A component recognition method and system based on directory search

Abstract

The application provides a component identification method and system based on directory retrieval, which comprises the following steps: directory modeling of a difference component is performed to determine and extract component identification features of the difference component, so as to obtain a component feature file, and to determine a component main directory hierarchical structure feature; according to the component main directory hierarchical structure feature, directory modeling is performed on each component to generate a component-specific feature mark of each component, which is used as unique verification information; according to the unique verification information, the component-specific feature mark is stored in a database to establish a directory feature database according to the main directory hierarchical structure feature; a to-be-identified component is indexed, and a directory feature of the to-be-identified component is extracted, which is matched with the component-specific feature mark in the directory feature database according to a credibility degree, so as to obtain a credibility probability, and the to-be-identified component is identified. The application solves the technical problems of restriction of special service identification and lack of identification ability of an identification method in a specific scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer operating system, and particularly relates to a component identification method and system based on directory retrieval. BACKGROUND

[0002] Correctly identifying the component type and version in the host asset is of great reference significance for evaluating the value of the host asset. The conventional component discovery strategy relies on service ports, banner information and process information. If the scanned service is customized configured, such as changing the default port, hiding the system banner information and other means of intentionally hiding service information, the conventional component identification technology is difficult to accurately and effectively identify the component related information.

[0003] The prior art patent application document with the publication number CN114124475A, "Network asset port scanning and service identification method and device", the method includes: creating an asset scanning task, the asset scanning task includes a scanning target and scanning parameters; performing port scanning on the scanning target according to the scanning parameters to obtain the current port state of each port; obtaining the historical port state of each port, and generating an alarm information when the current port state and the historical port state are inconsistent; identifying the port service fingerprint of the port whose current port state is open; generating a service fingerprint asset library according to the port service fingerprint, and visually displaying the service fingerprint asset library. The prior art patent application document with the publication number CN113518019A, "System identification method based on live port", the method includes performing port detection on a target machine to determine the live state of each port in the target machine; generating a code according to the live state of each port in the target machine, the code is used for marking the port live state; inputting the code into a system identification model trained by a supervised learning algorithm to obtain the output system type of the target machine. Here, tools and services are collectively referred to as components. As can be seen from the specific implementation mode of the foregoing prior art solutions, the existing conventional component identification method is based on the live state of the service. When the service is suspended or stopped, the conventional identification method will fail. Since the tool does not have some characteristics of the service, this also leads to the fact that the conventional identification method cannot be applied to the identification of tool components.

[0004] In summary, the prior art has the technical problems of constraints in special service identification and lack of identification ability of the identification method in specific scenarios. SUMMARY

[0005] The technical problem to be solved by the present application is how to solve the technical problems of constraints in special service identification and lack of identification ability of the identification method in specific scenarios in the prior art.

[0006] The application solves the above technical problems by the following technical scheme: a component identification method based on directory retrieval comprises:

[0007] S1, directory modeling is performed on the difference component, based on which component identification features of the difference component are determined and extracted to obtain a component feature file, based on which a component main directory hierarchical structure feature is determined;

[0008] S2, according to the component main directory hierarchical structure feature, directory modeling is performed on each component to generate a component-specific feature mark of each component, which is used as unique verification information, and the component-specific feature mark is stored according to the unique verification information, so as to establish a directory feature library according to the main directory hierarchical structure feature;

[0009] S3, a directory index of the to-be-identified component is performed, and a directory feature of the to-be-identified component is extracted, based on which a credibility degree matching is performed with the component-specific feature mark in the directory feature library, based on which a credibility probability is obtained to identify the to-be-identified component, and step S3 further comprises:

[0010] S31, a B+ directory index tree is created for the directory;

[0011] S32, a positioning operation is performed according to the component-specific feature, and a directory index is retrieved according to the B+ directory index tree, based on which an easily-identified hash code of the to-be-identified component is obtained;

[0012] S33, the easily-identified hash code is regulated and processed by using a preset compatibility control center to obtain a component identification credibility, so as to quantitatively analyze a directory feature uniqueness probability and a directory structure variability probability of the to-be-identified component, based on which the credibility probability is generated.

[0013] The application extracts common features of tools and services, comprehensively considers directory structure characteristics of respective tools or services, and breaks through technical bottlenecks of conventional identification technologies in tool identification or identification of some special services based on a component directory structure retrieval component identification technology.

[0014] The application reasonably controls calling of directory modeling, a directory feature library, a directory index, a compatibility control center and the like to realize identification of components. The method can be used as a replacement method or a supplementary method of a conventional component identification method in a specific application scenario to make up for deficiencies of the conventional component identification method in tool identification capability or identification stop state service capability.

[0015] In a more specific technical scheme, in step S1, the feature file of the component comprises a start-stop file and a configuration file.

[0016] In a more specific technical scheme, file attributes of the start-stop file and the configuration file of the component are extracted as component identification features.

[0017] In a more specific technical solution, step S2 comprises:

[0018] S21, when the component-specific feature mark is in the warehouse operation, the unique verification information is generated in the directory feature library;

[0019] S22, when the component-specific feature mark of the new component has been in the directory feature library, the component-specific feature mark of no less than 2 is refined.

[0020] The application can improve the accuracy of component identification by using the control parameter with upper limit floating to identify the component through the establishment of the component directory feature library.

[0021] In a more specific technical solution, in step S2, the minimum structural unit of the target feature library is a single row record, and the component-specific feature mark of the same component comprises no less than 2 row records.

[0022] In the application, although a single directory cannot be used as a basis for identifying the component type, the collection of all subdirectory features under the main directory is sufficient to be used as an important feature for identifying the component type, excluding the case of maliciously imitating the component feature structure.

[0023] In a more specific technical solution, step S32 comprises:

[0024] S321, the position of the component directory is located according to the identifiable feature of the component to be identified;

[0025] S322, the main directory level structure feature is used to traverse the directory structure in reverse, so as to locate the level of the main directory of the component to be identified;

[0026] The reverse traversal adopted in the application has strong purpose, which accelerates the speed and effectiveness of target traversal, and avoids redundant traversal of irrelevant directories in the global range.

[0027] S323, the directory index of all subdirectories and files under the current directory is recorded, so as to generate the easily identifiable hash code of the component to be identified.

[0028] In a more specific technical solution, in step S33, the matching degree of multiple row records is used to identify the credibility of component identification, and when the minimum credibility is reached, the identification of the component is recognized as reliable.

[0029] In a more specific technical solution, in step S33, the component directory blacklist of the component is obtained by using the compatibility control center, so as to control the component directory creation operation.

[0030] In a more specific technical solution, in step S33, the compatibility control center processes the directory index hierarchy of the component and the longitudinal index creation information to regulate the directory index hierarchy and the longitudinal index creation operation.

[0031] The application uses the compatibility control center to control the component directory blacklist management. The directory index of the directory placed in the blacklist will not be created, and the hierarchy of the directory index is controlled, and the invalid longitudinal index creation is strictly controlled.

[0032] In a more specific technical solution, a component identification system based on directory retrieval includes:

[0033] The directory hierarchy feature acquisition module is used to model the difference component directory, determine and extract the component identification features of the difference component, obtain the component feature file, and determine the component main directory hierarchy structure features;

[0034] The directory feature library construction module is used to model the directory of each component according to the component main directory hierarchy structure features, to generate the component-specific feature mark of each component, to serve as unique verification information, to perform the library operation on the component-specific feature mark according to the unique verification information, to establish the directory feature library according to the main directory hierarchy structure features, and the directory feature library construction module is connected with the directory hierarchy feature acquisition module;

[0035] The component identification module is used to index the directory of the component to be identified, extract the directory features of the component to be identified, match the directory features with the component-specific feature mark in the directory feature library, obtain the credibility probability, and identify the component to be identified. The component identification module is connected with the directory feature library construction module, and the component identification module further includes:

[0036] The index tree creation module is used to create a B+ directory index tree for the directory;

[0037] The positioning retrieval module is used to perform positioning operation according to the component-specific features, and retrieve the directory index according to the B+ directory index tree, to obtain the easily identifiable hash code of the component to be identified, and the positioning retrieval module is connected with the index tree creation module;

[0038] The credibility acquisition module is used to regulate and process the easily identifiable hash code by using the preset compatibility control center to obtain the component identification credibility, to quantitatively analyze the directory feature uniqueness probability and the directory structure variability probability of the component to be identified, to generate the credibility probability, and the credibility acquisition module is connected with the positioning retrieval module.

[0039] The present application has the following advantages compared with the prior art: the extraction tool and the service exist common features, the directory structure characteristics of the respective tool or service are integrated, the component identification technology based on the component directory structure retrieval breaks through the technical bottleneck of the conventional identification technology in tool identification or identification of some special services.

[0040] The present application reasonably controls the calling directory modeling, the directory feature library, the directory index, the compatibility control center and other capabilities to realize the identification of the component. The method can be used as a replacement method or a supplementary method of the conventional component identification method in a specific application scenario to make up for the lack of the tool identification capability or the identification stop state service capability of the conventional component identification method.

[0041] The present application improves the accuracy of component identification by using the control parameters with upper limit floating to identify the component through the establishment of the component directory feature library.

[0042] In the present application, although a single directory cannot be used as a basis for identifying the component type, the collection of all subdirectory features under the main directory is sufficient to be used as an important feature for identifying the component type under the condition that the maliciously imitated component feature structure is excluded.

[0043] The present application uses the compatibility control center to control the component directory blacklist management. The directory index of the directory placed in the blacklist will not be created, and the level of the directory index is controlled, and the invalid vertical index creation is strictly controlled.

[0044] The present application solves the technical problems of the existing special service identification, the identification capability deficiency of the identification method in a specific scenario and the like. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 FIG. 1 is a basic step schematic diagram of a component identification method based on directory retrieval according to Embodiment 1 of the present application;

[0046] Figure 2 FIG. 2 is a directory feature library schematic diagram according to Embodiment 1 of the present application;

[0047] Figure 3 FIG. 3 is a B+ cluster index tree structure schematic diagram according to Embodiment 1 of the present application;

[0048] Figure 4 FIG. 4 is a component identification data flow processing schematic diagram according to Embodiment 1 of the present application. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Example 1

[0051] like Figure 1 As shown, the present invention provides a component identification method based on directory retrieval, which includes the following basic steps:

[0052] S1. Perform directory modeling on the different components, obtain the component identification features of the different components, and determine the hierarchical structure features of the component's main directory based on the component feature file;

[0053] In this embodiment, it is necessary to perform directory modeling on different components in advance. First, the characteristic files of the components are determined. Under normal circumstances, each component has its own executable file (startup and shutdown file) and configuration file. Their file attributes are extracted as component identification features. Then, the hierarchical structure features of the component's main directory are determined. For different components, the packages they depend on and the naming rules of their directories are different. Although a single directory cannot be used as the basis for identifying the component type, the set of features of all subdirectories under its main directory is sufficient to be used as an important feature for identifying the component type, excluding malicious imitation of the component feature structure.

[0054] S2. Based on the hierarchical structure characteristics of the main directory, perform directory modeling for each component, obtain the component-specific feature imprint as unique verification information and perform the database entry operation, and establish a directory feature library based on the hierarchical structure characteristics of the main directory.

[0055] like Figure 2 As shown, in this embodiment, directory modeling prepares for establishing a directory feature library. The directory feature library is the capability pool of the component identification method; its identification strength depends on the completeness of the directory feature library. Each component generates a unique imprint through threat modeling. When this imprint is added to the library, a uniqueness verification is performed across the entire library. If the imprint already exists in the directory feature library and we confirm that this is indeed a new component, then we need to further refine the imprints of the two components to ensure they can be distinguished. The smallest structural unit of the target feature library is a single record. The directory feature imprint of the same component consists of multiple records. The credibility of component identification is indicated by the degree of matching across multiple records. Only when the minimum credibility is reached is the component identification considered reliable.

[0056] S3, catalog indexing is performed on the to-be-identified component, catalog features of the to-be-identified component are extracted, the catalog features are matched with component-specific feature marks in a catalog feature library, a credibility probability is obtained, and the to-be-identified component and a version thereof are identified;

[0057] As shown in the figure, Figure 3 In this embodiment, the catalog of the to-be-identified component is indexed, catalog features thereof are extracted, and the catalog features are matched with component marks in a catalog feature library to achieve the purpose of component identification. First, a B+ catalog index tree of all catalogs is created, then the position of the catalog is located according to the identifiable features of the component, then the component main catalog is located by reverse traversal of the catalog structure, and finally, all sub-catalogs and files under the catalog are recorded in the catalog index to generate an easily identifiable index hash code.

[0058] In this embodiment, general catalog traversal is from a parent catalog to a child catalog, and reverse traversal is from a child catalog to a parent catalog. The reverse traversal first determines a traversal starting point and a traversal range through a feature file specific to the component, then expands to traverse all nodes in the current level, then traverses up to a level, then expands to traverse all nodes in the current level, and so on, until the reverse traversal is completed at a specified level.

[0059] As shown in the figure, Figure 4 In this embodiment, the credibility of component identification is uniformly controlled by the compatibility control center, which quantitatively analyzes the catalog feature uniqueness probability and the catalog structure variability probability of the component, and derives the credibility probability from the two variables. The compatibility control center also controls the component catalog blacklist management, and will not create a catalog index for the catalog placed in the blacklist, and controls the level of the catalog index, and strictly controls the creation of invalid vertical indexes.

[0060] Version identification is an operation after component type identification, based on the version output of the executable file of each component, and the version information is extracted from the output.

[0061] Embodiment 2

[0062] The present application aims to identify a plurality of component types and versions on a target carrier. Before identification, the basic information of the target carrier needs to be obtained in advance. Here, a commonly used Linux host is taken as an example to implement a series of processes described in the present method.

[0063] In the embodiment, a remote login protocol is used to log in the target carrier (Linux host), a B+ tree cluster index is created for the directory of the target carrier, and the positions of the component feature file and the main directory in the cluster index are determined, wherein the position of the main directory is determined by backtracking of the feature file in the cluster index, a specified level is extended longitudinally from the main directory node to each word node in the cluster index, and the directories in the blacklist are ignored, so that each path extended is the record of the component feature library, and each record is hashed to create a temporary record combination.

[0064] In the embodiment, the reliability of each component to be identified is called from the compatibility control center, and the temporary hash record of the component to be identified is deeply matched with the record combination of the component directory feature library to obtain a matching rate, and finally all the obtained matching rates are ranked from high to low, and after excluding the components with a matching rate less than the reliability, the record combination of all the corresponding components with the highest ranking is the currently identified component type.

[0065] In the embodiment, after the component type is identified, the component version is extracted from the version information of the component executable file, and the general process and purpose of the method are achieved.

[0066] In summary, the tool and service extraction method extracts the common features of the tools and services, integrates the directory structure characteristics of each tool or service, and breaks through the technical bottleneck of the conventional identification technology in tool identification or identification of some special services based on the component directory structure retrieval component identification technology.

[0067] The application reasonably controls the calling directory modeling, the directory feature library, the directory index, the compatibility control center and the like to realize the identification of the component. The method can be used as a replacement method or a supplementary method of the conventional component identification method under certain conditions to make up for the lack of the tool identification capability or the identification stop state service capability of the conventional component identification method.

[0068] The application improves the accuracy of component identification by using the control parameters with an upper limit floating to identify the component through the establishment of the component directory feature library.

[0069] In the application, although a single directory cannot be used as a basis for identifying the component type, the collection of all the subdirectory features under the main directory is sufficient to be used as an important feature for identifying the component type under the condition that the maliciously imitated component feature structure is excluded.

[0070] The application uses the compatibility control center to control the component directory blacklist management, and the directory index of the directory placed in the blacklist will not be created, and the level of the directory index is controlled, and the invalid longitudinal index creation is strictly controlled.

[0071] The present application solves the technical problems of the prior art, i.e., the restriction of special service identification and the lack of identification ability of the identification method in specific scenarios.

[0072] The above examples are only used to illustrate the technical solutions of the present application, but not to limit the same; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that the technical solutions recorded in the foregoing examples can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A component identification method based on directory search, characterized by, The method comprises: S1, catalog modeling of the difference components, from which component identification features of the difference components are determined and extracted to obtain component feature files, from which component main catalog hierarchy features are determined; S2, catalog modeling of each of the components according to the component main catalog hierarchy features, to generate component-specific feature marks of each of the components, which are used as unique verification information, and according to the unique verification information, the component-specific feature marks are stored in a catalog feature library according to the main catalog hierarchy features; S3, catalog indexing of a component to be identified, from which catalog features of the component to be identified are extracted, which are used to perform a degree-of-confidence matching with the component-specific feature marks in the catalog feature library, from which a degree-of-confidence probability is obtained to identify the component to be identified, and the step S3 further comprises: S31, creating a B+ catalog index tree for the catalog; S32, performing a positioning operation according to the component-specific features and retrieving catalog indexes according to the B+ catalog index tree, from which an easily identifiable hash code of the component to be identified is obtained; S33, using a preset compatibility control center to regulate and process the easily identifiable hash code to obtain a component identification degree of confidence, to quantitatively analyze a catalog feature uniqueness probability and a catalog structure variability probability of the component to be identified, from which the degree-of-confidence probability is generated.

2. The component identification method based on catalog search according to claim 1, wherein, In the step S1, the feature files of the components include start-stop files and configuration files.

3. The component identification method based on catalog search according to claim 2, wherein, File attributes of the start-stop files and the configuration files of the components are extracted as component identification features.

4. The component identification method based on catalog search according to claim 1, wherein, The step S2 comprises: S21, generating the unique verification information in the catalog feature library when the component-specific feature marks are stored in the catalog feature library; S22, when the component-specific feature marks of a new component have been in the catalog feature library, refining not less than two of the component-specific feature marks.

5. The component identification method based on catalog search according to claim 1, wherein, In the step S2, a minimum structure unit of the target feature library is a single row of records, and the component-specific feature marks of the same component include not less than two rows of records.

6. The component identification method based on catalog search according to claim 1, wherein, The step S32 comprises: S321, positioning to obtain a component catalog location according to identifiable features of the component to be identified; S322, according to the main catalog hierarchy features, traversing a catalog structure in reverse to position to obtain a main catalog level of the component to be identified; S323, retrieving catalog indexes of all sub-catalogs and files under a current catalog to generate the easily identifiable hash code of the component to be identified.

7. The component identification method based on catalog search according to claim 1, wherein, In the step S33, a degree of matching of multiple rows of records is used to identify a degree of confidence of component identification, and when a minimum degree of confidence is reached, the identification of the component is recognized as reliable.

8. The component identification method based on catalog search according to claim 1, wherein, In the step S33, a component catalog blacklist of the component is processed by using the compatibility control center to regulate component catalog creation operations.

9. The component identification method based on catalog search according to claim 1, wherein, In the step S33, catalog index levels and longitudinal index creation information of the component are processed by using the compatibility control center to regulate catalog index level and longitudinal index creation operations.

10. A component identification system based on directory search, characterized by, The system comprises: The catalog level feature acquisition module is used to model the difference component, to determine and extract the component identification features of the difference component, to obtain the component feature file, to determine the component main catalog level structure features; The catalog feature library construction module is used to model the catalog of each component according to the component main catalog level structure features, to generate the component-specific feature imprint of each component, to serve as the unique verification information, to perform the library operation on the component-specific feature imprint according to the unique verification information, to establish the catalog feature library according to the main catalog level structure features, and the catalog feature library construction module is connected with the catalog level feature acquisition module; The component identification module is used to index the to-be-identified component, to extract the catalog features of the to-be-identified component, to perform the credibility matching with the component-specific feature imprint in the catalog feature library, to obtain the credibility probability, and to identify the to-be-identified component, and the component identification module is connected with the catalog feature library construction module, and the component identification module further comprises: The index tree creation module is used to create a B+ catalog index tree for the catalog; The positioning retrieval module is used to perform the positioning operation according to the component-specific features, to retrieve the catalog index according to the B+ catalog index tree, to obtain the easy-to-identify hash code of the to-be-identified component, and the positioning retrieval module is connected with the index tree creation module; The credibility acquisition module is used to utilize the preset compatibility control center to regulate and process the easy-to-identify hash code, to obtain the component identification credibility, to quantitatively analyze and obtain the catalog feature uniqueness probability and the catalog structure variability probability of the to-be-identified component, to generate the credibility probability, and the credibility acquisition module is connected with the positioning retrieval module.

Images