implementation manner, the method of the embodiment of the present application further includes the following steps:

[0109] Obtaining a second link scan result, wherein the second link scan result is obtained by the second nmap detection node executing the second scan task, or by the first nmap detection node executing the second scan task;

[0110] Based on the second link scanning result, construct a second N-ary tree;

[0111] Get the IP set of the first N-ary tree and the IP set of the second N-ary tree;

[0112] The first N-ary tree and the second N-ary tree are merged based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree and the IP set of the second N-ary tree.

[0113] In the above optional implementation, by obtaining the second link scan result, the second N-ary tree can be constructed based on the second link scan result, and by obtaining the IP set of the first N-ary tree and the IP set of the second N-ary tree, the first N-ary tree and the second N-ary tree can be merged based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree and the IP set of the second N-ary tree. Compared with the prior art, by merging the first N-ary tree and the second N-ary tree, the detection can be more comprehensive.

[0114] In an optional implementation, the step of: merging the first N-ary tree and the second N-ary tree based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree and the IP set of the second N-ary tree, comprises the following sub-steps:

[0115] Determine the key node with the highest detection accuracy based on the key node detection accuracy of the second N-ary tree and the key node detection accuracy of the first N-ary tree;

[0116] The N-ary tree where the key node with the highest detection accuracy is located is used as the basic N-ary tree, and the other N-ary trees are used as the N-ary trees to be merged;

[0117] Determine whether the IP set of the basic N-ary tree and the IP set of the N-ary tree to be merged have intersecting IP addresses. If so, based on the first network area detection accuracy of the intersection IP address and the second network area detection accuracy of the intersection IP address, retain the network area with higher detection accuracy in the basic N-ary tree.

[0118] In the above optional implementation, based on the key node detection accuracy of the second N-ary tree and the key node detection accuracy of the first N-ary tree, the key node with the highest detection accuracy can be determined, and then the N-ary tree where the key node with the highest detection accuracy is located can be used as the basic N-ary tree, and other N-ary trees can be used as the N-ary trees to be merged, and then by judging whether the IP set of the basic N-ary tree and the IP set of the N-ary tree to be merged have an intersection IP address, if so, the network area with a higher detection accuracy can be retained in the basic N-ary tree based on the first network area detection accuracy of the intersection IP address and the second network area detection accuracy of the intersection IP address. Compared with the prior art, by merging the first N-ary tree and the second N-ary tree, the detection can be made more accurate.

[0119] In the above optional implementation, for example, please refer to Fig.12 , Fig.13 and Fig.14 , Fig.12 is a schematic diagram of the structure of a basic N-ary tree provided in an embodiment of the present application, Fig.13 is a schematic diagram of a structure of an N-ary tree to be merged provided in an embodiment of the present application, Fig.12 This is a schematic diagram of the result of merging the N-ary trees to be merged. Fig.12 , Fig.13 and Fig.14 As shown, Fig.13 The network area corresponding to the real node gateway in is real, that is, the detection accuracy of the network area is higher than Fig.12 Therefore, in the merged result, the network area corresponding to the real node gateway is retained.

[0120] In an optional implementation manner, in an embodiment of the present application, the method in the embodiment of the present application further includes the following steps:

[0121] Based on the ttl field value of the intersection IP address, the virtual node in the basic N-ary tree is corrected.

[0122] In the above optional implementation, based on the ttl field value of the intersection IP address, the virtual nodes in the basic N-ary tree can be corrected, so that the accuracy of the merged N-ary tree is higher.

[0123] In the above optional implementation manner, illustratively, as Fig.14 As shown, after the network area corresponding to the real node gateway is merged into the basic N-ary tree, the virtual node 1 in the basic N-ary tree is deleted. The reason for deleting the virtual node 1 in the basic N-ary tree is that the ttl field value of the real node gateway is changed, so that the ttl field value of the real node gateway differs from the ttl field value of the gateway in the basic N-ary tree by 1, that is, there is no node that cannot be scanned between the gateway in the basic N-ary tree and the real node gateway, so the virtual node is no longer needed.

[0124] In an optional implementation, the step of calculating the detection accuracy of each network area includes the following sub-steps:

[0125] Calculate the key node detection accuracy corresponding to each network area and use it as the detection accuracy of each network area;

[0126] And, the calculation formula corresponding to the key node detection accuracy is:

[0127] ;

[0128] Among them, q represents the true weight of the key node, c1 represents the number of adjacent key nodes of the key node that are real nodes, c2 represents the number of adjacent non-key nodes of the key node that are real nodes, c3 represents the total number of adjacent key nodes of the key node, c4 represents the total number of adjacent nodes of the key node, and S represents the key node detection accuracy.

[0129] In the above optional implementation manner, the key node detection accuracy can be calculated using the above calculation formula.

[0130] Embodiment 2

[0131] See also Fig.15 , Fig.15 1 is a schematic diagram of a network topology generation device disclosed in an embodiment of the present application, wherein the network topology generation device is applied to a first nmap detection node. Fig.15 As shown, the device of the embodiment of the present application includes the following functional modules:

[0132] A detection module 201 is used to execute a first scanning task and obtain a first link scanning result, where the first scanning task carries a scanning IP address;

[0133] A judgment module 202 is used to judge whether the scanned IP address and the IP address of the first nmap detection node belong to the same network segment address. If the scanned IP address and the IP address of the first nmap detection node belong to the same network segment address, the information of the gateway node is added to the first link scanning result, wherein the gateway node is a forwarding node of the scanned IP address;

[0134] The construction module 203 is used to construct a first N-ary tree with the first nmap detection node as the root node based on the first link scanning result.

[0135] The device in the embodiment of the present application executes the network topology structure generation method to determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address in the first link scan result based on the scanned IP address, and then determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and add the information of the gateway node in the first link scan result, wherein the gateway node is the forwarding node of the scanned IP address, so that the first N-ary tree can be obtained.

[0136] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0137] It should be noted that for other detailed descriptions of the device in the embodiment of the present application, please refer to the relevant description of the embodiment of the present application, and the embodiment of the present application will not go into details therein.

[0138] Embodiment 3

[0139] See also Fig.16 , Fig.16 is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application, such as Fig.16 As shown, the electronic device of the embodiment of the present application includes:

[0140] Processor 301; and

[0141] The memory 302 is configured to store machine-readable instructions, and when the instructions are executed by the processor 301, the network topology structure generation method as described in any of the aforementioned implementations is executed.

[0142] The electronic device in the embodiment of the present application can determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address in the first link scan result by executing the network topology structure generation method, and then determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address by determining that the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and can add the information of the gateway node in the first link scan result, wherein the gateway node is the forwarding node of the scanned IP address, so that the first N-ary tree can be obtained.

[0143] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0144] Embodiment 4

[0145] An embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor to implement a method for generating a network topology structure as described in any of the foregoing implementations.

[0146] The storage medium in the embodiment of the present application executes the network topology structure generation method to determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address in the first link scan result based on the scanned IP address, and then determine whether the IP address of the first nmap detection node belongs to the same network segment as the scanned IP address, and add the information of the gateway node in the first link scan result, wherein the gateway node is the forwarding node of the scanned IP address, so that the first N-ary tree can be obtained.

[0147] Compared with the prior art, the prior art does not pass through the gateway when detecting devices whose IP addresses belong to the same network segment as the nmap detection node. Therefore, the detection results cannot reflect the actual node association relationship, and the accuracy of the obtained network topology map is low.

[0148] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0149] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0150] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0151] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0152] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0153] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for generating a network topology structure, characterized in that: The method is applied to a first nmap detection node, and the method comprises: Execute a first scanning task and obtain a first link scanning result, wherein the first scanning task carries a scanning IP address; Determine whether the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, if the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, add the information of the gateway node in the first link scanning result, wherein the gateway node is the forwarding node of the scanning IP address; Based on the first link scanning result, constructing a first N-ary tree with the first nmap detection node as the root node; And, after constructing a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result, the method includes: Determine a node association relationship of each link node in the first N-ary tree; Determine a key node in the first N-ary tree and a plurality of non-key nodes connected to the key node based on a node association relationship of each link node in the first N-ary tree; Obtaining the ttl field values ​​of two adjacent key nodes; Calculating a second difference based on the ttl field values ​​of two adjacent key nodes; When the second difference is greater than 1, it is determined that there is a network area boundary between two adjacent key nodes; Dividing the first N-ary tree based on the network area boundary to obtain a plurality of network areas, wherein the network area includes one key node and a plurality of non-key nodes connected to the key node; Calculating the detection accuracy of each of the network areas; And, calculating the detection accuracy of each of the network areas includes: Calculating the key node detection accuracy rate corresponding to each of the network areas and using it as the detection accuracy rate of each of the network areas; And, the calculation formula corresponding to the key node detection accuracy is: ； Among them, q represents the real weight of the key node, c1 represents the number of adjacent key nodes of the key node that are real nodes, c2 represents the number of adjacent non-key nodes of the key node that are real nodes, c3 represents the total number of adjacent key nodes of the key node, c4 represents the total number of adjacent nodes of the key node, and S represents the key node detection accuracy.

2. The method according to claim 1, characterized in that Before constructing a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result, the method further includes: Extracting scanning information of two adjacent link nodes based on the first link scanning result, wherein the scanning information of the link nodes includes a ttl field value; Calculating a first difference based on the ttl field values ​​of the two adjacent link nodes; When the first difference is greater than 1, a virtual node is added to the first link scanning result, wherein the virtual node is a link node that is not scanned by the first nmap detection node.

3. The method according to claim 1, characterized in that The method further comprises: Obtaining a second link scanning result, wherein the second link scanning result is obtained by the second nmap detection node executing the second scanning task, or by the first nmap detection node executing the second scanning task; Based on the second link scanning result, construct a second N-ary tree; Obtaining an IP set of the first N-ary tree and an IP set of the second N-ary tree; The first N-ary tree and the second N-ary tree are merged based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree, and the IP set of the second N-ary tree.

4. The method according to claim 3, characterized in that The merging of the first N-ary tree and the second N-ary tree based on the key node detection accuracy of the first N-ary tree, the key node detection accuracy of the second N-ary tree, the IP set of the first N-ary tree, and the IP set of the second N-ary tree includes: Determine a key node with the highest detection accuracy based on the key node detection accuracy of the second N-ary tree and the key node detection accuracy of the first N-ary tree; The N-ary tree where the key node with the highest detection accuracy is located is used as the basic N-ary tree, and the other N-ary trees are used as the N-ary trees to be merged; Determine whether the IP set of the basic N-ary tree and the IP set of the N-ary tree to be merged have an intersection IP address. If so, based on the first network area detection accuracy of the intersection IP address and the second network area detection accuracy of the intersection IP address, retain the network area with higher detection accuracy in the basic N-ary tree.

5. The method according to claim 4, characterized in that The method further comprises: Based on the ttl field value of the intersection IP address, the virtual node in the basic N-ary tree is modified.

6. A network topology generation device, characterized in that: The device is applied to a first nmap detection node, and the device comprises: A detection module, used to execute a first scanning task and obtain a first link scanning result, wherein the first scanning task carries a scanning IP address; A judgment module, used to judge whether the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, if the scanning IP address and the IP address of the first nmap detection node belong to the same network segment address, then add the information of the gateway node in the first link scanning result, wherein the gateway node is a forwarding node of the scanning IP address; A construction module, configured to construct a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result; And, after constructing a first N-ary tree with the first nmap detection node as a root node based on the first link scanning result, the device is further configured to include: Determine a node association relationship of each link node in the first N-ary tree; Determine a key node in the first N-ary tree and a plurality of non-key nodes connected to the key node based on a node association relationship of each link node in the first N-ary tree; Obtaining the ttl field values ​​of two adjacent key nodes; Calculating a second difference based on the ttl field values ​​of two adjacent key nodes; When the second difference is greater than 1, it is determined that there is a network area boundary between two adjacent key nodes; Dividing the first N-ary tree based on the network area boundary to obtain a plurality of network areas, wherein the network area includes one key node and a plurality of non-key nodes connected to the key node; Calculating the detection accuracy of each of the network areas; And, calculating the detection accuracy of each of the network areas includes: Calculating the key node detection accuracy rate corresponding to each of the network areas and using it as the detection accuracy rate of each of the network areas; And, the calculation formula corresponding to the key node detection accuracy is: ； Among them, q represents the real weight of the key node, c1 represents the number of adjacent key nodes of the key node that are real nodes, c2 represents the number of adjacent non-key nodes of the key node that are real nodes, c3 represents the total number of adjacent key nodes of the key node, c4 represents the total number of adjacent nodes of the key node, and S represents the key node detection accuracy.

7. An electronic device, characterized in that: include: processor; as well as The memory is configured to store machine-readable instructions, and when the instructions are executed by the processor, the network topology structure generation method according to any one of claims 1 to 5 is executed.

8. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program is executed by a processor to implement the network topology generation method according to any one of claims 1 to 5.

Images