Method and system for monitoring IP and network segment survival

Abstract

The embodiment of the present disclosure discloses a method for monitoring the online survival of IP and network segments, including performing a preliminary detection of network segment survival to determine the type of the network segment, which includes a surviving network segment and a non-surviving network segment; performing a secondary detection on the surviving network segment to determine whether the surviving network segment is truly surviving, and if not, updating it to a non-surviving network segment and moving it from a surviving network segment set to a non-surviving network segment set; performing a survival detection on the non-surviving network segment to determine whether the non-surviving network segment is truly surviving, and if so, updating it to a surviving network segment and moving it from a non-surviving network segment set to a surviving network segment set; the method is divided into a surviving network segment set and a non-surviving network segment set through preliminary detection; at the same time, performing a secondary detection on the surviving network segment set and detecting the non-surviving network segment set, effectively avoiding the time-consuming and wasteful use of network bandwidth resources when performing all precise detections when network survival is unclear, and improving the detection speed.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular to a method and system for monitoring the online survival of IP addresses and network segments. Background Art

[0002] In many areas of network security, existing network security products generally have the following problems: within a given IP range, the IP survival status is unknown; within a given IP range, the IP port openness is unknown; in a typical network environment, manual judgment of IP allocation / survival / online / status, and manual acquisition of port openness, service operation, and protocol support on the IP asset result in extremely high maintenance costs, low efficiency, and difficulty in continuous updates.

[0003] Without knowing whether a given IP is online, has network reachability, or has open ports, a rash full scan will not only be extremely time-consuming, but also generate a large number of messages at a high rate, which can easily trigger security device alarms. More importantly, the traversal behavior without any specific target will generate a large number of invalid network messages, which may affect the normal use of the network.

[0004] The inability to determine the IP liveness and port openness of these devices makes it difficult to accurately operate, detect, and collect data from network security devices. Often, due to a lack of clarity regarding IP liveness and port openness, vulnerability scans lack specificity, requiring interactive requests and timeouts for all IP addresses within the target range. This not only consumes network bandwidth but also reduces the speed and effectiveness of vulnerability scans. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a method and system for monitoring the online survival of IP addresses and network segments, which can achieve more accurate and efficient survival status detection of target network segments.

[0006] In a first aspect, an embodiment of the present disclosure provides a method for monitoring IP and network segment liveness, including:

[0007] Performing a preliminary test of the network segment survival and determining the type of the network segment, which includes a surviving network segment and a non-surviving network segment;

[0008] Perform a secondary test on the surviving network segment to determine whether the surviving network segment is truly surviving. If not, update it to a non-surviving network segment and move it from the surviving network segment set to the non-surviving network segment set.

[0009] Performing survival detection on the dead network segment to determine whether the dead network segment is truly alive, and if so, updating it to a living network segment and moving it from the dead network segment set to the living network segment set;

[0010] The surviving network segment set is used to store the surviving network segments, and the unsurviving network segment set is used to store the unsurviving network segments.

[0011] Optionally, performing a preliminary detection of network segment survival and determining the type of the network segment includes:

[0012] Acquire first scanning information based on a preset format element, a first port to be detected, and a preset port scanner;

[0013] If the first scanning information is empty, marking the preset format element as a dead network segment and storing it in the dead network segment set;

[0014] If the network segment and the port in the first scanning information belong to the preset format element and the first port to be detected respectively, the preset format element is marked as a surviving network segment and stored in the surviving network segment set.

[0015] Optionally, the method for obtaining the preset format element includes:

[0016] Splitting the target network range to be detected into a plurality of preset format data, wherein the plurality of preset format data constitute an element list;

[0017] An element randomly taken out from the element list is the preset format element.

[0018] Optionally, the first ports to be detected are a set of n ports randomly selected from a port list;

[0019] The number of ports in the port list is N;

[0020] When N>50, n=25;

[0021] When 50≥N>25, n=12;

[0022] When 25≥N>10, n=5.

[0023] Optionally, the performing secondary detection on the surviving network segment to determine whether the surviving network segment is truly surviving includes:

[0024] Based on the surviving network segment, the port list, and the preset port scanner, obtaining second scanning information, wherein the second scanning information includes the IP information of the surviving network segment and its open ports;

[0025] Determine whether the port corresponding to the IP information belongs to the port list or whether the IP information supports ICMP; if so, determine that the surviving network segment is truly surviving.

[0026] Optionally, performing survival detection on the non-survival network segment to determine whether the non-survival network segment is truly alive includes:

[0027] Acquire third scanning information based on the dead network segment, the second port to be detected, and the preset port scanner;

[0028] If the network segment in the third scanning information does not belong to the dead network segment, or the port in the third scanning information does not belong to the port list and the IP information in the third scanning information does not support ICMP, then the dead network segment is determined to be truly dead;

[0029] If the network segment of the third scanning information belongs to the dead network segment, and the port of the third scanning information belongs to the port list or the IP information in the third scanning information supports ICMP, the dead network segment is determined to be a live network segment.

[0030] Optionally, the unsurvivable network segment is any network segment in the unsurvivable network segment set;

[0031] The second ports to be detected are a set of m ports randomly selected from the port list;

[0032] When N>50, m=10;

[0033] When 50≥N>25, m=5;

[0034] When 25≥N>10, m=2.

[0035] In a second aspect, the embodiments of the present disclosure further provide a system for continuously monitoring the liveness of IP network segments in a network security scanning scenario, including:

[0036] A preliminary detection module is configured to perform a preliminary detection of the survival of the network segment and determine the type of the network segment, wherein the type includes a surviving network segment and a non-surviving network segment;

[0037] A secondary detection module is configured to perform a secondary detection on the surviving network segment to determine whether the surviving network segment is truly surviving;

[0038] If not, it is updated to a non-survival network segment and moved from the surviving network segment set to the non-survival network segment set; the surviving network segment set is used to store the surviving network segment, and the non-survival network segment set is used to store the non-survival network segment;

[0039] a correction module configured to perform survival detection on the non-survival network segment to determine whether the non-survival network segment is truly alive;

[0040] If so, it is updated to a surviving network segment and moved from the non-surviving network segment set to the surviving network segment set.

[0041] In a third aspect, the present disclosure also provides an electronic device that employs the following technical solution:

[0042] The electronic device comprises:

[0043] at least one processor; and,

[0044] a memory communicatively connected to the at least one processor; wherein,

[0045] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above-mentioned methods for monitoring IP and network segment online survival.

[0046] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned methods for monitoring IP and network segment online survival.

[0047] The present application discloses a method for monitoring the online survival of IPs and network segments. Through the settings of preliminary detection, secondary detection and survival detection, compared with periodic detection based on traffic mirroring, PING detection based solely on ICMP interaction, and comprehensive port detection based on all IPs, the detection time is shorter and more targeted, and more accurate IP network segment survival information can be continuously output.

[0048] By setting up the initial detection phase for network segment survival, network segments are preliminarily determined to be alive or dead based on whether any IP is alive, thereby reducing the problems of low accuracy, large message interaction, and long time consumption of continuous, full-IP, full-port detection of given ports in existing technical means. By setting up the precise detection phase, comprehensive (full-port, full-IP) detection is performed on network segments with known surviving IPs, accurately obtaining the specific surviving IPs and their port openness within the surviving CIDR network segment. Since the rapid detection process is used as the basis, the non-surviving IPs in the target IP range are filtered out, and thus the packet interaction efficiency of the precise detection process is higher. The setting up of the survival detection phase supplements the problem of CIDR network misjudgment and omission of survival in extreme cases due to random port selection in the above-mentioned precise detection. At the same time, in the continuous survival monitoring process, network segments that have changed from non-survival to survival can be quickly discovered and promptly added to the surviving network segments for subsequent precise detection processes.

[0049] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0051] Figure 1 A logical flow chart of the method provided in the embodiment of the present disclosure.

[0052] Figure 2 A schematic diagram of the process of preliminary detection of network segment survival provided by an embodiment of the present disclosure.

[0053] Figure 3 A schematic diagram of the process flow of the secondary detection stage provided in an embodiment of the present disclosure.

[0054] Figure 4 A flowchart of the survival detection phase provided in an embodiment of the present disclosure.

[0055] Figure 5 A block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0056] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0057] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0058] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0059] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0060] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0061] Reference Figure 1 The first aspect of the present application discloses a method for monitoring IP and network segment survival, the method comprising the following steps:

[0062] S100, network segment survival rapid detection phase (ie, preliminary detection phase): perform a rapid detection of network segment survival (ie, preliminary detection) to determine the type of the network segment; wherein the type includes a surviving network segment and a non-surviving network segment.

[0063] S200, precise detection phase (ie, secondary detection phase): perform precise detection (ie, secondary detection) on the surviving network segment to determine whether the surviving network segment is truly surviving. If not, update it to a non-surviving network segment and move it from the surviving network segment set to the non-surviving network segment set.

[0064] The surviving network segment set is used to store surviving network segments, and the unsurviving network segment set is used to store unsurviving network segments.

[0065] S300, survival detection phase: perform survival detection on the non-survival network segment to determine whether the non-survival network segment is truly alive. If so, update it to a surviving network segment and move it from the non-survival network segment set to the surviving network segment set.

[0066] In the field of network security, asset mapping, target information collection, vulnerability scanning and other products all need to understand the target IP or the target IP range, the survival of the IP; the openness of the port. General products generally support two configurations, namely: (1) configure which / which IPs to scan, such as a single IP, a CIDR format network segment with a mask, etc.; (2) configure which ports of the above IP to scan, such as the common HTTP80 port, HTTPS443 port, mysql3306 port, or even all ports 0-65535. However, if the online, network reachability and port openness of the given IP in (1) are not clear, a full scan will be extremely time-consuming. On the other hand, the high-speed scan will generate a large number of messages, which can easily trigger security equipment alarms. More importantly, the traversal behavior without any specific target generates a large number of invalid network messages, which may affect the normal use of the network.

[0067] Through the method disclosed in this application, it is possible to detect the target IP segment and the survival and use of IPs in the segment and the port openness at a lower cost, more accurately and efficiently.

[0068] Reference Figure 2 , S100 specifically includes the following steps:

[0069] S110 , acquiring first scanning information based on a preset format element T3 , a first port to be detected P3 , and a preset port scanner.

[0070] That is, in this embodiment, the preset format element is used as the target network segment, the first port to be detected is used as the target port, and a preset port scanner is used for scanning.

[0071] Preferably, the preset port scanner is masscan.

[0072] Furthermore, the method for obtaining the preset format element is: obtaining the element list T2 based on the target network range; and obtaining the preset format element T3 based on the element list T2.

[0073] Specifically, the method includes the following steps: A1, splitting the target network range T1 to be detected into a number of preset format data, and the plurality of preset format data constitute an element list T2;

[0074] A2, an element randomly taken from the element list T2 is the preset format element.

[0075] In this embodiment, a number of ports P3 to be detected are obtained based on the port list P1 of the target network range.

[0076] Specifically, the first port to be detected P3 is a set of n ports randomly selected from a port list, and the number of ports in the port list is N.

[0077] When N>50, n=25, that is, when the number of ports in the port list is greater than 50, 25 ports are randomly selected therefrom to form the first ports to be detected.

[0078] When 50≥N>25, n=12, that is, when the number of ports in the port list is greater than 25 and not greater than 50, 12 ports are randomly selected therefrom to form the first ports to be detected.

[0079] When 25≥N>10, n=5, that is, when the number of ports in the port list is greater than 10 and not greater than 25, 5 ports are randomly selected therefrom to form the first ports to be detected.

[0080] In this embodiment, the preset format data is preferably CIDR format data with a network mask not less than 24, and the element list is a CIDR element list.

[0081] S120: Analyze the first scan information through a regularization module to determine whether the first scan information is empty.

[0082] S130, if the first scan information is empty, that is, the target network segment has no response to the target port and ICMP, that is, the IP is not online or the network access is unreachable, then mark the preset format element as a dead network segment and store it in the dead network segment set.

[0083] S140, if the first scan information is not empty, and the network segment in the first scan information belongs to the preset format element T3, and the port in the first scan information belongs to the first port to be detected P3, then mark the preset format element as a surviving network segment T4 and store it in the surviving network segment set.

[0084] The preset port scanner parses out all the corresponding IP information according to the preset format element T3; and parses out all the ports according to the port to be detected P3.

[0085] Furthermore, through the setting of S100, all elements in the element list can be traversed to perform network segment activity detection on all elements, and the network segment set with currently surviving online IPs can be learned.

[0086] This step (i.e., the rapid detection phase of network segment survival) is to make a quick judgment from the network segment dimension, with a preset format element T3 randomly selected from the element list as the target network segment, and the first port to be detected P3 consisting of a set of n ports randomly selected from the port list as the target port. The preset port scanner is used for scanning and analysis, and the IP segments are quickly classified when the survival of the target IP range within the target network range is detected for the first time or is unclear.

[0087] Specifically: Split the given target IP range (i.e., target network range T1) into multiple CIDR segments with 24-bit masks, such as 10.10.10.0 / 24; Randomly select some ports from the given port range or common open ports to form the ports to be detected, and perform scanning and detection; If any port in the CIDR segment is found to be open, it is assumed that the CIDR segment is alive, and the surviving segment is quickly locked.

[0088] For the CIDR segments split from the given target IP range, repeat the above process to divide the given target IP range (ie, target network range T1) into: a set of surviving CIDR segments and a set of unsurviving CIDR segments.

[0089] After completing the above steps, a preliminary conclusion has been drawn on the survival test of the given target network range. Enter the second step of precise detection.

[0090] Reference Figure 3 , S200 specifically includes the following steps:

[0091] S210 , based on the surviving network segment T4 , the port list P1 and the preset port scanner, obtain second scanning information, where the second scanning information includes the IP information of the surviving network segment and its open ports.

[0092] That is, in this embodiment, the surviving network segment is used as the target network segment, the port list is used as the target port, ICMP supplementary parameters are used, and a preset port scanner is used for scanning.

[0093] S220: Determine, through a regularization module, whether the port corresponding to the IP information belongs to a port list or whether the IP information supports ICMP.

[0094] S230, if yes, that is, the port corresponding to the IP information belongs to the port list or the IP information supports ICMP, both indicate that the request judgment based on the open port or ICMP proves that the IP has responded, then the surviving network segment is determined to be truly surviving and continues to be stored in the surviving network segment set; otherwise, the surviving network segment is determined to be falsely surviving and is moved from the surviving network segment set to the non-surviving network segment set.

[0095] Furthermore, if the second scanning information does not include any IP information, any open port, or ICMP information, the surviving network segment is determined to be falsely surviving, and is moved from the surviving network segment set to the non-surviving network segment set.

[0096] In this embodiment, when the randomly selected elements from the element list are different, that is, when the preset format element changes, when it is determined to be alive, the surviving network segment T4 changes accordingly; therefore, by traversing the surviving network segments, all surviving IPs in the given target network range and their open ports supported by the port list to be detected can be accurately obtained.

[0097] This step (i.e., the precise detection phase) is to make a quick judgment from the port dimension. Specifically, the CIDR segments within the above-mentioned surviving CIDR segment set are scanned using a given port range list or a common open port list. Accurately obtain all IPs with open ports in the given surviving CIDR segment as surviving IPs and the open ports as the open ports of the IPs.

[0098] After completing the above steps, the liveness detection for the given target network range has been accurately concluded. However, since the unavailable network segment may be temporarily unreachable due to network configuration, IP allocation, etc., the third step of liveness detection will be continued.

[0099] Reference Figure 4 , S300 specifically includes the following steps:

[0100] S310: Acquire third scanning information based on the dead network segment, the second port to be detected, and the preset port scanner.

[0101] In this embodiment, when the element randomly selected from the element list is different, that is, when the preset format element is changed, when it is determined to be non-survival, the non-survival network segment is changed accordingly.

[0102] The unsurvivable network segment is any network segment in the unsurvivable network segment set.

[0103] The second ports to be detected are a set of m ports randomly selected from the port list.

[0104] When N>50, m=10, that is, when the number of ports in the port list is greater than 50, 10 ports are randomly selected as the second ports to be detected.

[0105] When 50≥N>25, m=5, that is, when the number of ports in the port list is greater than 25 and not greater than 50, 5 ports are randomly selected as the second ports to be detected.

[0106] When 25≥N>10, m=2, that is, when the number of ports in the port list is greater than 10 and not greater than 25, 2 ports are randomly selected as the second ports to be detected.

[0107] S320, analyze and judge the third scanning information through the regular module. If the network segment in the third scanning information does not belong to the dead network segment, or the port of the third scanning information does not belong to the port list and the IP information in the third scanning information does not support ICMP, it is determined to be dead.

[0108] Specifically, the non-survival network segment is used as the target network segment, the second port to be detected is used as the target port, ICMP is used as the supplementary parameter, and a preset port scanner is used to scan and output the scan result, i.e., the third scan information; then the third scan information is analyzed and judged by the regular module.

[0109] S330, if the network segment of the third scan information belongs to a dead network segment, and the port of the third scan information belongs to the port list or the IP information supports ICMP, then the dead network segment is determined to be alive, and the dead network segment is moved from the dead network segment set to the alive network segment set.

[0110] Specifically, the first judgment criterion is that the network segment in the third scan information does not belong to a dead network segment; the second judgment criterion is that the port of the third scan information does not belong to the port list and the IP information does not support ICMP; the third judgment criterion is that the port of the third scan information belongs to the port list or the IP information supports ICMP.

[0111] When the third scanning information satisfies the first judgment criterion or the second judgment criterion, the dead network segment is determined to be truly dead.

[0112] When the third scanning information does not meet the first judgment standard but meets the third judgment standard, the dead network segment is determined to be false dead, that is, truly alive, and the dead network segment is moved from the dead network segment set to the alive network segment set to complete the correction.

[0113] This step (i.e., the survival detection phase) is to perform correction and update from the correction dimension; specifically, for the non-survival network segments in the non-survival network segment set, i.e., the CIDR network segments in the non-survival CIDR network segment set, some ports are randomly selected from the given port range or common open ports (and the number of ports is less than the number of detection ports in the rapid detection process) for scanning and detection. If any port of the CIDR network segment is found to be open, it is assumed that the CIDR network segment is alive, so as to correct the scanning result of S100 and move it from the non-survival network segment set to the surviving network segment set (i.e., the surviving CIDR network segment set). Through the setting of this step, both the monitoring cycle of the overall step and the accuracy of the monitoring can be guaranteed.

[0114] Furthermore, the dead network segment set is a Dead-Set dead network segment set, and the alive network segment set is an Alive-Set alive network segment set.

[0115] After completing the above-mentioned rapid detection, accurate detection, and probing detection stages, the first round of detection information on IP survival in a given target network range can be obtained.

[0116] The first round of detection divides the IP segments of a given network range into a set of surviving network segments and a set of non-surviving network segments through rapid detection. At the same time, accurate detection is performed on the set of surviving network segments and detection is performed on the set of non-surviving network segments, effectively avoiding the time-consuming and wasteful use of network bandwidth resources by performing accurate detection on all segments when the network survival is unclear, while improving the detection speed.

[0117] Specifically, the information includes: CIDR representation of the surviving IP segment, CIDR representation of the dead IP segment, surviving IPs in the surviving IP segment, whether the surviving IPs in the surviving IP segment support ICMP interaction, and open port numbers of the surviving IPs in the surviving IP segment for the given target port list P1.

[0118] Since the above process has completed the initial analysis of the target network segment, in order to continue the online survival analysis of the given target network range, it is only necessary to repeat the precise detection phase of step 2 and the detection phase of step 3 to continuously update the survival status of the given target network range T1.

[0119] After obtaining the above-mentioned first round of detection results, the current surviving IP segment set (i.e., Alive-Set) and the dead IP segment set (i.e., Dead-Set) are known. In actual environments, IPs may be dynamically allocated through DHCP, or reclaimed upon expiration, or the assets corresponding to the IPs may be shut down and offline, or put online, or some newly connected asset devices may enable the IP segments in the original dead IP segment set Dead-Set. Therefore, in subsequent continuous detection, the surviving IP segment set Alive-Set and the dead IP segment set Dead-Set obtained in the previous round of detection are used as the basis for continuous detection. That is: based on the surviving IP segment set Alive-Set obtained in the previous round of detection, S200 is repeatedly executed to perform accurate detection, as follows:

[0120] D1: Set the Alive-Set of surviving IP segments obtained in the previous round of detection to T4. Scan each segment from T4 as the target segment to be detected, using the port list P1 as the target port and ICMP as the supplementary parameter. The scan output will include information about IP addresses in the target segment that have open ports in the port list and IP addresses that support ICMP request interaction.

[0121] D2: Extract the IP information from the scan results, specifically the current IP's online status, whether it supports ICMP, and the open port numbers supported by the IP for the port list P1 to be tested. If the scan results do not contain any open ports or ICMP information for any IP, the target network segment is dead. The target network segment is then moved from the live network segment set to the dead network segment set.

[0122] D3: After traversing the surviving network segment T4, all surviving IP addresses in the given target network range and their open ports supported by the port list P1 to be detected in this round of detection can be obtained.

[0123] Based on the current dead IP network segment set Dead-Set (the current dead IP network set includes dead IP network segments from the previous round and newly added dead network segments during the current round of precise detection), S300 is repeated to perform liveness detection, as follows:

[0124] E1: From the dead-set output by the above process, one network segment is selected as the target network segment to be detected, and M ports are randomly selected from the port list to be detected P1. In particular, when the number of ports in the port list to be detected P1 is greater than 50, 10 ports are randomly selected as the target ports to be detected; when the number of ports in the port list to be detected P1 is greater than 25, 5 ports are randomly selected as the ports to be detected; when the number of ports in the port list to be detected P1 is greater than 10, 2 ports are randomly selected as the ports to be detected.

[0125] E2: Scanning is performed based on the target network segment and ports to be detected obtained in the above step (i.e., E1) as basic parameters and ICMP as a supplementary parameter. The scan output will include information about IP addresses with open ports and supporting ICMP request interaction in the target network segment if there are any live IP addresses in the target network segment.

[0126] E3: Extract the IP information from the scan results. If the IP, port, and ICMP request interaction information described above are present, the network segment is alive. The target network segment is then moved from the Dead-Set to the Alive-Set.

[0127] After completion, the updated detection results for this round are obtained. Subsequently, precise detection of D1, D2, and D3, as well as probing of E1, E2, and E3, are repeated. This continuously updates the alive and dead segments of the target IP range. A common industry solution involves sending an ICMP request message (i.e., a ping message) to the target IP address within a given IP range before testing. If the target IP address responds with an ICMP reply message, it indicates that the target IP address is alive and online. If the target IP address does not respond with an ICMP reply message, it is considered dead and online. However, in real-world environments, not all IP asset devices respond to ICMP reply messages. Common Linux and Windows operating systems allow users to disable the ICMP request and reply function. Furthermore, a single ICMP request message sent from the same source IP address within a given period of time targeting a large range of IP addresses may be identified as an ICMP flood attack by firewalls and other devices, which may discard the message, resulting in inaccurate IP alive detection results.

[0128] Therefore, compared to the methods used in common network security products, the rapid segment survival detection phase is used to initially determine whether a segment is alive or dead based on whether any IP addresses are alive. This reduces the low accuracy, high message exchange volume, and long time consumption of continuous, full-IP, full-port detection of a given port, which are common in existing technologies. The precise detection phase allows for comprehensive (full-port, full-IP) detection of segments known to have surviving IP addresses, accurately capturing the specific surviving IP addresses and their port openness within the surviving CIDR segment. Because the rapid detection process serves as a foundation, it filters out dead IP addresses within the target IP range, resulting in higher packet exchange efficiency during the precise detection process. The survival detection phase addresses the issue of CIDR network misjudgment and missed survival in extreme cases caused by random port selection in the aforementioned precise detection. Furthermore, during the continuous survival monitoring process, segments transitioning from dead to alive can be quickly identified and promptly added to the surviving segments for subsequent precise detection.

[0129] In the above three stages, the surviving online IP information, ICMP interaction support information, and port open information discovered in any stage can be used as output and provided to other network security products and modules for use.

[0130] A second aspect of the present application discloses a system for continuously monitoring the liveness of IP network segments in a network security scanning scenario, comprising:

[0131] A preliminary detection module is configured to perform a quick detection of network segment survival and determine the type of the network segment, wherein the type includes a surviving network segment and a non-surviving network segment;

[0132] The secondary detection module is configured to accurately detect the surviving network segment and determine whether the surviving network segment is truly surviving. If not, it is updated to a non-surviving network segment and moved from the surviving network segment set to the non-surviving network segment set; the surviving network segment set is used to store surviving network segments, and the non-surviving network segment set is used to store non-surviving network segments;

[0133] The correction module is configured to perform survival detection on the dead network segment, determine whether the dead network segment is truly alive, and if so, update it to a living network segment and move it from the dead network segment set to the living network segment set.

[0134] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0135] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer-readable instructions stored in the memory, causing the electronic device to execute all or part of the steps of the method for monitoring IP and network segment online survival described in each embodiment of the present disclosure.

[0136] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0137] like Figure 5 The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device according to an embodiment of the present invention. Figure 5 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0138] like Figure 5As shown, the electronic device may include a processing device (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processing device, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0139] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes and hard disks; and communication devices. The communication device allows the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 5 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0140] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of the method for monitoring IP and network segment online survival of the embodiment of the present disclosure are executed.

[0141] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0142] According to an embodiment of the present disclosure, a computer-readable storage medium stores non-transitory computer-readable instructions. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the method for monitoring IP and network segment liveness in each embodiment of the present disclosure are performed.

[0143] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0144] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0145] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0146] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0147] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0148] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0149] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0150] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0151] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for monitoring IP and network segment survival, characterized in that: include: Performing a preliminary test of the network segment survival and determining the type of the network segment, which includes a surviving network segment and a non-surviving network segment; Performing a secondary detection on the surviving network segment to determine whether the surviving network segment is truly surviving; If not, it is updated to a dead network segment and moved from the live network segment set to the dead network segment set; Performing survival detection on the non-survival network segment to determine whether the non-survival network segment is truly alive; If so, update it to a surviving network segment and move it from the non-surviving network segment set to the surviving network segment set; The surviving network segment set is used to store the surviving network segments, and the unsurviving network segment set is used to store the unsurviving network segments; The performing secondary detection on the surviving network segment to determine whether the surviving network segment is truly surviving includes: obtaining second scanning information based on the surviving network segment, the port list and the preset port scanner, the second scanning information including the IP information of the surviving network segment and its open ports; Determine whether the port corresponding to the IP information belongs to the port list or whether the IP information supports ICMP; if so, determine that the surviving network segment is truly alive; if the second scanning information does not contain any IP information, any open port, or ICMP information, determine that the surviving network segment is falsely alive, and move it from the surviving network segment set to the non-surviving network segment set.

2. The method according to claim 1, characterized in that The preliminary detection of network segment survival and determination of the type of the network segment include: Acquire first scanning information based on a preset format element, a first port to be detected, and a preset port scanner; If the first scanning information is empty, marking the preset format element as a dead network segment and storing it in the dead network segment set; If the network segment and the port in the first scanning information belong to the preset format element and the first port to be detected respectively, the preset format element is marked as a surviving network segment and stored in the surviving network segment set.

3. The method according to claim 2, characterized in that The method for obtaining the preset format element includes: Splitting the target network range to be detected into a plurality of preset format data, wherein the plurality of preset format data constitute an element list; An element randomly taken out from the element list is the preset format element.

4. The method according to claim 3, characterized in that The first port to be detected is randomly selected from the port list A port set; The number of ports in the port list is ; when hour, ; when hour, ; when hour, .

5. The method according to claim 4, characterized in that The performing survival detection on the non-survival network segment to determine whether the non-survival network segment is truly alive includes: Acquire third scanning information based on the dead network segment, the second port to be detected, and the preset port scanner; If the network segment in the third scanning information does not belong to the dead network segment, or the port in the third scanning information does not belong to the port list and the IP information in the third scanning information does not support ICMP, then the dead network segment is determined to be truly dead; If the network segment of the third scanning information belongs to the dead network segment, and the port of the third scanning information belongs to the port list or the IP information in the third scanning information supports ICMP, the dead network segment is determined to be a live network segment.

6. The method according to claim 5, characterized in that The non-survival network segment is any network segment in the non-survival network segment set; The second port to be detected is randomly selected from the port list A port set; when hour, ; when hour, ; when hour, .

7. A system for continuously monitoring the online presence of IP network segments in a network security scanning scenario, characterized in that: include: A preliminary detection module is configured to perform a quick detection of network segment survival and determine the type of the network segment, wherein the type includes a surviving network segment and a non-surviving network segment; A secondary detection module is configured to accurately detect the surviving network segment and determine whether the surviving network segment is truly surviving; If not, it is updated to a dead network segment and moved from the live network segment set to the dead network segment set; The surviving network segment set is used to store the surviving network segments, and the unsurviving network segment set is used to store the unsurviving network segments; a correction module configured to perform survival detection on the non-survival network segment to determine whether the non-survival network segment is truly alive; if so, update it to a surviving network segment and move it from the non-survival network segment set to the surviving network segment set; The performing secondary detection on the surviving network segment to determine whether the surviving network segment is truly surviving includes: obtaining second scanning information based on the surviving network segment, the port list and the preset port scanner, the second scanning information including the IP information of the surviving network segment and its open ports; Determine whether the port corresponding to the IP information belongs to the port list or whether the IP information supports ICMP; if so, determine that the surviving network segment is truly alive; if the second scanning information does not contain any IP information, any open port, or ICMP information, determine that the surviving network segment is falsely alive, and move it from the surviving network segment set to the non-surviving network segment set.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for monitoring IP and network segment online survival described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a computer to execute the method for monitoring IP and network segment online survival according to any one of claims 1 to 6.

Images