Intranet asset identification method and device, electronic equipment and storage medium

Abstract

The application provides an intranet asset identification method and device, electronic equipment and a storage medium, and relates to the technical field of information security. The method identifies the intranet IP segment in the traffic by combining the port information and the IP information carried by the traffic. The device corresponding to the intranet IP segment is the intranet asset. Thus, the identification of the intranet asset is realized. Since the IP information and the port information can better reflect the communication characteristics of the device (that is, the communication characteristics between the devices in the intranet can be represented by the IP information and the port information), the method is suitable for any local area network communication environment (including a public network segment private scenario). Therefore, the intranet asset can be effectively identified based on the two information. The present application does not rely on the network segment to identify the intranet asset. Compared with the existing method of identifying the intranet asset only according to the network segment, the identification method of the application can more comprehensively and accurately identify the intranet asset.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to an intranet asset identification method, device, electronic device, and storage medium. Background Technology

[0002] In recent years, with the widespread adoption of internet applications and the increasing volume of network traffic, security incidents have become possible, thus creating security risks. In an enterprise security operations system, asset security is the foundation of all security. Therefore, the identification of internal network assets is particularly important.

[0003] Currently, the identification of intranet assets is generally based on network segments. For example, some intranet segments belonging to intranet assets are pre-defined, and then intranet assets are identified based on these intranet segments. However, this method is not applicable to scenarios where public network segments are used privately. In other words, it cannot identify intranet assets in such scenarios, making it impossible to identify intranet assets comprehensively and accurately. Summary of the Invention

[0004] The purpose of this application is to provide an intranet asset identification method, device, electronic device, and storage medium to improve the problem that existing identification methods cannot comprehensively and accurately identify intranet assets.

[0005] In a first aspect, embodiments of this application provide an intranet asset identification method, the method comprising:

[0006] Obtain the port and IP information carried by the traffic;

[0007] Based on the port information and the IP information, the internal network IP segment in the traffic is identified, and the device corresponding to the internal network IP segment is identified as an internal network asset.

[0008] In the above implementation process, the internal network IP segment in the traffic is identified by combining the port information and IP information carried by the traffic. The device corresponding to the internal network IP segment is the internal network asset. This method of identifying internal network assets is applicable to any local area network communication environment (including scenarios where public network segments are used privately) because IP information and port information better reflect the communication characteristics of the devices (i.e., the communication characteristics between devices in the internal network can be characterized by IP information and port information). Therefore, internal network assets can be effectively identified based on these two pieces of information. This solution does not rely on network segments for internal network asset identification. Compared with the existing method of identifying internal network assets based solely on network segments, the identification method of this application can identify internal network assets more comprehensively and accurately.

[0009] Optionally, identifying the intranet IP segment in the traffic based on the port information and the IP information includes:

[0010] Count the number of destination ports corresponding to the same destination IP in the traffic, and count the number of source IPs corresponding to the same destination IP in the traffic;

[0011] Based on the number of ports and the number of IPs, identify the internal network IP segments in the traffic.

[0012] In the above implementation process, combining the number of ports and the number of IPs to identify internal network assets can improve the accuracy of internal network asset identification.

[0013] Optionally, identifying the intranet IP segment in the traffic based on the number of ports and the number of IPs includes:

[0014] If the destination port corresponding to the same destination IP does not match the port whitelist, and the number of ports is greater than the first threshold, then the destination IP and the corresponding IP C segment are cached in the port identification table.

[0015] If the number of source IPs corresponding to the same destination IP is greater than the second threshold, and the average three-way handshake time of the packets corresponding to the destination IP is greater than the third threshold, then the IP C segment of the destination IP is cached in the IP identification table.

[0016] If the IP identification table and the port identification table contain the same IP C segment, then the same IP C segment is determined to be the first internal network IP segment.

[0017] In the above implementation process, if an IP C segment hits both the IP identification table and the port identification table, it indicates that the IP C segment is indeed an internal network IP segment. In other words, identifying internal network IP segments based on a combination of IP and port is more accurate.

[0018] Optionally, after caching the destination IP and IP C segment corresponding to the destination port into the port identification table, the method further includes:

[0019] If different destination IPs in the port identification table have the same IP address segment (ICC), then that ICC segment is identified as the second internal network IP segment. Generally, devices within an internal network share the same ICC segment; therefore, if different destination IPs have the same ICC segment, it can be considered an internal network IP segment.

[0020] Optionally, the method further includes:

[0021] If the destination port matches the port whitelist, then the IP C segment of the destination IP corresponding to the destination port is determined to be the third internal network IP segment;

[0022] If the average of the three handshake times is less than or equal to the third threshold, then the IP C segment of the same destination IP is determined to be the fourth internal network IP segment.

[0023] In the above implementation process, the port whitelist contains some default ports, which are generally internal network ports. Therefore, if a port is matched by the whitelist, it is considered to be an internal network IP segment. Generally, the three-way handshake time for communication between devices on an internal network is relatively short. Therefore, if the average of the three-way handshake times is less than a threshold, it is determined to be an internal network IP segment.

[0024] Optionally, if the destination port matches the port whitelist, then the IP C segment of the destination IP corresponding to the destination port is determined to be a third internal network IP segment, including:

[0025] If the destination port matches the system's fixed port whitelist, then the IP C segment corresponding to the destination port is determined to be the third internal network IP segment;

[0026] If the destination port matches the software's default port whitelist and the number of ports corresponding to the destination IP is greater than the fourth threshold, then the IP C segment of the destination IP is determined to be the third intranet IP segment.

[0027] In the above implementation process, if the port matches the software's default port whitelist, the number of ports is then used for judgment. This is because the ports in the software's default port whitelist are dynamic ports that can be customized by the user, so combining the number of ports can more accurately identify the internal network IP segment.

[0028] Optionally, the method further includes:

[0029] The IP C segments with the same IP B segment in the internal network IP segment are expanded according to the upper and lower limits, and the expanded IP C segments are saved to the IP C segment table. The internal network IP segments include the first internal network IP segment, the second internal network IP segment, the third internal network IP segment, and the fourth internal network IP segment.

[0030] The IP C segment in the IP C segment table is determined to be the final internal network IP segment.

[0031] In the above implementation process, by expanding the IP C segment with the same IP B segment in the internal network IP segment, while ensuring that the expanded IP C segment is an internal network IP segment, more internal network IP segments can be identified.

[0032] Optionally, after saving the expanded IPC segment to the IPC segment table, the method further includes:

[0033] The third intranet IP segment, the fourth intranet IP segment, the port identification table, and the corresponding traffic information in the IP identification table are cached in a temporary identification table;

[0034] Extract the IP C segments of all source IPs and the occurrence count of each IP C segment from the temporary identification table and add them to the IP master table;

[0035] The IP segment table is compared with the total IP table, and the same IP segments that appear most frequently are selected according to a preset proportion. The selected IP segments are then cached in the intranet IP segment table.

[0036] The IP C segment in the internal network IP segment table is determined to be the final internal network IP segment.

[0037] In the above implementation process, by filtering the IP C segments in the temporary identification table, the real internal network IP segments can be filtered out, thereby enabling more accurate identification of internal network assets.

[0038] Optionally, after caching the selected IP C segments into the internal network IP segment table, the method further includes:

[0039] Extract all destination IPs from the temporary identification table and add them to the destination IP table;

[0040] If the IP C segment corresponding to the destination IP in the temporary identification table is in the intranet IP segment table, then the source IP corresponding to the destination IP will be compared with the destination IP table.

[0041] If the source IP is in the destination IP table, then the IP C segment corresponding to the source IP is saved to the IP C segment table.

[0042] In the above implementation process, by combining the destination IP table, it is possible to identify whether the IP C segment corresponding to the source IP in the temporary identification table is an internal network IP segment, thereby expanding the identification range of internal network IP segments and achieving the effect of automatic clustering. This not only enhances the accuracy of internal network asset identification but also improves the comprehensiveness of internal network asset identification.

[0043] Secondly, embodiments of this application provide an intranet asset identification device, the device comprising:

[0044] The information acquisition module is used to acquire port information and IP information carried by traffic;

[0045] The identification module is used to identify the intranet IP segment in the traffic based on the port information and the IP information, and to identify the device corresponding to the intranet IP segment as an intranet asset.

[0046] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the method provided in the first aspect above are performed.

[0047] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method provided in the first aspect above.

[0048] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating an intranet asset identification method provided in this application embodiment;

[0051] Figure 2 A structural block diagram of an intranet asset identification device provided in this application embodiment;

[0052] Figure 3 This is a schematic diagram of the structure of an electronic device for performing an intranet asset identification method, provided as an embodiment of this application. Detailed Implementation

[0053] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0054] It should be noted that the terms "system" and "network" in the embodiments of this invention can be used interchangeably. "Multiple" refers to two or more; therefore, in the embodiments of this invention, "multiple" can also be understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0055] This application provides a method for identifying intranet assets. This method identifies intranet IP segments in traffic by combining port information and IP information carried by the traffic. The devices corresponding to these intranet IP segments are the intranet assets. This method achieves the identification of intranet assets. Since IP information and port information better reflect the communication characteristics of devices (i.e., the communication characteristics between devices in the intranet can be characterized by IP information and port information), it is applicable to any local area network communication environment (including scenarios where public network segments are used privately). Therefore, intranet assets can be effectively identified based on these two pieces of information. This solution does not rely on network segments for intranet asset identification. Compared with existing methods that only identify intranet assets based on network segments, the identification method of this application can identify intranet assets more comprehensively and accurately.

[0056] Please refer to Figure 1 , Figure 1 A flowchart of an intranet asset identification method provided in this application embodiment is included, the method comprising the following steps:

[0057] Step S110: Obtain the port information and IP information carried by the traffic.

[0058] The execution entity of the intranet asset identification method in this application embodiment can be a collection device deployed in the intranet, such as a sensor. This sensor can be used to collect network traffic, and it can be strategically deployed in multiple locations within the network to collect as comprehensive network traffic as possible. Alternatively, the collection device can be a device such as a firewall. These devices can collect network traffic, identify intranet IP segments within the traffic, and thus determine which devices are intranet assets. Subsequent security checks and other operations can then be performed on these intranet assets. For ease of description, the term "collection device" will be used as a general term in the following embodiments.

[0059] The traffic here can be real-time traffic or cached traffic. For example, the acquisition device can cache the acquired traffic and then identify internal network assets from the cached traffic at regular intervals.

[0060] Traffic consists of a large number of packets, which carry port information and IP information, i.e., four-tuple information, including source port, source IP address, destination port, and destination IP address. The port information includes the source port and destination port as well as the corresponding statistical information of these ports, such as the number of ports. The IP information includes the source IP address and destination IP address as well as the corresponding statistical information of these IP addresses, such as the IP Class C segment corresponding to these IP addresses and the number of IPs.

[0061] Step S120: Based on the port information and IP information, identify the internal network IP segment in the traffic, and determine the device corresponding to the internal network IP segment as an internal network asset.

[0062] Among them, the devices corresponding to the internal network IP range are the internal network assets. Since port information and IP information can characterize the communication characteristics between devices, for example, for devices in the internal network, their communication ports may be fixed or some default ports, and their IP information also has certain patterns. Therefore, based on these two types of information, it is possible to distinguish which traffic is communication traffic between internal network devices and which traffic is external traffic, thereby achieving accurate identification of internal network assets.

[0063] In the above implementation process, the internal network IP segment in the traffic is identified by combining the port information and IP information carried by the traffic. The device corresponding to the internal network IP segment is the internal network asset. This method of identifying internal network assets is applicable to any local area network communication environment (including scenarios where public network segments are used privately) because IP information and port information better reflect the communication characteristics of the devices (i.e., the communication characteristics between devices in the internal network can be characterized by IP information and port information). Therefore, internal network assets can be effectively identified based on these two pieces of information. This solution does not rely on network segments for internal network asset identification. Compared with the existing method of identifying internal network assets based solely on network segments, the identification method of this application can identify internal network assets more comprehensively and accurately.

[0064] Based on the above embodiments, the identification of internal network IP segments in traffic is based on port information and IP information, specifically including:

[0065] The system counts the number of destination ports corresponding to the same destination IP in the traffic, as well as the number of source IPs corresponding to the same destination IP in the traffic. Based on the number of ports and IPs, it identifies the internal network IP segments in the traffic.

[0066] Here's an example of port count statistics: For instance, cached traffic contains 50 packets, each with a destination IP and a destination port. The goal is to count the number of ports corresponding to these destination IPs. When counting, only one port is counted for each destination IP (e.g., if three packets all have the destination IP 195.1.1.1, and their corresponding destination ports are 20, 20, and 23, then destination port 20 is counted only once, resulting in a port count of 2). Essentially, this count represents the number of port types corresponding to the same destination IP, so the total port count should be less than or equal to 50. Therefore, the port count for each destination IP can be counted. For example, the count might show that the destination IP 195.1.1.1 has 2 ports, the destination IP 195.1.1.2 has 3 ports, and so on.

[0067] For example, if the cached traffic contains 50 packets, we can obtain the destination IPs from these 50 packets. If the number of destination IPs obtained is less than or equal to 50, for example, if there are a total of 30 destination IPs (some packets may have the same destination IP), then we can count the number of source IPs corresponding to each of these 30 destination IPs. For example, if the destination IP is 195.1.1.1, and 10 packets in the 50 packets have this destination IP, then the number of source IPs corresponding to this destination IP is 10. In this way, we can obtain the number of source IPs corresponding to each destination IP.

[0068] During the specific identification process, if the destination port corresponding to the same destination IP does not match the port whitelist, and the number of corresponding ports is greater than the first threshold, then the destination IP and the corresponding IP C segment are cached in the port identification table; if the number of source IPs corresponding to the same destination IP is greater than the second threshold, and the average three-way handshake time of the packets corresponding to the destination IP is greater than the third threshold, then the IP C segment of the destination IP is cached in the IP identification table; if the IP identification table and the port identification table contain the same IP C segment, then the same IP C segment is determined to be the first internal network IP segment.

[0069] The port whitelist is preset and includes information on some fixed ports, such as ports used for specific system purposes (e.g., ports 21, 22, 23), and default ports used by commonly used software (e.g., ports 1158, 1433). If the destination port does not match the port whitelist, it can be preliminarily determined that the destination IP address may not be within the internal network IP range. Further judgment is needed based on other information. Specifically, it is necessary to determine whether the number of ports exceeds a first threshold (the value of the first threshold can be flexibly set according to the actual situation). If so, the destination IP address and the IP address range can be cached in the port identification table. This is because generally only internal network devices provide multiple services, so the same IP address may correspond to a large number of ports. Therefore, it can be temporarily cached in the port identification table (here, the port identification table can be temporarily recorded as PORT_c_internal), and further judgment can be made later in conjunction with the IP identification table.

[0070] If the number of IPs exceeds the second threshold (the specific value of the second threshold can be flexibly set according to the actual situation), it indicates that the device corresponding to the destination IP is very likely also an internal network device. Then, obtain the average of the three-way handshake time (the average can be calculated in real time or calculated in advance and obtained directly when needed). The three-way handshake time determination can be used as an auxiliary determination for internal network asset identification. Generally speaking, the handshake time of devices within a local area network is relatively short. If the average is greater than the third threshold (the value of the third threshold can be flexibly set according to the actual situation), it indicates that the device corresponding to the destination IP may be an internal network asset. The IP C segment of the destination IP can be temporarily cached in the IP identification table and further determined in conjunction with the port identification table later.

[0071] The port identification table contains destination IPs and IP address ranges, while the IP identification table caches some IP address ranges. Devices corresponding to these destination IPs and IP address ranges can be considered potential internal network assets. Therefore, combining these two tables further refines the identification of internal network assets. If the IP identification table and the port identification table contain the same IP address range—for example, searching the port identification table for an IP address range identical to one in the IP identification table, or vice versa—then these identical IP address ranges can be identified as the first internal network IP range. In other words, the devices corresponding to these identical IP address ranges can be considered internal network assets.

[0072] In the above implementation process, if an IP C segment hits both the IP identification table and the port identification table, it indicates that the IP C segment is indeed an internal network IP segment. In other words, identifying internal network IP segments based on a combination of IP and port is more accurate.

[0073] In addition, the port identification table stores the destination IP and the corresponding IP C segment. If different destination IPs have the same IP C segment, they can be considered as internal network IP segments. Therefore, if there are different destination IPs with the same IP C segment in the port identification table, the IP C segment can be identified as the second internal network IP segment, and the device corresponding to the second internal network IP segment can be considered as an internal network asset.

[0074] For example, in the port identification table, there is a destination IP: 10.1.1.2, whose corresponding IP C segment is 1. If there are two other different destination IPs: 10.1.1.3 and 10.1.1.4, and the IP C segment of these two destination IPs is also 1, then this IP C segment (1) can be considered an internal network IP segment. Of course, in this statistical analysis, it means that at least two different destination IPs correspond to the same IP C segment. Only then is the IP C segment an internal network IP segment; otherwise, it is not an internal network IP segment. Alternatively, a quantity threshold can be added here. For example, if the number of different destination IPs corresponding to the same IP C segment is greater than a certain threshold (this threshold can be set to 3 or 4, etc., depending on the actual situation), then the IP C segment is determined to be an internal network IP segment.

[0075] The above embodiments illustrate how, when the destination port does not match the port whitelist, the number of ports is used to further identify the internal network IP segment. However, if the destination port matches the port whitelist, the IP segment corresponding to the destination port can be determined as the third internal network IP segment, and the device corresponding to this third internal network IP segment can be considered an internal network asset. Here, the IP segment refers to the IP segment of the destination IP corresponding to the destination port.

[0076] In practice, the port whitelist can be further subdivided, for example, into a system fixed port whitelist and a software default port whitelist. The ports in the system fixed port whitelist are system default ports, which are generally not arbitrarily tampered with (such as SSH connection services, printer services, etc.). Therefore, if the destination port matches the system fixed port whitelist, it can be determined that the IP segment corresponding to the destination port is a third-party internal network IP segment.

[0077] The ports in the software's default port whitelist are some dynamic ports that can be customized by the user. Therefore, it is necessary to add a quantity judgment for greater accuracy. So if the destination port matches the software's default port whitelist and the number of ports of the destination IP corresponding to the destination port is greater than the fourth threshold (the specific value of this threshold can be flexibly set according to the actual situation), then the IP C segment of the destination IP is determined to be the third internal network IP segment.

[0078] For example, if a destination port is 1158 and this destination port 1158 matches the software's default port whitelist, then the number of ports corresponding to the destination IP (e.g., 10.1.1.1) in the traffic is counted. That is, the number of ports corresponding to the destination IP (10.1.1.1) in the traffic is counted (e.g., if the destination ports corresponding to this destination IP include 1158, 1433, and 1642, then the number of ports is 3). If the number of ports corresponding to the destination IP (10.1.1.1) is greater than the fourth threshold, then the IP C segment of the destination IP (10.1.1.1) is considered as an internal network IP segment; otherwise, it is considered not to be an internal network IP segment.

[0079] In addition, when identifying based on IP information, if the number of source IPs corresponding to the same destination IP is greater than the second threshold, the average of the three-way handshake time of the packets corresponding to that destination IP is calculated. If the average is less than or equal to the third threshold, the IP C segment of the same destination IP is determined to be the fourth internal network IP segment (because the three-way handshake time of internal network devices is generally relatively short, so if the average is less than or equal to the third threshold, it can be determined to be an internal network asset).

[0080] In the above implementation process, the port whitelist contains some default ports, which are generally internal network ports. Therefore, if a port is matched by the whitelist, it is considered to be an internal network IP segment. Generally, the three-way handshake time for communication between devices on an internal network is relatively short. Therefore, if the average of the three-way handshake times is less than a threshold, it is determined to be an internal network IP segment.

[0081] Based on the above embodiments, the first, second, third, and fourth internal network IP segments were identified. The devices corresponding to these internal network IP segments can all be considered internal network assets. However, in reality, there may be more internal network IP segments that have not been identified. Therefore, internal network IP segments can be further identified in the following ways:

[0082] The IP C segments with the same IP B segment in the internal network IP segment are expanded according to the upper and lower limits. The expanded IP C segments are stored in the IP C segment table. The internal network IP segments here include the first internal network IP segment, the second internal network IP segment, the third internal network IP segment and the fourth internal network IP segment mentioned above. Then, the IP C segments in the IP C segment table are determined as the final internal network IP segments.

[0083] For ease of description, we can denote all IP segments contained in the first, second, third, and fourth internal network IP segments as white_current_ip (i.e., internal network IP segments). Then, we count all IP C segments stored in white_current_ip, excluding the IP addresses themselves. For IP C segments with the same IP B segment, we expand the C segment according to upper and lower limits. For example, if the IP addresses 10.1.1.1 and 10.1.6.6 have the same IP B segment, we can expand their IP C segments according to upper and lower limits. Specifically, the expansion method can be from 10.1.1.x to 10.1.6.x. For example, the expanded IP C segments include 10.1.2.x, 10.1.3.x, 10.1.4.x, and 10.1.5.x. In other words, we expand the IP C segments from the smallest to the largest IP C segment in white_current_ip.

[0084] The reason for this expansion is that the IP C segments in the IP C segment table can already be identified as internal network IP segments. Therefore, the IP C segments obtained by expanding in the above way should also be internal network IP segments. This can expand the internal network IP segments, increase the identification range of internal network IP segments, and, on the basis of ensuring that the expanded IP C segments are internal network IP segments, can achieve the identification of more internal network IP segments.

[0085] In some implementations, to make the identification more accurate, the number of IP C segments with the same IP B segment can be counted. If the number exceeds a specified threshold, expansion is performed. This is because if the number exceeds the specified threshold, it indicates that there are a large number of these IP C segments, and it is highly likely that only internal network devices can provide so many services. Therefore, the expanded IP C segments are more likely to be internal network IP segments, thus improving the accuracy of internal network IP segment expansion.

[0086] Based on the above embodiments, in order to further improve the accuracy of internal network IP segment identification, after expanding the IP C segment, the traffic information of the third internal network IP segment, the fourth internal network IP segment, the port identification table, and the corresponding four-tuple in the IP identification table can be cached in a temporary identification table. Then, the IP C segments of all source IPs and the occurrence count of each IP C segment are extracted from the temporary identification table and added to the IP total table. The IP C segment table is compared with the IP total table, and the IP C segments with the same occurrence count at the top of the preset proportion are selected. The selected IP C segments are cached in the internal network IP segment table, and then the IP C segments in the internal network IP segment table are determined as the final internal network IP segments.

[0087] For ease of description, the aforementioned temporary identification table can be denoted as ip_all_info. ip_all_info stores corresponding traffic information, including four-tuple information. Therefore, the IP C segments of all source IPs, along with the frequency of occurrence of these IP C segments, can be extracted from ip_all_info and stored in the IP master table, denoted as all_src_ip_c_dict. For example, if a source IP extracted from ip_all_info is 195.1.1.1, its corresponding IP C segment is 195.1.1.x. Then, the frequency of occurrence of 195.1.1.x in ip_all_info can be counted, for example, 5 times. The correspondence between 195.1.1.x and 5 can then be stored in all_src_ip_c_dict.

[0088] The IP C segment table includes some expanded IP C segments. This table can be denoted as white_ip_c. Compare white_ip_c with all_src_ip_c_dict to filter out identical IP C segments (those with overlap). Then, retrieve the occurrence count of these identical IP C segments from all_src_ip_c_dict. Filter out the IP C segments with the highest occurrence counts (a predetermined percentage, such as the top 50%) and cache them in the intranet IP segment table, denoted as intranet_c_top. For example, sort these identical IP C segments by occurrence count in descending order and store the top 50% in intranet_c_top. Alternatively, store IP C segments with occurrence counts greater than a preset number (also adjustable, such as 3) in intranet_c_top.

[0089] The reason for this screening is that if an IP address within a C-segment corresponds to a device that is both a server and a client, then it is considered an internal network device. Furthermore, the C-segments that appear in the top 50% of the times are more likely to be internal network IP segments. Here, 50% is a threshold; the lower the threshold, the higher the probability that it is an internal network IP segment.

[0090] Based on the above embodiments, in order to identify more intranet IP segments, such as an intranet asset that acts as both a server and a client, its IP C segment is an intranet IP segment. Therefore, in order to identify intranet assets in this scenario, all destination IPs can be extracted from the temporary identification table and added to the destination IP table. If the IP C segment corresponding to the destination IP in the temporary identification table is in the intranet IP segment table, the source IP corresponding to the destination IP is compared with the destination IP table. If the source IP is in the destination IP table, the IP C segment corresponding to the source IP is saved to the IP C segment table. The IP C segment in the IP C segment table is the final intranet IP segment.

[0091] The destination IP is denoted as all_dst_ip. If the IP C segment of the destination IP in ip_all_info is in the internal network IP segment table, then all source IPs connected to the destination IP are compared with the destination IP table all_dst_ip. If the source IP is in all_dst_ip, then the IP C segment of this source IP is considered to be an internal network IP segment, and it is saved to the IP C segment table.

[0092] Then, the IP C segment in white_current_ip is updated every once in a while, and the above steps of expanding the IP C segment are repeated until the process of "saving the IP C segment corresponding to the source IP to the IP C segment table" is completed. In this way, the internal network IP segment can be re-identified and expanded every once in a while.

[0093] In the above implementation process, by combining the destination IP table, it is possible to identify whether the IP C segment corresponding to the source IP in the temporary identification table is an internal network IP segment, thereby expanding the identification range of internal network IP segments and achieving the effect of automatic clustering. This not only enhances the accuracy of internal network asset identification but also improves the comprehensiveness of internal network asset identification.

[0094] Please refer to Figure 2 , Figure 2 This is a structural block diagram of an intranet asset identification device 200 provided in an embodiment of this application. The device 200 can be a module, program segment, or code on an electronic device. It should be understood that this device 200 is similar to the one described above. Figure 1 The method implementation corresponds to this and can be executed. Figure 1 The various steps involved in the method embodiment and the specific functions of the device 200 can be found in the description above. To avoid repetition, detailed descriptions are omitted here.

[0095] Optionally, the device 200 includes:

[0096] The information acquisition module 210 is used to acquire port information and IP information carried by traffic;

[0097] The identification module 220 is used to identify the intranet IP segment in the traffic based on the port information and the IP information, and to identify the device corresponding to the intranet IP segment as an intranet asset.

[0098] Optionally, the identification module 220 is used to count the number of destination ports corresponding to the same destination IP in the traffic, and to count the number of source IPs corresponding to the same destination IP in the traffic; based on the number of ports and the number of IPs, it identifies the intranet IP segment in the traffic.

[0099] Optionally, the identification module 220 is configured to cache the destination IP and its corresponding IP C segment in the port identification table if the destination port corresponding to the same destination IP does not match the port whitelist and the number of ports is greater than a first threshold; if the number of source IPs corresponding to the same destination IP is greater than a second threshold and the average three-way handshake time of the packets corresponding to the destination IP is greater than a third threshold, then cache the IP C segment of the destination IP in the IP identification table; if the IP identification table and the port identification table contain the same IP C segment, then the same IP C segment is determined to be the first intranet IP segment.

[0100] Optionally, the identification module 220 is used to determine that the IPC segment is the second internal network IP segment if there are different destination IPs with the same IPC segment in the port identification table.

[0101] Optionally, the identification module 220 is configured to determine the IP C segment of the destination IP corresponding to the destination port as the third intranet IP segment if the destination port matches the port whitelist; and to determine the IP C segment of the same destination IP as the fourth intranet IP segment if the average of the three handshake times is less than or equal to the third threshold.

[0102] Optionally, the identification module 220 is used to determine that the IP C segment corresponding to the destination port is the third intranet IP segment if the destination port matches the system fixed port whitelist; and to determine that the IP C segment of the destination IP is the third intranet IP segment if the destination port matches the software default port whitelist and the number of ports of the destination IP corresponding to the destination port is greater than a fourth threshold.

[0103] Optionally, the identification module 220 is used to expand the IP C segments with the same IP B segment in the internal network IP segment according to the upper and lower limits, and save the expanded IP C segments to the IP C segment table. The internal network IP segment includes the first internal network IP segment, the second internal network IP segment, the third internal network IP segment, and the fourth internal network IP segment; and determine the IP C segment in the IP C segment table as the final internal network IP segment.

[0104] Optionally, the identification module 220 is configured to cache the traffic information corresponding to the third intranet IP segment, the fourth intranet IP segment, the port identification table, and the IP identification table into a temporary identification table; extract the IP C segments of all source IPs and the occurrence count of each IP C segment from the temporary identification table into the total IP table; compare the IP C segment table with the total IP table, filter out the IP C segments with the same occurrence count at the top of the preset proportion, and cache the filtered IP C segments into the intranet IP segment table; and determine the IP C segments in the intranet IP segment table as the final intranet IP segments.

[0105] Optionally, the identification module 220 is used to extract all destination IPs from the temporary identification table into the destination IP table; if the IP C segment corresponding to the destination IP in the temporary identification table is in the intranet IP segment table, then the source IP corresponding to the destination IP is compared with the destination IP table; if the source IP is in the destination IP table, then the IP C segment corresponding to the source IP is saved to the IP C segment table.

[0106] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0107] Please refer to Figure 3 , Figure 3 This application provides a schematic diagram of the structure of an electronic device for executing an intranet asset identification method. The electronic device may include: at least one processor 310, such as a CPU; at least one communication interface 320; at least one memory 330; and at least one communication bus 340. The communication bus 340 is used to establish direct communication between these components. In this embodiment, the communication interface 320 is used for signaling or data communication with other node devices. The memory 330 may be a high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 330 may also be at least one storage device located remotely from the aforementioned processor. The memory 330 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 310, the electronic device performs the aforementioned... Figure 1 The method and process are shown.

[0108] Understandable. Figure 3 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3The components shown can be implemented using hardware, software, or a combination thereof.

[0109] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, performs the following... Figure 1 The method process executed by the electronic device in the illustrated method embodiment.

[0110] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as including:

[0111] Obtain the port and IP information carried by the traffic;

[0112] Based on the port information and the IP information, the internal network IP segment in the traffic is identified, and the device corresponding to the internal network IP segment is identified as an internal network asset.

[0113] In summary, this application provides a method, apparatus, electronic device, and storage medium for identifying intranet assets. This method identifies intranet IP segments in traffic by combining port information and IP information carried by the traffic. The device corresponding to this intranet IP segment is the intranet asset. This method achieves intranet asset identification because IP and port information better reflect the communication characteristics of devices (i.e., the communication characteristics between devices in the intranet can be characterized by IP and port information). It is applicable to any local area network communication environment (including scenarios where public network segments are used privately). Therefore, intranet assets can be effectively identified based on these two pieces of information. This solution does not rely on network segments for intranet asset identification. Compared to existing methods that only identify intranet assets based on network segments, the identification method of this application can more comprehensively and accurately identify intranet assets.

[0114] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0115] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0116] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0117] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0118] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for identifying intranet assets, characterized in that, The method includes: Obtain the port and IP information carried by the traffic; Based on the port information and the IP information, identify the intranet IP segment in the traffic, and determine the device corresponding to the intranet IP segment as an intranet asset; The step of identifying the intranet IP segment in the traffic based on the port information and the IP information includes: Count the number of destination ports corresponding to the same destination IP in the traffic, and count the number of source IPs corresponding to the same destination IP in the traffic; Based on the number of ports and the number of IPs, identify the intranet IP segments in the traffic; The step of identifying the intranet IP segment in the traffic based on the number of ports and the number of IPs includes: If the destination port corresponding to the same destination IP does not match the port whitelist, and the number of ports is greater than the first threshold, then the destination IP and the corresponding IP C segment are cached in the port identification table. If the number of source IPs corresponding to the same destination IP is greater than the second threshold, and the average three-way handshake time of the packets corresponding to the destination IP is greater than the third threshold, then the IP C segment of the destination IP is cached in the IP identification table. If the IP identification table and the port identification table contain the same IP C segment, then the same IP C segment is determined to be the first internal network IP segment.

2. The method according to claim 1, characterized in that, After caching the destination IP and IP C segment corresponding to the destination port into the port identification table, the method further includes: If different destination IPs in the port identification table have the same IP C segment, then the IP C segment is determined to be the second internal network IP segment.

3. The method according to claim 1, characterized in that, The method further includes: If the destination port matches the port whitelist, then the IP C segment of the destination IP corresponding to the destination port is determined to be the third internal network IP segment; If the average of the three handshake times is less than or equal to the third threshold, then the IP C segment of the same destination IP is determined to be the fourth internal network IP segment.

4. The method according to claim 3, characterized in that, If the destination port matches the port whitelist, then the IP C segment of the destination IP corresponding to the destination port is determined to be a third internal network IP segment, including: If the destination port matches the system's fixed port whitelist, then the IP C segment corresponding to the destination port is determined to be the third internal network IP segment; If the destination port matches the software's default port whitelist and the number of ports corresponding to the destination IP is greater than the fourth threshold, then the IP C segment of the destination IP is determined to be the third intranet IP segment.

5. The method according to claim 3 or 4, characterized in that, The method further includes: The IP C segments with the same IP B segment in the internal network IP segment are expanded according to the upper and lower limits, and the expanded IP C segments are saved to the IP C segment table. The internal network IP segments include the first internal network IP segment, the second internal network IP segment, the third internal network IP segment, and the fourth internal network IP segment. The IP C segment in the IP C segment table is determined to be the final internal network IP segment.

6. The method according to claim 5, characterized in that, After saving the expanded IPC segment to the IPC segment table, the method further includes: The third intranet IP segment, the fourth intranet IP segment, the port identification table, and the corresponding traffic information in the IP identification table are cached in a temporary identification table; Extract the IP C segments of all source IPs and the occurrence count of each IP C segment from the temporary identification table and add them to the IP master table; The IP segment table is compared with the total IP table, and the same IP segments that appear most frequently are selected according to a preset proportion. The selected IP segments are then cached in the intranet IP segment table. The IP C segment in the internal network IP segment table is determined to be the final internal network IP segment.

7. The method according to claim 6, characterized in that, After caching the selected IP C segments into the internal network IP segment table, the process also includes: Extract all destination IPs from the temporary identification table and add them to the destination IP table; If the IP C segment corresponding to the destination IP in the temporary identification table is in the intranet IP segment table, then the source IP corresponding to the destination IP will be compared with the destination IP table. If the source IP is in the destination IP table, then the IP C segment corresponding to the source IP is saved to the IP C segment table.

8. An intranet asset identification device, characterized in that, The device includes: The information acquisition module is used to acquire port information and IP information carried by traffic; The identification module is used to identify the intranet IP segment in the traffic based on the port information and the IP information, and to identify the device corresponding to the intranet IP segment as an intranet asset; Specifically, the identification module is used to count the number of destination ports corresponding to the same destination IP in the traffic, and to count the number of source IPs corresponding to the same destination IP in the traffic; based on the number of ports and the number of IPs, it identifies the intranet IP segment in the traffic. Specifically, the identification module is used to cache the destination IP and its corresponding IP C segment in the port identification table if the destination port corresponding to the same destination IP does not match the port whitelist and the number of ports is greater than a first threshold; if the number of source IPs corresponding to the same destination IP is greater than a second threshold and the average three-way handshake time of the packets corresponding to the destination IP is greater than a third threshold, then cache the IP C segment of the destination IP in the IP identification table; if the IP identification table and the port identification table contain the same IP C segment, then the same IP C segment is determined to be the first internal network IP segment.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-7.

Images