A method of application recognition and related devices
By obtaining the fixed text framework of the target application and utilizing preset matching rules and template libraries, the problem of not being able to identify keyword-free detection results in existing technologies is solved, and accurate application identification is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 国网思极网安科技(北京)有限公司
- Filing Date
- 2023-01-06
- Publication Date
- 2026-07-24
AI Technical Summary
In existing technologies, when identifying applications based on protocols, it is impossible to identify cases where keywords are not present in the detection results, resulting in services and applications being unable to be identified.
By obtaining a fixed text frame of the target application, and using preset matching rules and template libraries for matching, the type of the target application can be identified.
It achieves accurate identification of the type of target application without keyword detection results, overcoming the shortcomings of existing technologies.
Smart Images
Figure CN116304729B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method and related equipment for application identification. Background Technology
[0002] In related technologies, live asset and fingerprint detection tools such as nmap, zmap, and masscan mainly send probe messages based on protocols (network protocols and application protocols) to discover live assets and identify fingerprints of services and applications; they identify asset types and fingerprint information by accurately matching fingerprint database rules. However, the above technologies mainly identify and judge asset fingerprints and other information by responding to keywords. If the probe results do not contain keywords, it is impossible to extract fingerprint information of services and applications, which may lead to the problem that some services and applications cannot be identified. Summary of the Invention
[0003] In view of this, the purpose of this application is to propose a method and related equipment for application identification.
[0004] In view of the above objectives, firstly, this application provides an application identification method, the method comprising:
[0005] Obtain the target application and parse it to obtain the fixed text frame of the target application;
[0006] In response to the successful matching of the fixed text frame of the target application based on the first matching rule, the target application is identified through a preset matching model;
[0007] In response to the failure of the fixed text frame of the target application based on the first matching rule, the target application is identified through a preset template library.
[0008] Optionally, obtaining and parsing the target application to obtain its fixed text frame includes:
[0009] Use the detection engine to obtain the target application;
[0010] Remove the dynamic data of the target application, wherein the dynamic data includes numeric information, date information, version number information, parameters, and invisible character information;
[0011] Obtain the fixed text frame of the target application.
[0012] Optionally, the response to the fixed text frame of the target application succeeding based on the first matching rule includes:
[0013] The fixed text frame of the target application is parsed, word segmentation is performed on the fixed text frame of the target application, and at least one repeated phrase is obtained. The at least one repeated phrase is deduplicated and the phrase is used as the first keyword feature.
[0014] If the phrase is successfully retrieved, the first matching rule is successful.
[0015] Optionally, the preset template library includes:
[0016] Crawl internet content, remove dynamic data from the internet content, and obtain a fixed text frame of the internet content, wherein the dynamic data of the internet content includes numerical information, date information, version number information, and invisible character information;
[0017] The fixed text frame of the Internet content and the Internet content corresponding to the text frame of the Internet content are retained to form the preset template library.
[0018] Optionally, before identifying the target application through a preset matching model, the following steps are included:
[0019] The fixed text frame of the Internet content is parsed, word segmentation is performed on the fixed text frame of the Internet content, and at least one repeated phrase is obtained. The at least one repeated phrase is deduplicated and the phrase is obtained as a second keyword feature.
[0020] Optionally, identifying the target application through a preset matching model includes:
[0021] Input the first keyword feature and the second keyword feature, output the similarity between the first keyword feature and the second keyword feature, and also output the Internet content type corresponding to the second keyword feature.
[0022] Wherein, if the similarity between the first keyword feature and the second keyword feature is configured to be greater than 80%, then the target service and application corresponding to the first keyword feature are the same as the Internet content type corresponding to the second keyword feature.
[0023] Optionally, the step of identifying the target application through a preset template library in response to the failure of the fixed text frame for the target application based on the first matching rule includes:
[0024] If the acquisition of the phrase fails, then the first matching rule fails.
[0025] Match the fixed text frame of the target application to the template library. In response to the fixed text frame of the target application being consistent with the fixed text frame of Internet content in the template library, the type of the target application is consistent with the type of the Internet content.
[0026] Secondly, this application provides an application identification device, comprising:
[0027] The acquisition module is used to acquire the target application and, at the same time, acquire the fixed text frame of the target application;
[0028] The judgment module is used to determine whether the fixed text frame of the target application is successfully matched based on the first matching rule;
[0029] The storage module is used to store the preset template library and preset matching models.
[0030] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the program to implement the method described above.
[0031] Fourthly, this application provides a non-transitory computer-readable storage medium that stores computer instructions, characterized in that the computer instructions are used to cause a computer to execute the method described above.
[0032] As can be seen from the above, the application identification method and related equipment provided in this application utilize the fixed text framework of the target application, which does not change, and match it with the preset template library and preset matching model according to the first matching rule, thereby identifying the type of the target application. This overcomes the situation in related technologies where the detection results of the target application do not contain keywords, thus making it impossible to identify services and applications. Attached Figure Description
[0033] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0034] Figure 1 This is a flowchart illustrating an application identification method according to an embodiment of this application;
[0035] Figure 2 This is a schematic diagram illustrating the identification of target applications using a preset matching model, as described in an embodiment of this application.
[0036] Figure 3This is a schematic diagram of an application identification device according to an embodiment of this application;
[0037] Figure 4 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation
[0038] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.
[0039] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0040] Combination Figure 1 This application provides an application identification method, the method comprising:
[0041] S101. Obtain the target application and parse it to obtain the fixed text frame of the target application;
[0042] Specifically, when we want to identify a target application, we first use a detection engine to obtain the target application. This includes the detection engine sending a general detection data packet to the target application. Then, we obtain the target application's data information. Next, the detection engine analyzes the returned data information, checking if the protocol and version detection data packets match the engine's settings. The detection engine has pre-set version and protocol data for the target application. If either the protocol or version detection data packet matches the engine's settings, the target application is successfully matched and obtained. If neither the protocol nor version detection data packet matches the engine's pre-set version and protocol data, the attempt to obtain the target application is abandoned; that is, the target application in this case is not the one we are trying to identify.
[0043] Next, the target application is parsed, which means obtaining the fixed text frame of the target application. Specifically, the fixed text frame of the target application is obtained by removing the dynamic data added to the target application. What remains is the fixed text frame of the target application. In short, the fixed text frame is the foundation of the target application. The dynamic data removed includes numeric information, date information, version number information, parameters and invisible character information, etc. What remains is the fixed text frame of the target application.
[0044] It should be noted that the target applications mentioned in this application are not limited to application software, web pages, search engines, network services, email, online media, digital entertainment, e-commerce, etc.
[0045] S102. In response to the successful matching of the fixed text frame of the target application based on the first matching rule, the target application is identified through the preset matching model;
[0046] Specifically, the first matching rule has priority. Whether to identify the target application through the preset matching model depends on whether the fixed text frame of the target application successfully matches the first matching rule.
[0047] Further, refer to Figure 2 The process involves parsing the fixed text framework of the target application, performing word segmentation on the framework, and identifying at least one recurring phrase. This recurring phrase is then deduplicated, and the resulting phrase is used as the first keyword feature. In other words, the first matching rule checks if word segmentation and the acquisition of the first keyword feature are successful. If the first keyword feature can be obtained, the target application succeeds based on the first matching rule; otherwise, the matching fails. It's important to note that if multiple different phrases appear repeatedly, deduplication is performed on all repeated phrases, removing redundant phrases, and leaving one phrase from each set as the first keyword feature.
[0048] Furthermore, before identifying the target application through the preset matching model, the process includes: parsing the fixed text framework of the internet content, performing word segmentation calculation on the fixed text framework of the internet content, obtaining at least one recurring phrase, deduplicating the at least one recurring phrase, and obtaining the phrase as the second keyword feature. It should be noted that when multiple recurring phrases appear, the acquisition of the second keyword feature is the same as that of the first keyword feature, and will not be elaborated here.
[0049] Furthermore, in the matching model, the first keyword feature and the second keyword feature are input, and the similarity between the first keyword feature and the second keyword feature is output. Simultaneously, the internet content type corresponding to the second keyword feature is also output, for example, for... Figure 2 The webpage shown is identified by extracting second keyword features from the fixed text frame of the webpage. These second keyword features include...
[0050]
[0051] <title> 301Moved
[0052] Permanently< / title>
[0053]
[0054] <center> <h1>301Moved
[0055] Permanently< / h1> < / center>
[0056] <hr> <center>< / center>
[0057]
[0058]
[0059] If the webpage content corresponding to these second keywords is determined to be nginx, then the first keyword is extracted from the target webpage. If the similarity between the first keyword and the second keyword is greater than 80%, then the target webpage is also identified as the nginx framework by the preset matching model.
[0060] S103. In response to the failure of the fixed text frame of the target application based on the first matching rule, the target application is identified through the preset template library.
[0061] Furthermore, the preset template library includes methods for crawling internet content, removing dynamic data, and obtaining fixed text frames for the internet content. This means that crawling internet content ensures the identification of its type. Both the target application and the internet content share a common fixed text frame. If the first matching rule fails, the fixed text frame of the target application can be matched against the fixed text frame of the internet content. If the fixed text frame of the target application matches the fixed text frame of the internet content, then the target application and the corresponding internet content are identical. Therefore, directly reading the fixed text frame of the internet content and its corresponding content from the preset template library reveals the target application, thus achieving the effect of identifying the target application and its category.
[0062] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.
[0063] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0064] Based on the same technical concept, corresponding to any of the above embodiments, this application also provides an application identification device.
[0065] refer to Figure 3 The application identification device includes:
[0066] The acquisition module 301 is used to acquire the target application and the fixed text frame of the target application.
[0067] The judgment module 302 is used to determine whether the fixed text frame of the target application is successfully matched based on the first matching rule;
[0068] Storage module 303 is used to store the preset template library and preset matching model.
[0069] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.
[0070] The apparatus of the above embodiments is used to implement the corresponding application identification method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.
[0071] Based on the same technical concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the application identification method described in any of the above embodiments.
[0072] Figure 4This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.
[0073] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.
[0074] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.
[0075] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.
[0076] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).
[0077] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.
[0078] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.
[0079] The electronic devices described above are used to implement the corresponding application identification methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.
[0080] Based on the same technical concept, corresponding to any of the above embodiments, this application also provides
[0081] A non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the applications described in any of the above embodiments.
[0082] The identification method.
[0083] The computer-readable medium in this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), and dynamic random access memory.
[0084] DRAM, other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, read-only optical disc read-only memory (CD-ROM), digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices or any other non-transfer medium, 5 can be used to store information that can be accessed by computing devices.
[0085] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the application identification method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.
[0086] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples;
[0087] Under the same approach, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in detail for the sake of brevity.
[0088] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided in Figure 5. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should...).
[0089] (As is fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that embodiments of this application may be practiced without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.
[0090] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.
[0091] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.
Claims
1. A method for application recognition, characterized in that, The method includes: The target application is obtained using a detection engine; dynamic data of the target application, including numerical information, date information, version number information, parameters, and invisible character information, is removed; a fixed text frame of the target application is obtained; the target application is obtained by analyzing whether the protocol detection data packets and version detection data packets of the application's data information match the detection engine. The fixed text framework of the target application is parsed, word segmentation is performed on the fixed text framework of the target application, and at least one repeated phrase is obtained. The at least one repeated phrase is deduplicated and the phrase is used as the first keyword feature. In response to the successful acquisition of the phrase, the first matching rule is successful. The target application is identified by a preset matching model. In response to the failure of the fixed text frame of the target application based on the first matching rule, the target application is identified through a preset template library.
2. The method according to claim 1, characterized in that, The preset template library includes: Crawl internet content, remove dynamic data from the internet content, and obtain a fixed text frame of the internet content, wherein the dynamic data of the internet content includes numerical information, date information, version number information, and invisible character information; The fixed text frame of the Internet content and the Internet content corresponding to the text frame of the Internet content are retained to form the preset template library.
3. The method according to claim 2, wherein before identifying the target application through a preset matching model, the following steps are taken: The fixed text frame of the Internet content is parsed, word segmentation is performed on the fixed text frame of the Internet content, and at least one repeated phrase is obtained. The at least one repeated phrase is deduplicated and the phrase is obtained as a second keyword feature.
4. The method according to claim 3, characterized in that, The step of identifying the target application through a preset matching model includes: Input the first keyword feature and the second keyword feature, output the similarity between the first keyword feature and the second keyword feature, and also output the Internet content type corresponding to the second keyword feature. Wherein, if the similarity between the first keyword feature and the second keyword feature is configured to be greater than 80%, then the target service and application corresponding to the first keyword feature are the same as the Internet content type corresponding to the second keyword feature.
5. The method according to claim 1, characterized in that, The method of responding to the fixed text frame of the target application by identifying the target application through a preset template library after the first matching rule fails includes: If the acquisition of the phrase fails, then the first matching rule fails. Match the fixed text frame of the target application to the template library. In response to the fixed text frame of the target application being consistent with the fixed text frame of Internet content in the template library, the type of the target application is consistent with the type of the Internet content.
6. An application identification device, comprising: The acquisition module is used to acquire the target application using the detection engine. The dynamic data of the target application is removed, including numerical information, date information, version number information, parameters, and invisible character information; at the same time, the fixed text frame of the target application is obtained; the target application is obtained by analyzing whether the protocol probe data packets and version probe data packets of the application's data information match the probe engine; The judgment module is used to parse the fixed text frame of the target application, perform word segmentation calculation on the fixed text frame of the target application, and obtain at least one repeated phrase, remove duplicates from the at least one repeated phrase and obtain the phrase as a first keyword feature; and determine whether the fixed text frame of the target application is successfully matched based on the first matching rule based on whether the phrase is successfully obtained. The storage module is used to store the preset template library and preset matching models.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.
8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method as described in any one of claims 1 to 5.