A fingerprint recognition method, device and electronic device

Abstract

This application discloses a fingerprint recognition method, device, and electronic device, relating to the field of computer technology. The solution of this application identifies only the acquired network data, passively identifying network assets, which can ensure network security and improve work efficiency to a certain extent. The specific solution is as follows: determining a fingerprint recognition rule set; the fingerprint recognition rule set includes at least one fingerprint recognition rule, which is used to detect fingerprint information, and the fingerprint information is used to characterize the features of the network asset; acquiring network data of the network to be detected; and obtaining a matching result based on the network data and the fingerprint recognition rule set, wherein the matching result indicates whether fingerprint information exists in the network data.

Description

Technical Field

[0001] This application relates to the field of computer technology. More specifically, it relates to a fingerprint recognition method, apparatus, and electronic device. Background Technology

[0002] As the number of network devices and terminals in enterprises increases, Internet Technology (IT) administrators encounter numerous challenges when inventorying and managing assets. For example, how to identify network assets (such as different electronic devices, operating systems, application software, applications, service components, and middleware on the network) from a massive amount of IT assets; and how to automatically identify the latest network asset information after initialization or configuration changes.

[0003] In the field of cybersecurity, fingerprints can be used to identify network assets one by one, enabling their identification. Currently, fingerprint recognition is mainly used through open-source tools, platforms, or manual inspection of network assets to help IT administrators quickly and effectively verify known vulnerabilities, thereby improving network security and reliability.

[0004] However, fingerprint recognition tools are mainly used for fingerprint recognition scenarios with low traffic, and they are used to actively identify network assets. This can lead to problems such as high false alarm rate, relatively simple fingerprints, and low work efficiency. Summary of the Invention

[0005] In view of the above problems, this application provides a fingerprint recognition method, device and electronic device to solve the problems of high false alarm rate, relatively simple fingerprints and low work efficiency of existing fingerprint recognition tools for fingerprint recognition scenarios with low traffic and active identification of network assets.

[0006] In a first aspect, embodiments of this application provide a fingerprint recognition method, which may include: determining a fingerprint recognition rule set; the fingerprint recognition rule set includes at least one fingerprint recognition rule, the fingerprint recognition rule is used to detect fingerprint information, and the fingerprint information is used to characterize the features of network assets; acquiring network data of the network to be detected; and obtaining a matching result based on the network data and the fingerprint recognition rule set, wherein the matching result is used to indicate whether fingerprint information exists in the network data.

[0007] In conjunction with the first aspect, in one alternative approach, the fingerprint recognition rule may include: a rule header and rule options; the rule header is used to determine the behavior of the rule, and the rule options are used to determine the characteristics and content of the rule.

[0008] In conjunction with the first aspect, in one alternative approach, the rule header may include: a rule behavior; the rule behavior is used to indicate the action to be performed when the behavior is matched; the rule options may include: an option keyword and option content, the option keyword is used to indicate the rule option, and the option content is the content corresponding to the rule option.

[0009] In conjunction with the first aspect, in one alternative approach, the rule behavior may include fingerprint recognition behavior; the option keywords may include network asset name, limited content, and network asset tag, whereby the network asset name is used to identify whether a network name exists in the network data; the limited content is used to limit the direction and form of the network data; and the network asset tag is used to identify the network asset.

[0010] In conjunction with the first aspect, in one alternative approach, the option keywords may also include network asset version, which is used to identify whether a network asset version exists in the network data.

[0011] In conjunction with the first aspect, in one alternative approach, the fingerprint recognition rule may include a sur icate fingerprint recognition rule.

[0012] In conjunction with the first aspect, in one optional approach, obtaining network data of the network to be detected may include: obtaining network data packets of the network to be detected; reassembling the network data packets into groups to obtain reassembled network data, thereby obtaining complete network data packets; and decoding the reassembled network data packets according to the protocol to obtain network data.

[0013] In conjunction with the first aspect, in an alternative approach, the fingerprint recognition method may further include: generating a log record of fingerprint information when the matching result is that the network data includes fingerprint information; storing and outputting the log record.

[0014] Secondly, embodiments of this application also provide a fingerprint recognition device. This fingerprint recognition device may include: a determining module, an acquiring module, and a matching module, etc.

[0015] The determination module can be used to determine the fingerprint recognition rule set; the fingerprint recognition rule set includes at least one fingerprint recognition rule, which can be used to detect fingerprint information, and the fingerprint information can be used to characterize the existence of network assets in the network.

[0016] The acquisition module can be used to acquire network data of the network to be tested.

[0017] The matching module can be used to obtain matching results based on network data and fingerprint recognition rule sets. The matching results can be used to indicate whether fingerprint information exists in the network data.

[0018] Thirdly, embodiments of this application provide an electronic device, including: a processor and a memory for storing processor-executable instructions. When the processor is configured to execute the aforementioned instructions, the electronic device implements the fingerprint recognition method as described in the first aspect or a possible implementation thereof.

[0019] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions thereon. When the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the fingerprint recognition method as described in the first aspect or a possible implementation thereof.

[0020] Fifthly, embodiments of this application provide a computer program product including computer-readable code that, when executed in an electronic device, causes the electronic device to implement the fingerprint recognition method as described in the first aspect or a possible implementation thereof.

[0021] The solution provided in this application first determines a fingerprint recognition rule set for identifying fingerprint information; then acquires network data of the network to be detected; and finally, based on the network data and the fingerprint recognition rule set, obtains a matching result indicating whether fingerprint information exists in the network data.

[0022] The proposed solution involves acquiring network data from the network to be detected, i.e., passively acquiring network data. After acquiring the network data, it is matched against a defined set of fingerprint recognition rules to determine the fingerprint information (i.e., network assets) within the network data. In other words, the proposed solution only identifies the acquired network data, passively identifying network assets, which can, to a certain extent, ensure network security and improve work efficiency.

[0023] Furthermore, the solution provided in this application identifies network assets by matching the Suricata fingerprinting rule set with network data using the Suricata engine. Since the Suricata fingerprinting rule set supports fingerprinting for protocols such as HTTP, DNS, TCP, TLS, UDP, and SMB, and also supports matching hexadecimal, string, and regular expressions, the solution provided in this application can handle high-traffic, high-fingerprinting scenarios and solves the problem of poor fingerprinting compatibility.

[0024] The above description is merely an overview of the technical solutions of the embodiments of this application. In order to better understand the technical means of the embodiments of this application and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of this application more obvious and understandable, specific implementation methods of this application are described below. Attached Figure Description

[0025] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0026] Figure 1 This diagram illustrates the structure of an electronic device provided in this embodiment.

[0027] Figure 2 A schematic flowchart of a fingerprint recognition method provided in this application is shown;

[0028] Figure 3 A flowchart illustrating another fingerprint recognition method provided in this application is shown;

[0029] Figure 4 The display interface for the log information of the electronic device provided in this application is shown;

[0030] Figure 5 A schematic diagram of the structure of a fingerprint recognition device provided in this application is shown. Detailed Implementation

[0031] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0032] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0033] As the number of network devices and terminals in enterprises increases, Internet Technology (IT) administrators encounter numerous challenges when inventorying and managing assets. For example, how to identify network assets (such as different electronic devices, operating systems, application software, applications, service components, and middleware on the network) from a massive amount of IT assets; and how to automatically identify the latest network asset information after initialization or configuration changes.

[0034] In the field of cybersecurity, fingerprints can identify network assets one by one, enabling their identification. Currently, fingerprint recognition primarily utilizes open-source tools, platforms, or manual inspection of network assets to accurately obtain middleware type, service component type, and version information. This helps IT administrators quickly and effectively verify known vulnerabilities, thereby improving network security and reliability.

[0035] Currently, common fingerprint detection targets can include: Content Management System (CMS) information, front-end technology, web server, application server, programming language, operating system information, Content Delivery Network (CDN) information, Web Application Firewall (WAF) information, network protocol (intellectual property, IP) and domain name information, port information, etc.

[0036] The CMS information may include: DaHanCMS, DedeCMS, EmpireCMS, phpcms, ecshop, etc.

[0037] Front-end technologies can include: HyperText Markup Language (HTML5), jQuery, Bootstrap, Pure, Ace, etc.

[0038] Web servers can include Apache, lighttpd, Nginx, IIS, etc.

[0039] Application servers can include Tomcat, JBoss, WebLogic, WebSphere, etc.

[0040] Developer language information may include: Hypertext Preprocessor (PHP), Java, Ruby, Python, C#. Operating system information may include: Linux, Windows 2008, Windows 7, Kali, CentOS, etc. Content Delivery Network (CDN) information: whether a CDN is used, such as Cloudflare, 360cdn, 365cyd, yunjiasu, etc. IP and domain information may include: IP and domain registration information, service provider information, etc. Port information may include: some software or platforms may detect common open ports on the server.

[0041] Common fingerprinting methods may include: keywords contained in normal or error pages of a specific file using the message-digest algorithm (MD5), keyword matching in request header information, keywords contained in some Uniform Resource Locators (URLs) (such as wp-includes, dede, and other key URL features), and identification of the programming language.

[0042] Fingerprint recognition tools can be used to identify the aforementioned targets. Common fingerprint recognition tools include Nmap, WhatWeb, Wapplyzer, Whatruns, WebEye, Goby, nuclei, and TideFinger. Nmap is used to scan for basic information about the target host, such as whether it is online, the ports it uses, and its operating system type. WhatWeb is a website fingerprinting tool in kail, developed using Ruby. WhatWeb can identify web technologies, including content management systems (CMS), blog platforms, statistics / analysis packages, JavaScript libraries, web servers, and embedded devices. WhatWeb can also identify version numbers, email addresses, account IDs, web framework modules, and SQL errors. Wapplyzer is a browser plugin that can identify the type of web technologies used by a target website, detecting CMS and e-commerce systems, message boards, JavaScript frameworks, hosting panels, analytics tools, and other web systems. Nuclei is a customized, fast vulnerability scanner based on YAML syntax templates, primarily used for web applications. TideFinger is used to scan web applications.

[0043] However, different fingerprint recognition tools will produce different fingerprint types. For example, Nmap focuses on host systems, while Nuclei and TideFinger focus on web applications. The fingerprint recognition tools mentioned above, whether Nmap, Nuclei, or TideFinger, focus on a specific application and have poor compatibility.

[0044] Furthermore, current fingerprint recognition tools are primarily designed for low-traffic fingerprint recognition scenarios and can only actively send packets to probe and identify network assets. This can have a certain impact on the network and is easily blocked by security devices, resulting in problems such as high false alarm rates, limited fingerprint diversity, and low work efficiency.

[0045] To address the aforementioned issues, this application provides a fingerprint recognition method. This method first determines a fingerprint recognition rule set for identifying fingerprint information; then acquires network data of the network to be detected; and finally, based on the network data and the fingerprint recognition rule set, obtains a matching result indicating whether fingerprint information exists in the network data.

[0046] The proposed solution involves acquiring network data flowing through the network to be inspected, i.e., passively acquiring network data. After acquiring the network data, it is matched against a defined fingerprint recognition rule set to determine the fingerprint information (i.e., network assets) within the network data. In other words, the proposed solution only identifies the acquired network data, passively identifying network assets, which can, to a certain extent, ensure network security and improve work efficiency.

[0047] Furthermore, the solution provided in this application identifies network assets by matching the Suricata fingerprinting rule set with network data using the Suricata engine. Since the Suricata fingerprinting rule set supports fingerprinting for protocols such as HTTP, DNS, TCP, TLS, UDP, and SMB, and also supports matching hexadecimal, string, and regular expressions, the solution provided in this application can handle high-traffic, high-fingerprinting scenarios and solves the problem of poor fingerprinting compatibility.

[0048] The fingerprint recognition method provided in this application is described below.

[0049] The fingerprint recognition method provided in this application can be applied to electronic devices. The electronic device can be a device with fingerprint recognition functionality.

[0050] In some embodiments, the electronic device may be a laptop computer, tablet computer, handheld computer, PC, personal digital assistant (PDA), wearable device, or other electronic device. This application does not limit the specific form of the electronic device. This application uses a laptop computer as an example for illustrative purposes.

[0051] In some examples, a laptop computer is used as an example of an electronic device. Figure 1 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown.

[0052] like Figure 1As shown, the electronic device (i.e., the laptop computer) may include: a processor 110, a fan 111, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, a display screen 150, an antenna, a wireless communication module 160, an audio module 170, a speaker (i.e., a horn) 170A, a microphone 170C, a headphone jack 170B, a touchpad 180, a keyboard 190, and a camera 191, etc.

[0053] The components mentioned above, excluding the display screen 150 (such as the processor 110, fan 111, external memory interface 120, internal memory 121, USB interface 130, charging management module 140, power management module 141, battery 142, antenna, wireless communication module 160, audio module 170, touchpad 180, speaker 170A, microphone 170C, headphone jack 170B, keyboard 190, and camera 191), can all be mounted on the laptop's dock. The camera 191 can also be mounted on the bezel of the laptop's display screen 150.

[0054] It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the laptop computer. In other embodiments, the laptop computer may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0055] Processor 110 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0056] The controller can be the nerve center and command center of a laptop computer. Based on the instruction opcode and timing signals, the controller generates operation control signals to control the fetching and execution of instructions.

[0057] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0058] In some embodiments, the processor 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0059] It is understood that the interface connection relationships between the modules illustrated in this embodiment are merely illustrative and do not constitute a limitation on the structure of the laptop computer. In other embodiments, the laptop computer may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0060] The charging management module 140 receives charging input from a charger (such as a wireless charger or a wired charger) to charge the battery 142. The laptop's wireless communication functionality is implemented via an antenna and wireless communication module 160, a modem processor, and a baseband processor.

[0061] Antennas are used to transmit and receive electromagnetic wave signals. Each antenna in a laptop computer can be used to cover one or more communication frequency bands. Different antennas can also be reused to improve antenna utilization.

[0062] In some embodiments, the laptop's antenna and wireless communication module 160 are coupled, enabling the laptop to communicate with networks and other devices via wireless communication technologies. The wireless communication module 160 can provide solutions for wireless communication applications on laptops, including wireless local area networks (WLANs) (such as Wi-Fi networks, Bluetooth, GNSS, frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies.

[0063] A laptop computer can achieve display functionality through a GPU, a display screen 150, and an application processor. The GPU is a microprocessor for image processing, connecting the display screen 150 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information. The display screen 150 is used to display images, videos, etc.

[0064] The laptop computer can perform shooting functions through an ISP, camera 191, video codec, GPU, display 150, and application processor. The ISP is used to process data fed back by the camera 191. In some embodiments, the ISP can be set in the camera 191. The camera 191 is used to capture still images or videos. In some embodiments, the laptop computer may include one or N cameras 291, where N is a positive integer greater than 1.

[0065] The external storage interface 120 can be used to connect an external storage card, such as a Micro SD card, to expand the storage capacity of the laptop. The internal memory 121 can be used to store executable program code, including instructions. The processor 110 executes various functional applications and data processing of the laptop by running the instructions stored in the internal memory 121. For example, in this embodiment, the processor 110 can execute instructions stored in the internal memory 121, which may include a program storage area and a data storage area.

[0066] Laptops can implement audio functions such as music playback and recording through audio modules 170, speakers 170A, microphones 170C, headphone jacks 170B, and application processors.

[0067] Of course, it is understandable that the above... Figure 1 The illustration shown is merely an example of an electronic device in the form of a laptop computer. If the electronic device is a handheld computer, PDA, personal computer, server, or other similar device, its structure may include more advanced features. Figure 1 The fewer structures shown can also include more than Figure 1 The structures shown are not limited here.

[0068] The methods described in the following embodiments can all be implemented in electronic devices with the above-described hardware structure. This application uses a laptop computer as an example for illustrative purposes.

[0069] Figure 2 A flowchart of a fingerprint recognition method provided in an embodiment of this application is shown. Figure 2 As shown, the fingerprint recognition method may include: S201-S203.

[0070] S201. Determine the fingerprint recognition rule set; the fingerprint recognition rule set shall include at least one fingerprint recognition rule, which is used to detect fingerprint information and the fingerprint information is used to characterize the features of network assets.

[0071] Determine the fingerprint recognition rule set, which must include at least one fingerprint recognition rule for detecting fingerprint information.

[0072] Each fingerprint recognition rule can include a rule header and rule options. The rule header is used to determine the behavior of the rule, and the rule options are used to determine the characteristics and content of the rule.

[0073] In some embodiments, the rule header may include a rule behavior. The rule behavior can be used to indicate the action to be performed when a behavior is matched.

[0074] For example, rule-based behaviors may include fingerprint recognition behavior, alarm behavior, recording behavior, passage behavior, and discarding behavior.

[0075] In some embodiments, the rule header may also include rule conditions. Rule conditions can be used to define conditions required for network data identification.

[0076] For example, rule conditions may include protocol type, source address and port, destination address and port, and traffic direction.

[0077] In some embodiments, rule options may include option keywords and option content. Option keywords can be used to indicate rule options, and option content is the content corresponding to the rule option.

[0078] In some embodiments, option keywords may include network asset name, qualifying content, and network asset tag. The network asset name can be used to identify whether a network name exists in the network data; the qualifying content can be used to define the direction and format of the network data; and the network asset tag can be used to identify the network asset.

[0079] In some embodiments, the option keyword may also include network asset version. Network asset version is used to identify whether a network asset version exists in the network data.

[0080] In some embodiments, option keywords may also include: feature identifier, revision, reference, priority, category, modifier, traffic direction, etc. Feature identifier can be used to uniquely represent a rule. Revision can be used to indicate that a rule has been modified. Reference can be used to link to external news sources. Priority can be used to manually set the priority of a rule. Category can be used to classify fingerprinting rules according to the type of activity identified by the fingerprinting rule. Modifier can be used to add modifiers after the matched content to precisely control how the engine matches content in web data. Traffic direction can be used to limit the traffic source.

[0081] By defining the above fingerprint recognition rules, a fingerprint recognition rule set can be determined, which can then be used to identify whether fingerprint information (i.e., network assets) exists in network data.

[0082] S202. Obtain the network data to be detected.

[0083] When network data from the network to be tested flows through an electronic device, the electronic device can acquire the network data flowing through it.

[0084] In some embodiments, network packets of the network to be detected are first acquired; then, the network packets are reassembled to obtain reassembled network data, thus obtaining complete network packets; subsequently, the reassembled network packets are decoded according to the protocol to obtain network data. This enables deep fingerprinting of the acquired network data, thereby identifying fingerprint information (i.e., network assets) within the network data.

[0085] In summary, it can be seen that the network data being acquired is the network data flowing through electronic devices, i.e., passively acquiring the network data to be detected, thereby passively identifying fingerprint information (i.e., network assets) in the network data. In other words, the solution in this application does not actively send data packets, but only performs fingerprint identification on the received network data, which does not affect network security and thus can prevent network data from being intercepted.

[0086] S203. Based on the network data and the fingerprint recognition rule set, obtain the matching result, wherein the matching result is used to indicate whether fingerprint information exists in the network data.

[0087] After acquiring network data, the electronic device can match the network data with fingerprint recognition rules to obtain a matching result indicating whether fingerprint information exists in the network data.

[0088] In some embodiments, obtaining a matching result based on network data and a fingerprint recognition rule set may include: determining fingerprint recognition rules in the fingerprint recognition rule set according to the type of network data; and matching the network data with the fingerprint recognition rules to obtain a matching result.

[0089] If the network data matches the fingerprint recognition rules, a matching result is obtained where the network data includes fingerprint information, indicating that the network asset has been identified. If the network data does not match the fingerprint recognition rules, a matching result is obtained where the network data does not include fingerprint information, indicating that no network asset has been identified, and the fingerprint recognition process can be terminated.

[0090] The present application provides a fingerprint recognition method, which first determines a fingerprint recognition rule set for recognizing fingerprint information; then acquires network data of the network to be detected; and finally obtains a matching result indicating whether fingerprint information exists in the network data based on the network data and the fingerprint recognition rule set.

[0091] The proposed solution involves acquiring network data flowing through the network to be inspected, i.e., passively acquiring network data. After acquiring the network data, it is matched against a defined fingerprint recognition rule set to determine the fingerprint information (i.e., network assets) within the network data. In other words, the proposed solution only identifies the acquired network data, passively identifying network assets, which can, to a certain extent, ensure network security and improve work efficiency.

[0092] The Suricata engine is a free, open-source, mature, fast, and robust network threat detection engine. It performs real-time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM), and offline pcap processing. Suricata uses a powerful and extensive rules and signature language to inspect network traffic and provides robust Lua scripting support for detecting complex threats. Integration with existing SIEMs, Splunk, Logstash / Elasticsearch, Kibana, and other databases is very simple, using standard input and output formats such as YAML and JSON.

[0093] For ease of understanding, the following is in conjunction with the appendix. Figure 3Taking the Suricata fingerprint recognition rule set as an example, this paper provides a detailed explanation of the specific implementation of a fingerprint recognition method provided in this application. Figure 3 As shown, the fingerprint recognition method provided in this application embodiment may include: S301-S309.

[0094] S301. Determine the Suricata fingerprint recognition rule set, wherein the Suricata fingerprint recognition rule set includes at least one Suricata fingerprint recognition rule. The Suricata fingerprint recognition rule is used to detect fingerprint information, and the fingerprint information is used to characterize the features of network assets.

[0095] Each Suricata fingerprint recognition rule includes a rule header and rule options. The rule header is used to determine the behavior of the rule, and the rule options are used to determine the characteristics and content of the rule.

[0096] The rule header can include the rule behavior. The rule behavior can be used to indicate the action to be performed when the behavior is matched.

[0097] Rule behaviors can include fingerprinting behavior, which is used to instruct the Suricata engine to fingerprint network data.

[0098] In some embodiments, rule behaviors may also include alert behaviors, log behaviors, pass behaviors, and drop behaviors. An alert behavior notifies the Suricata engine to record all matching rules and the network data associated with those rules. A log behavior notifies the Suricata engine to record all matching rules but not the network data associated with them. A pass behavior means that no action is taken on the network data. A drop behavior discards the network data.

[0099] In some embodiments, the option header may also include a protocol. The protocol can be used to inform the Suricta engine of the protocol type to which the Suricta fingerprinting rule applies. For example, the protocol type can be tcpb, udpc, icmpdip; when both TCP and UDP protocols are applicable, any can be used.

[0100] In some embodiments, the rule header may also include a source / destination host. The source / destination host can be used to determine the host corresponding to the source / destination when matching (i.e., fingerprinting). For example, the source / destination host can be a list of IPs or a range of IPs in the form of classless interDomain routing (CIDR). The source IP can also be specified in the configuration file: 3. [MISSING IMAGE:,]HOME_NET Suricata configuration file: suricate.yaml. If it is not possible to limit the Suricata fingerprinting rule to a specific type of host, the keyword "any" can be used to match any host.

[0101] In some embodiments, the rule header may also include a source / destination port. The source / destination port can be used to determine the port corresponding to the source / destination host when a match occurs. The port setting can be specified; for example, specifying a specific port could be like specifying 80b. The port setting can also specify any port; for example, specifying any port could be like specifying any port.

[0102] In some embodiments, the rule header may also include the traffic direction (i.e., the direction of network data). The traffic direction can be used to indicate the source of the traffic, that is, only traffic (i.e., network data) in the specified direction is identified. The traffic direction is used to write the rules for the three-way handshake based on the TCP network traffic state. The three-way handshake includes: the first handshake is when the client sends a first handshake message (i.e., a SYN packet) to the server's listening port; the second handshake is when the server sends a second handshake message (i.e., a SYN / ACK packet) to the client after receiving the first handshake message; the third handshake is when the client sends a third handshake message (i.e., an ACK packet) to the server after receiving the second handshake message.

[0103] The configuration format for flow direction is flow: <option>,< / option> <option>,< / option> <option>The first option is the status option, the second option is the direction option, and the third option is the traffic mode status.

[0104] The status options can include: established and stateless. "Established" means it matches traffic for which a TCP session connection has been established. "Stateless" means it matches traffic regardless of whether a TCP session connection has been established.

[0105] Traffic redirection options can include to_server, from_server, to_client, and from_client. to_server represents traffic from the client to the server; from_server represents traffic from the server to the client; to_client represents traffic from the server to the client; and to_client represents traffic from the client to the server.

[0106] Traffic pattern states can include: no_stream and only_stream. no_stream indicates that the data to be matched is reassembled network data; only_stream indicates that the data to be matched is a single network packet.

[0107] Rule options can include option keywords and option content. Option keywords indicate rule options, while option content can be the content corresponding to the rule option. Option keywords can include network asset name, network asset version, restrictions, and network asset tags, etc.

[0108] The network asset name (product.name.set) can be used to identify whether a network asset name exists in network data.

[0109] In some embodiments, a regular expression for determining the network asset name is used. After matching, the network asset name can be set using content from the network data, or a custom network asset name can be set.

[0110] For example, the regular expression for a network asset name is as follows:

[0111] http.server;product.name.set:"Microsoft-IIS,iis";.

[0112] In the fingerprinting rules described above, `http.server` indicates matching from the `server` field in the HTTP header. `product.name.set` needs to be enclosed in quotation marks; the format is: `[pattern,[middle ware namesetting]]`. The matched content and the name of the network asset being set are separated by commas. For example, if "Microsoft-IIS" is matched, then the network asset name `iis` is set.

[0113] The content after the comma is optional; if there is no comma, "Microsoft-IIS" will be set as the name of the network asset.

[0114] The product.ver.set can be used to identify whether a product.ver.set exists in the web data.

[0115] In some embodiments, a regular expression for determining the network asset version is used, and after matching, the content in the network data can be used as the network asset version.

[0116] For example, the regular expression for a network asset name is as follows:

[0117] http.server; product.ver.set:"|28 28 28 34 7C 35 29 5C 2E 5B 30 2D 395D 29 7C 36 5C 2E 28 30 7C 31 29 29|";.

[0118] In the fingerprinting rules above, `http.server` indicates matching from the `server` field in the HTTP header. `product.ver.set` needs to be enclosed in double quotes; the format is: `"[pattern]"`. The network asset version can be converted from the above hexadecimal format to a string.

[0119] The network asset version in the above fingerprinting rule is (((4|5)\.[0-9])|6\.(0|1)). If this fingerprinting rule is matched, the string of this expression code is set as the network asset version.

[0120] Limitations can be used to restrict the direction and format of network data. Limitations can include server-to-client limits and client-to-server limits. Server-to-client limits can be used to restrict the content and storage format from the server to the client; server-to-client limits can also be used to restrict the content and storage format from the server to the client.

[0121] The server-to-client limited content can include server-to-client temporary storage fields and server-to-client case fields.

[0122] The server-to-client temporary storage field (var.toclient.set) can be used to extract a temporary variable from network data in the toclient direction and store it in the session for easy secondary extraction of network asset names and versions. This server-to-client temporary storage field can be modified to identify content.

[0123] For example, the regular expression for the server-to-client temporary storage field (i.e., var.toclient.set) is as follows:

[0124] http.server;var.toclient.set:"Microsoft-IIS / |28 28 28 34 7C 35 29 5C2E 5B 30 2D 39 5D 29 7C 36 5C 2E 28 30 7C 31 29 29|";fast_pattern;.

[0125] In the fingerprinting rules above, `http.server` indicates matching from the `server` field in the HTTP header. `var.toclient.set` needs to be enclosed in double quotes (`"`), with the format: `"[pattern]"`. The network asset version is hexadecimal data. Converting the hexadecimal data to a string, the network asset version is: `(((4|5)\.[0-9])|6\.(0|1))`. A temporary variable is extracted from the network data in the `toclient` direction and stored in the session. When the network data is matched against the above regular expression in the session, if the expression is matched, the string representing this expression is set as the network asset version.

[0126] The above fingerprint recognition rule uses fast_pattern, which means that the fingerprint recognition rule is executed first in the prefilter process, and first in other matching fields, that is, it is first matched in the temporary variables from the server to the client.

[0127] The aforementioned server-to-client temporary storage field sets temporary variables in the server-to-client direction, and prioritizes the identification of network assets (i.e., fingerprint information) on these temporary variables. This can save network resources while ensuring fingerprint recognition efficiency.

[0128] The server-to-client case field (i.e., the var.toclient field) can be used to collect network data from the server to the client, where the network data can include uppercase and / or lowercase data. This server-to-client case field is a buffer type modifier that can modify the identification content, indicating that fingerprint rule matching is performed from a case-insensitive temporary variable in the toclient direction; this facilitates the extraction of network name and network asset version in subsequent fields.

[0129] For example, the regular expression for the server-to-client case field (i.e., the var.toclient field) is as follows:

[0130] http.server;var.toclient.set:"Microsoft-IIS / |28 28 28 34 7C 35 29 5C2E 5B 30 2D 39 5D 29 7C 36 5C 2E 28 30 7C 31 29 29|"fast_pattern;var.toclient;product.name.set:"Microsoft-IIS";var.toclient;pro duct.ver.set:"|28 28 28 34 7C 35 29 5C 2E 5B 30 2D 39 5D 29 7C 36 5C 2E 28 30 7C 31 29 29|";.

[0131] In the fingerprint recognition rules mentioned above, var.toclient can be matched from the temporary variables extracted from the session var.toclient.set.

[0132] The `var.toclient` field modifies the `product.name` field, meaning that `var.toclient` modifies the network asset name. This indicates that Microsoft-IIS will match the content retrieved from `var.toclient.set` and then set the network asset name to Microsoft-IIS.

[0133] The aforementioned server-to-client case sensitivity field, while limiting the traffic direction, defaults to accepting all traffic in that direction, meaning it doesn't distinguish between uppercase and lowercase traffic. This ensures efficient identification of network assets (i.e., fingerprint information) while limiting the traffic source; in other words, it eliminates the need to restrict the case sensitivity of network asset names or versions.

[0134] The client-to-server constraints can include client-to-server temporary storage fields and client-to-server case sensitivity fields.

[0135] The client-to-server temporary storage field (var.toserver.set) can be used to extract a temporary variable from network data in the toserver direction and store it in the session for easy secondary extraction of network asset names and versions. This server-to-client temporary storage field can be modified to identify the content.

[0136] For example, the regular expression for the temporary storage field from the server to the client (i.e., var.toserver.set) is as follows:

[0137] http.user_agent;var.toserver.set:"curl / 7.79.1";fast_pattern;.

[0138] In the fingerprinting rules above, `http.user_agent` indicates matching from the User-Agent field in the HTTP header. `var.server.set` needs to be enclosed in double quotes; the format is: `"[pattern]"`. The network asset version mentioned above is: curl / 7.79.1. A temporary variable is extracted from the network data in the `toserver` direction and stored in the session. When the network data in the session is matched against the above regular expression, if the expression is matched, the string representing this expression is set as the network asset version.

[0139] The fingerprint recognition rule mentioned above uses fast_pattern, which means that the fingerprint recognition rule is executed first during the prefilter process, and is executed first over other matching fields. That is, it is prioritized for matching in the temporary variables from the client to the server.

[0140] The aforementioned client-to-server temporary storage field sets a temporary variable in the direction from the client to the server, and prioritizes the identification of network assets (i.e., fingerprint information) on this temporary variable. This can save network resources while ensuring fingerprint recognition efficiency.

[0141] The client-to-server case field (i.e., the var.toclient field) can be used to collect network data from the client to the server, which can include uppercase and / or lowercase data. This client-to-server case field is a buffer type modifier that can modify the detection content, indicating that fingerprint rule matching is performed from a case-insensitive temporary variable in the toclient direction; this facilitates the extraction of network asset names and versions in subsequent fields.

[0142] For example, the regular expression for a client-to-server case-sensitive field (i.e., the var.toserver field) is as follows:

[0143] http.user_agent;var.toserver.set:"curl / 7.79.1";fast_pattern;var.toserver;pro duct.name.set:"curl";var.toserver;product.ver.set:"|5C 64 2E5C 64 2B 5C 2E 5C 64 2B|";.

[0144] In the fingerprinting rules described above, the var.toserver field can be matched from the temporary variables extracted from the session's var.toserver.set field.

[0145] The `var.toserver` field modifies the `product.name.set` field, meaning the `var.toserver` field modifies the network asset name. This indicates that the `curl` keyword should match the content extracted from `var.toclient.set` and then set the network asset name to `curl`.

[0146] The aforementioned client-to-server case sensitivity field, while limiting the traffic direction, defaults to accepting all traffic in that direction, meaning it doesn't distinguish between uppercase and lowercase. This ensures efficient identification of network assets (i.e., fingerprint information) while limiting the traffic source; in other words, it eliminates the need to restrict the case sensitivity of network asset names or versions.

[0147] It should be noted that when there are restrictions in the Suricata fingerprinting rules, you can choose not to set the above traffic direction.

[0148] Fingertags can be used to identify network assets. Multiple fingertags can be separated by commas.

[0149] For example, network asset tags are shown below:

[0150] fingertag: Operating system, Windows 10;

[0151] The above network asset tags do not need to be enclosed in quotation marks; if there are multiple network asset tags, they should be separated by commas.

[0152] In some embodiments, option keywords may also include feature identifier (sid), revision (rev), reference, priority, and classtype.

[0153] Among them, the feature identifier (sid) can be used to uniquely identify the rule. The feature identifier cannot be repeated and can only be a number.

[0154] For example, a signature between 0 and 10,000,000 indicates that it is reserved for Sourcefire VRT. Similarly, a signature between 20,000,000 and 29,999,999 indicates that it is reserved for Emerging Threats (ET). Furthermore, a signature above 30,000,000 indicates that it is public.

[0155] The revision (rev) can be used to indicate that the Suricata fingerprinting rules have been modified, i.e., the version number of the Suricata fingerprinting rules.

[0156] For example, when creating a new Suricata fingerprinting rule, specifying rev:1 can be used to identify this Suricata fingerprinting rule as version 1. Similarly, when a Suricata fingerprinting rule is changed, it is not necessary to create a new Suricata fingerprinting rule; instead, rev can be incremented while keeping the feature identifier unchanged.

[0157] References can be used to link to external information sources, thereby expanding the application scenarios of Suricta fingerprint recognition rules. This helps maintain the cleanliness of fingerprint recognition rules, reduces their length, and makes them easier to modify and manage.

[0158] For example, references can be specified directly. For instance: `reference:,`; `reference:url,doc.emergingthreats.net / 2010235b.`.

[0159] For example, a reference can be defined in the `reference.config` file configured in `suricata.yaml`. The file format is: `config reference:`. For instance, in the file: `config reference:cve http: / / cve.mitre.org / cgi-bin / cvename.cgi?name=`, the rule is: `reference:cve,2001-0414`, and the actual reference is: `reference:cve,http: / / cve.mitre.org / cgi-bin / cvename.cgi?name=2001-0414`.

[0160] The priority setting can be used to manually specify the priority of Suricta fingerprint recognition rules. Specifying the priority of Suricta fingerprint recognition rules can improve fingerprint recognition efficiency.

[0161] This priority can be adjusted. For example, the priority can be set to 0-10 levels, where level 0 is the highest priority and level 10 is the lowest priority.

[0162] The class type can be used to classify fingerprint recognition rules based on the type of activity identified by the Suricata fingerprint recognition rules.

[0163] For example, the Suricata fingerprint recognition rule specifies the following method: classtype:; the class in the rule is described by configuring the classification.config file in suricata.yaml. The format in the file is: configclassification:,,classification name: class name; classification description: class description; classification privilege: the default priority specified by the class, which is used when the fingerprint recognition rule uses the class.

[0164] In some embodiments, option keywords may also include modifiers. Modifiers are used to add modifiers after the matched content to allow for precise control over how the Suricata engine matches content in web data.

[0165] For example, modifiers can include nocase, offset, depth, distance, within, and the matching scope that limits both distance and within content matching, as well as HTTP content modifiers.

[0166] The `nocase` option can be used to ignore case when matching content. For example, `product.name.set: "root"; nocase` means that regardless of whether `root` or `ROOT` exists in the network data, if the network asset name is `root`, then the network asset exists in the network data.

[0167] `offset` can be used to indicate the starting position of content matching in network data, counting from the payload's starting position. The payload's starting position is byte 0, not byte 1. For example, `product.name.set: "root"; offset: 5;` means matching for the network asset name "root" will begin at byte 5 in the network data.

[0168] `depth` can be used to limit the end position of the search match. If `offset` is used, the start position is `offset`; otherwise, it is the start position of the payload. For example, `product.name.set: "root"; offset: 5; depth: 7;` indicates that the network data is matched starting from the 5th byte and ending at the 7th byte, identifying whether the network asset name "root" exists in the network data from the start to the end bytes.

[0169] The distance can be used to specify the distance between the end position of the previous content match and the start position of the current content match.

[0170] within: can be used to limit how many bytes the current match must appear within after the end of the previous match.

[0171] Using `distance` and `within` together restricts the matching scope of the second content match. For example, `content:"evilliveshere"; content:"here"; distance:1; within:7;`

[0172] Match the string "here" within a range of 1 to 7 bytes following the string "evilliveshere".

[0173] HTTP content modifiers can be used to create fingerprint-like rules for identifying HTTP network data. For example, Suricata provides HTTP packet reassembly capabilities and offers more efficient rule modifiers for writing HTTP network data-related rules.

[0174] For example, `fingerprint tcp any any->any80(msg:"Evil Doaminwww.appliednsm.com";"content:"GET";httpmethod;product.name.set:"www.appliednsm.com";http_uri;sid:5445555;rev:1;)`. Here, `http method` specifies the HTTP method used by the client (e.g., GET, POST, etc.).

[0175] In some embodiments, common HTTP content modifiers may also include: http_client_body, http_cookie, http_client_body, http_header, http_uri, http_stat_code, http_stat_message, http_stat_message, and http_encode, etc.

[0176] `http_client_body` is the body of the HTTP client request; `http_cookie` is the content of the "cookie" field in the HTTP header; `http_header` is any content in the HTTP request or response header; `http_uri` is the URI content of the HTTP client request; `http_stat_code` is the content of the HTTP status field in the server response; `http_stat_message` is the content of the HTTP status message in the server response; `http_encode` is the encoding type used during HTTP transmission.

[0177] In some embodiments, header detection may include: TTL, dsize, itype, icode, and ip_proto. TTL can be used to match a specified TTL value, using relational operators (<, <=, >=, >), and can be used to identify the type of network asset. dsize can be used to match a network packet of a specified payload size, using relational operators (<, <=, >=, >). itype can be used to match a specified ICMP type value. icode can be used to match a specified ICMP code value. ip_proto can be used to match a specified IP protocol, such as IGMP or GRE.

[0178] The above Suricata fingerprint recognition rules can be used to modify ordinary fingerprint rules into Suricata fingerprint recognition rules that can be recognized by the Suricata engine.

[0179] For example, the rules for a typical fingerprint are as follows:

[0180]

[0181] If the network name is Baidu Online Text Editor and the "ueditor\\.all\\.js" field exists in the body of the HTTP response, then the accessed network asset can be considered to be Baidu Online Web Editor.

[0182] Using the Suricata fingerprint recognition rules described above, fingerprint information can be modified to conform to the Suricata fingerprint recognition rules. For example, the Suricata fingerprint recognition rules are shown below:

[0183] fingerprint http any any->any any(msg:"Baidu Online Web Editor Fingerprint Recognition"; flow:established,to_client; http.response_body; product.name.set:"|75 65 64 6974 6f 72 5c 2e 61 6c 6c 5c 2e 6a 73|,Baidu Online Web Editor"; fast_pattern; classtype:finger-application-layer; reference:url,wait_for_update; sid:20000085; rev:1; fingerprinttag:application-layer / editor; reliability:70;).

[0184] The above Suricata fingerprinting rules can include the following in the rule header: the fingerprinting behavior and network data using the HTTP protocol. Rule options can include:

[0185] The network asset name is "Baidu Online Web Editor Fingerprint Recognition". The content is limited to matching network data from the server to the client within an established TCP session connection. The recognition scope is the HTTP response message body. If the following lines exist within the recognition scope: 75 65 64 69 74 6f 72 5c 2e 61 6c 6c 5c 2e 6a 73 (this is the hexadecimal representation of "ueditor\\.all\\.js"), then the target is considered to be the Baidu Online Web Editor. The priority is the highest. The category is application-layer network asset. The reference is a related link. The identification rule is 20000085. The rule version is 1. The asset tag is application-layer / editor. The confidence level is 70%.

[0186] By modifying ordinary fingerprint rules to the aforementioned Suricata fingerprint recognition rules, fingerprint recognition (i.e., network assets) can be achieved, making the Suricata engine able to recognize the Suricata fingerprint recognition rules.

[0187] Because the Suricata engine supports protocols such as HTTP, DNS, TCP, TLS, UDP, and SMB, and also supports hexadecimal and string representations, converting ordinary fingerprint recognition rules into Suricata fingerprint recognition rules that the engine can recognize allows Suricata fingerprint recognition rules to support the recognition of protocols such as HTTP, DNS, TCP, TLS, UDP, and SMB, and to support matching of hexadecimal, strings, and regular expressions. This improves fingerprint recognition efficiency and enables its use in a wider range of application scenarios.

[0188] It should be noted that S301 in this embodiment corresponds to S201 in the above embodiment.

[0189] S302. Obtain network data packets of the network to be detected.

[0190] When network data packets of the network to be detected flow through the electronic device, the electronic device acquires the network data packets of the network to be detected, and can then reassemble the network data packets into groups.

[0191] In some embodiments, the Suricata engine can obtain network packets flowing through the network interface of an electronic device or a PCP file, thereby enabling the obtained network packets to be grouped and reassembled.

[0192] S303. Reassemble the network data packets into groups to obtain reassembled network data, thus obtaining a complete network data packet.

[0193] After acquiring network data packets, electronic devices can reassemble the network data packets into complete network data packets, and then perform protocol decoding on the reassembled network data packets.

[0194] In some embodiments, when the Suricata engine acquires network packets, it can reassemble TCP and UDP network packets to enable deep fingerprinting of the network packets.

[0195] S304. Decode the reassembled network data packets to obtain the network data.

[0196] After obtaining the reassembled network data packets, the reassembled network data is decoded according to the TCP and UDP protocols to obtain the network data. This network data can be a 5-tuple. The 5-tuple data can include: source IP, destination IP, source port, destination port, and transport protocol.

[0197] In some embodiments, after obtaining the reconstructed network data packets, protocol decoding of the reconstructed network data packets may include: the Suricata engine performing protocol decoding on the reconstructed network data packets according to TCP and UDP protocols to enable the identification of various protocols in the network data. For example, various protocols may include: Hypertext Transfer Protocol (HTTP), Domain Name System (DNS), FTP (File Transfer Protocol), etc.

[0198] It should be noted that S302 to S304 in this embodiment correspond to S202 in the above embodiment. That is, S202 in the above embodiment can be implemented by S302 to S304 in this embodiment.

[0199] S305. Based on the type of protocol in the network data, determine the Suricata fingerprint recognition rule in the Suricata fingerprint recognition rule set.

[0200] After obtaining the network data, based on the protocol type in the network data, the Suricta fingerprint recognition rule that matches the protocol type of the network data is determined in the Suricta fingerprint recognition rule set. Thus, the network data can be matched with the Suricta fingerprint recognition rule to obtain the matching result.

[0201] Since the Sur icata fingerprinting rule set contains a series of Sur icata fingerprinting rules, and each fingerprinting rule defines different fingerprint information, it is necessary to determine a Sur icata fingerprinting rule set corresponding to the network data type within the Sur icata fingerprinting rule set for fingerprint recognition.

[0202] S306. Match the network data with the Sur icata fingerprint recognition rules to obtain the matching result.

[0203] After determining the Sur icata fingerprint recognition rules, the network data is matched with the Sur icata fingerprint recognition rules to obtain the matching results.

[0204] If the network data matches the Sur icata fingerprint recognition rules, the matching result of the network data including fingerprint information is obtained, and the following S307 can be executed.

[0205] If the network data does not match the Sur icata fingerprint recognition rules, and the network data does not include fingerprint information, the fingerprint recognition process can be terminated.

[0206] In some embodiments, the Sur icata engine can match network data with Sur icata fingerprint recognition rules to obtain a matching result.

[0207] S307. When the network data matches the Sur icata fingerprint recognition rules, obtain the matching result of the network data including fingerprint information.

[0208] When network data matches Sur icata fingerprint recognition rules, electronic devices can determine that fingerprint information exists in the network data, thus identifying network assets.

[0209] In some embodiments, the Sur icata engine can match the network data after protocol decoding with Sur icata fingerprint recognition rules. When the matching degree between the network data and the Sur icata fingerprint recognition rules reaches a preset confidence level, it indicates that fingerprint information exists in the network data, that is, network assets exist.

[0210] For example, when the confidence level in the Sur icata fingerprint recognition rule is 70, if the similarity between the network data and the Sur icata fingerprint recognition rule reaches 70 or more, it is considered that there is fingerprint information in the network data, that is, there is network asset in the network data.

[0211] It should be noted that S305 to S307 in this embodiment correspond to S203 in the above embodiment. That is, S203 in the above embodiment can be implemented by S305 to S307 in this embodiment.

[0212] S308. If the matching result is that the network data includes fingerprint information, generate a log record of the fingerprint information.

[0213] When the Sur icata engine detects fingerprint information (i.e., network assets), the electronic device generates a log record corresponding to the fingerprint information.

[0214] Log entries can include detailed information about detected network assets. For example, log information may include timestamps, source IP addresses, destination IP addresses, protocols, rule IDs, categories, priorities, confidence levels, and fingerprint tags.

[0215] S309. Store and output log records.

[0216] After generating a log record of fingerprint information, the electronic device stores the log information and outputs the log information.

[0217] In some embodiments, after generating a log record of fingerprint information, the electronic device can write the generated log record to a disk.

[0218] For example, the storage log records are as follows:

[0219] Asset log http any any->any any(msg: "CMS fingerprinting"; flow: established, to_server; content: "ThinkPHP"; nocase; http_header; fast_pattern; classtype: protocol-command-decode; reference: cve, CVE-2014-1234; sid: 127; rev: 1; fingertag: CMS, THINKPHP; reliability: 99;).

[0220] The Suricata engine can store information on disk that includes the HTTP protocol, identification rules (CMS fingerprint name), matching only established TCP session connections, client-to-server network data, network name (ThinkPHP), case insensitive, any content in HTTP request or response headers, highest priority, protocol-command-decode type, reference to CVE (CVE-2014-1234), feature identifier 127, revision 1, fingerprint tags (CMS, THINKPHP), and confidence level of 99 or higher.

[0221] In some embodiments, the output log records can be displayed. For example, the log records can be displayed on the display interface of an electronic device.

[0222] For example, Figure 4 The log display interface is shown. Figure 4 The display interface shows the log information of 4 fingerprint information (i.e. network assets), namely log record 1, log record 2, log record 3 and log record 4.

[0223] Log record 1 shows the following log entries: fingerprint recognition rule; HTTP protocol is [1:20000344:1]; network asset name is ConnKeepalive fingerprint recognition; type is application layer recognition; priority is level 2; confidence level is 70; TCP is 8.130.165.191:80->172.31.1.102:32940; chain; fingerprint tag is application layer / other.

[0224] Log record 2 shows the following log entries: fingerprint recognition rule; HTTP protocol is [1:20000346:1]; network asset name is ConnKeepalive fingerprint recognition; type is application layer recognition; priority is level 2; confidence level is 70; TCP is 8.130.165.191:80->172.31.1.102:32940; chain; fingerprint tag is application layer / other.

[0225] Log record 3 shows the following log record: fingerprint recognition rule; HTTP protocol is [1:20000981:1]; network asset name is Nginx fingerprint recognition; type is application layer recognition; priority is level 2; confidence level is 70; TCP is 8.130.165.191:80->172.31.1.102:32940; chain:; fingerprint tag is application layer / reverse proxy.

[0226] Log record 4 shows the following log record: fingerprint recognition rule; HTTP protocol is [1:20000982:1]; network asset name is Nginx fingerprint recognition; type is application layer recognition; priority is level 2; confidence level is 70; TCP is 8.130.165.191:80->172.31.1.102:32940; chain:; fingerprint tag is application layer / reverse proxy.

[0227] Users can view the above log records through the display interface on their electronic devices, accurately obtain relevant information about network assets, and thus quickly and effectively verify known vulnerabilities, thereby improving network security and reliability.

[0228] The solution of this application involves: determining a set of Suricata fingerprint recognition rules for identifying fingerprint information; acquiring network data containing protocol types; determining Suricata fingerprint recognition rules corresponding to the network type based on the type of network data; matching the network data with the determined Suricata fingerprint recognition rules; and obtaining a matching result including fingerprint information.

[0229] The solution proposed in this application is to acquire network data flowing through the network to be detected, i.e., passively acquire network data. After acquiring the network data, the network data is matched with a determined Suricata fingerprint recognition rule set, and then the fingerprint information (i.e., network assets) in the network data is determined. In other words, the solution proposed in this application only identifies the acquired network data, i.e., passively identify network assets, which can ensure network security to a certain extent and improve work efficiency.

[0230] Furthermore, the solution provided in this application identifies network assets by matching the Suricata fingerprinting rule set with network data using the Suricata engine. Since the Suricata fingerprinting rule set supports the recognition of protocols such as HTTP, DNS, TCP, TLS, UDP, and SMB, and also supports matching hexadecimal, string, and regular expressions, the solution provided in this application can handle high-traffic, high-fingerprinting scenarios and solves the problem of poor fingerprint recognition compatibility.

[0231] In addition to the methods described in the foregoing embodiments, this application also provides a fingerprint recognition device. This fingerprint recognition device can be applied to electronic devices to implement the methods described in the foregoing embodiments. The fingerprint recognition device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

[0232] For example, Figure 5 A schematic diagram of a fingerprint recognition device is shown. Figure 5 The fingerprint recognition device 500 may include: a determination module 501, an acquisition module 502, and a matching module 503, etc.

[0233] The determination module 501 can be used to determine the fingerprint recognition rule set; the fingerprint recognition rule set includes at least one fingerprint recognition rule, which can be used to detect fingerprint information, and the fingerprint information can be used to characterize the existence of network assets in the network.

[0234] The acquisition module 502 can be used to acquire network data of the network to be detected.

[0235] The matching module 503 can be used to obtain a matching result based on network data and fingerprint recognition rule set, wherein the matching result can be used to indicate whether fingerprint information exists in the network data.

[0236] In some embodiments, a fingerprint recognition rule includes a rule header and rule options; the rule header is used to determine the behavior of the rule, and the rule options are used to determine the characteristics and content of the rule.

[0237] In some embodiments, the rule header includes: rule behavior; the rule behavior is used to indicate the action to be performed when the behavior is matched; the rule options include: option keywords and option content, the option keywords are used to indicate the rule options, and the option content is the content corresponding to the rule options.

[0238] In some embodiments, rule behavior includes fingerprint recognition behavior; option keywords include network asset name, qualified content and network asset tag, whereby the network asset name is used to identify whether a network name exists in the network data; the qualified content is used to limit the direction and form of the network data; and the network asset tag is used to identify the network asset.

[0239] In some embodiments, the option keyword may also include network asset version, which is used to identify whether a network asset version exists in the network data.

[0240] In some embodiments, fingerprint recognition rules may include sur icate fingerprint recognition rules.

[0241] In some embodiments, the acquisition module 502 can also be used to acquire network data packets of the network to be detected; reassemble the network data packets into groups to obtain reassembled network data, so as to obtain complete network data packets; and perform protocol decoding on the reassembled network data packets to obtain network data.

[0242] In some embodiments, the matching module 503 can also be used to determine fingerprint recognition rules in the fingerprint recognition rule set according to the type of network data; match the network data with the fingerprint recognition rules to obtain a matching result; and obtain a matching result in which the network data includes fingerprint information when the network data matches the fingerprint recognition rules.

[0243] In some embodiments, such as Figure 5 As shown, the fingerprint recognition device may also include a log generation module 504, a storage module 505, and an output module 506.

[0244] The log generation module 504 can be used to generate a log record of fingerprint information when the matching result is network data including fingerprint information.

[0245] Storage module 505 can be used to store log records.

[0246] Output module 506 can be used to output log records.

[0247] It should be understood that the division of units or modules (hereinafter referred to as units) in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, all units in the device can be implemented in software through processing element calls; all units can be implemented in hardware; or some units can be implemented in software through processing element calls, and some units can be implemented in hardware.

[0248] For example, each unit can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as a program in memory, invoked and executed by a processing element within the device. Furthermore, these units can be integrated in whole or in part, or implemented independently. The processing element described here can also be called a processor, which can be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each of the above units can be implemented through integrated logic circuits in the processor element or through software invoked by the processing element.

[0249] In one example, the unit in the above device may be one or more integrated circuits configured to implement the above methods, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of at least two of these integrated circuit forms.

[0250] For example, when the units in the device can be implemented through a processing element scheduler, the processing element can be a general-purpose processor, such as a CPU or other processor capable of calling programs. Alternatively, these units can be integrated together as a system-on-a-chip (SOC).

[0251] In one implementation, the units that implement the corresponding steps in the above methods can be implemented in the form of a processing element scheduler. For example, the device may include a processing element and a storage element, wherein the processing element calls a program stored in the storage element to execute the methods described in the above embodiments. The storage element may be a storage element located on the same chip as the processing element, i.e., an on-chip storage element.

[0252] In another implementation, the program used to perform the above methods can be located on a storage element on a different chip than the processing element, i.e., an off-chip storage element. In this case, the processing element calls or loads the program from the off-chip storage element onto the on-chip storage element to call and execute the methods described in the above method embodiments.

[0253] For example, embodiments of this application may also provide an apparatus, such as an electronic device, which may include a processor and a memory for storing processor-executable instructions. When the processor is configured to execute the aforementioned instructions, the electronic device implements the fingerprint recognition method as described in the foregoing embodiments. The memory may be located within or outside the electronic device. Furthermore, the processor may include one or more processors.

[0254] In another implementation, the unit implementing each step of the above method can be configured as one or more processing elements, which can be disposed on the corresponding electronic device described above. These processing elements can be integrated circuits, such as one or more ASICs, one or more DSPs, one or more FPGAs, or combinations of these types of integrated circuits. These integrated circuits can be integrated together to form a chip.

[0255] For example, this application also provides a chip that can be applied to the aforementioned electronic device. The chip includes one or more interface circuits and one or more processors; the interface circuits and processors are interconnected via lines; the processor receives and executes computer instructions from the electronic device's memory through the interface circuits to implement the fingerprint recognition method described in the above method embodiments.

[0256] This application also provides a computer program product, including computer instructions for operation of the electronic device described above.

[0257] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0258] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0259] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0260] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0261] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product, such as a program. This software product is stored in a program product, such as a computer-readable storage medium, and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0262] For example, embodiments of this application may also provide a computer-readable storage medium storing computer program instructions thereon. When the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the fingerprint recognition method as described in the foregoing method embodiments.

[0263] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.< / option>

Claims

1. A method of fingerprint recognition, characterized by, The fingerprint identification method comprises: determining a fingerprint identification rule set; the fingerprint identification rule set comprises at least one fingerprint identification rule; the fingerprint identification rule comprises a suricate fingerprint identification rule; the suricate fingerprint identification rule supports at least HTTP, DNS, tcp, tls, udp and smb protocols; the fingerprint identification rule is used for detecting fingerprint information; the fingerprint information is used for representing the characteristics of a network asset; obtaining network data of a network to be detected flowing through; no probe data packet is actively sent; obtaining a matching result according to the network data and the fingerprint identification rule set; the matching result is used for indicating whether the fingerprint information exists in the network data; the fingerprint identification rule comprises a rule header and a rule option; the rule header is used for determining the behavior of the rule; the rule option is used for determining the characteristics and content of the rule; the rule header comprises a rule behavior; the rule behavior is used for indicating the action performed when the behavior is matched; the rule option comprises an option keyword and an option content; the option keyword is used for indicating the rule option; the option content is the content corresponding to the rule option; the option keyword comprises a feature identifier, a revision, a reference, a priority, a category, a modifier and a traffic direction; the feature identifier is used for uniquely representing the rule; the revision is used for indicating that the rule has been modified; the reference is used for linking external message sources; the priority is used for manually setting the priority of the rule; the category is used for classifying the fingerprint identification rule according to the type of the activity identified by the fingerprint identification rule; the modifier is used for adding a modifier after matching the content to control the way of matching the content in the network data; the traffic direction is used for limiting the traffic source.

2. The method of claim 1, wherein, the rule behavior comprises a fingerprint identification behavior; the option keyword comprises a network asset name, a limited content and a network asset tag; the network asset name is used for identifying whether the network name exists in the network data; the limited content is used for limiting the direction and form of the network data; the network asset tag is used for identifying the network asset.

3. The method of claim 2, wherein, the option keyword further comprises a network asset version; the network asset version is used for identifying whether the network asset version exists in the network data.

4. The method according to any one of claims 1-3, characterized in that, the network data of the network to be detected is obtained, comprising: obtaining a network data packet of the network to be detected; grouping and recombining the network data packet to obtain recombined network data, so as to obtain a complete network data packet; performing protocol decoding on the recombined network data packet to obtain the network data.

5. The method of claim 1, wherein, obtaining a matching result according to the network data and the fingerprint identification rule set, comprising: determining a fingerprint identification rule in the fingerprint identification rule set according to the type of the network data; matching the network data with the fingerprint identification rule to obtain a matching result; in the case that the network data matches the fingerprint identification rule, obtaining a matching result that the network data comprises the fingerprint information.

6. The method of claim 5, wherein, the fingerprint identification method further comprises: In a case where the matching result is that the network data includes the fingerprint information, a log record of the fingerprint information is generated; The log record is stored and output.

7. A fingerprint recognition device, characterized by The fingerprint identification device includes a determination module, an acquisition module, and a matching module; The determination module is configured to determine a fingerprint identification rule set; the fingerprint identification rule set includes at least one fingerprint identification rule; the fingerprint identification rule includes a suricate fingerprint identification rule; the suricate fingerprint identification rule supports at least HTTP, DNS, tcp, tls, udp, and smb protocols; the fingerprint identification rule is used to detect fingerprint information; the fingerprint information is used to represent that there is a network asset in a network; the fingerprint identification rule includes a rule header and a rule option; the rule header is used to determine the behavior of the rule; the rule option is used to determine the characteristics and content of the rule; the rule header includes a rule behavior; the rule behavior is used to indicate the action performed when the behavior is matched; the rule option includes an option keyword and an option content; the option keyword is used to indicate the rule option; the option content is the content corresponding to the rule option; the option keyword includes a feature identifier, a revision, a reference, a priority, a category, a modifier, and a traffic direction; the feature identifier is used to uniquely represent the rule; the revision is used to indicate that the rule has been modified; the reference is used to link external message sources; the priority is used to manually set the priority of the rule; the category is used to classify the fingerprint identification rule according to the type of activity identified by the fingerprint identification rule; the modifier is used to add a modifier after matching the content to control the way the content is matched in the network data; and the traffic direction is used to limit the traffic source. The acquisition module is configured to acquire network data of a to-be-detected network flowing therethrough without actively sending a probe data packet. The matching module is configured to obtain a matching result according to the network data and the fingerprint identification rule set; the matching result is used to indicate whether the fingerprint information exists in the network data.

8. An electronic device, comprising: The electronic device includes a processor and a memory for storing processor-executable instructions; the processor is configured to execute the instructions, so that the electronic device implements the fingerprint identification method according to any one of claims 1-6.

Images