A method and apparatus for identifying network element components in a mobile communication network

Abstract

The application relates to a method and device for identifying a network element component in a mobile communication network, and belongs to the technical field of networks. The method comprises the following steps: S01, matching a keyword obtained based on a network element detection response message with a keyword fingerprint in a fingerprint library; if the matching is successful, a network element component is preliminarily determined based on the keyword fingerprint, and step S02 is entered; if the matching fails, step S03 is entered; S02, matching a to-be-identified component fingerprint constructed based on the network element detection response message with a component fingerprint corresponding to the preliminarily determined network element component; if the matching is successful, the preliminarily determined network element component is the component identification result; if the matching fails, step S03 is entered; S03, sequentially matching the to-be-identified component fingerprint with the component fingerprints in the fingerprint library; if a known component fingerprint is matched, the network element component corresponding to the known component fingerprint is the component identification result; otherwise, the component identification fails. The method can quickly and accurately identify the network element component.

Description

Technical Field

[0001] This invention belongs to the field of network technology, and in particular relates to a method and apparatus for identifying network element components in a mobile communication network. Background Technology

[0002] Mobile communication networks have transitioned from 4G to 5G. If the security of these networks is compromised, the security and privacy of information carried by users, such as personal data and corporate information, will face significant challenges. Therefore, timely security detection of all nodes in the mobile communication network is a crucial step in maintaining overall network security. During security detection, component fingerprinting technology can scan each network node to identify the components used by network elements, thereby discovering vulnerabilities and laying the foundation for further security measures.

[0003] In existing technologies, fingerprint recognition network element solutions often employ the following methods: One method involves intercepting the communication traffic of various devices to collect target information. The advantage of this method is that it only detects traces left by the target on the network, resulting in fewer attacks on the target, making it less likely to be recorded by the target, and less likely to trigger protection measures, thus providing good concealment. The disadvantage is that it sacrifices the comprehensiveness and accuracy of intelligence information collection and has a certain degree of lag. Another method involves sending data packets containing probe information to the target, thereby constructing a rule base based on the returned header information, static link information, etc., to identify the target and analyze relevant intelligence. The advantage of this method is that the detection is more comprehensive and the identification accuracy is higher. The disadvantage is that it requires constructing a large number of requests and performing comparisons, resulting in low identification efficiency, and the rule base information is constructed manually. Summary of the Invention

[0004] Based on the above analysis, the present invention aims to provide a method and apparatus for identifying network element components in a mobile communication network, which can quickly and accurately identify network element components based on their fingerprints, and can automatically build and expand a fingerprint database of component fingerprints.

[0005] On one hand, the present invention provides a method for identifying network element components in a mobile communication network, specifically including the following steps:

[0006] Step S01: Match the keywords obtained from the network element detection response message with the keyword fingerprints in the fingerprint database; if the match is successful, preliminarily determine the network element component based on the keyword fingerprints and proceed to step S02; if the match fails, proceed to step S03.

[0007] Step S02: Match the fingerprint of the component to be identified constructed based on the network element detection response message with the component fingerprint corresponding to the preliminarily determined network element component; if the match is successful, the preliminarily determined network element component is the component identification result; if the match fails, proceed to step S03.

[0008] Step S03: Match the fingerprint of the component to be identified with the component fingerprints in the fingerprint database in sequence; if a known component fingerprint is matched, the network element component corresponding to the known component fingerprint is the component identification result; otherwise, the component identification fails.

[0009] Furthermore, in the fingerprint database, one network element component corresponds to one or more corresponding keyword fingerprints, and one network element component corresponds to one or more corresponding known component fingerprints.

[0010] Furthermore, keywords are extracted from the response header information and HTML text information of the network element detection response message, including extracting the X-Powered-By, Server, and Set-Cookie fields as keywords.

[0011] Furthermore, the fingerprint of the component to be identified is constructed based on the network element detection response message, including:

[0012] The JS and CSS files in the network element detection response message are obtained. A static address fingerprint is constructed based on the file name and the corresponding static file address. A static file fingerprint is constructed based on the file name and the corresponding file MD5 value. The static address fingerprint and the static file fingerprint constitute the fingerprint of the component to be identified.

[0013] Furthermore, after a component identification fails, the method also includes storing the fingerprint of the component to be identified as an unknown component fingerprint in the fingerprint database; recording the number of times each component fingerprint in the fingerprint database is successfully matched as the hit rate of that component fingerprint; when the hit rate of a component fingerprint is lower than a preset threshold, recording that component fingerprint as an unknown component fingerprint, otherwise recording that component fingerprint as a known component fingerprint, and determining the component corresponding to that component fingerprint and the corresponding keyword fingerprint of that component.

[0014] Furthermore, the step of sequentially matching the fingerprint of the component to be identified with the component fingerprints in the fingerprint database includes: sorting the component fingerprints in the fingerprint database according to their respective hit rates, and prioritizing the matching of component fingerprints with higher hit rates based on the sorting order.

[0015] On the other hand, the present invention also provides an apparatus for identifying network element components in a mobile communication network, comprising:

[0016] The fingerprint detection module is used to construct a mobile communication network element detection request, obtain keywords and construct the fingerprint of the component to be identified based on the corresponding network element detection response message;

[0017] The component identification module is used to match the keyword with the fingerprint to be identified and the fingerprint in the fingerprint database, and identify the component based on the matching result;

[0018] The fingerprint database management module is used to build the fingerprint database and update the fingerprint database based on the recognition results of the fingerprint to be identified.

[0019] Furthermore, the fingerprint detection module includes a detection request module and a fingerprint construction module, wherein,

[0020] The probe request module is used to send network element probe requests to mobile communication network elements in the network;

[0021] The fingerprint construction module is used to obtain keywords and construct the fingerprint of the component to be identified based on the corresponding network element detection response message;

[0022] Furthermore, the component identification module includes a keyword matching module and a component fingerprint matching module, wherein,

[0023] The keyword matching module is used to match the keyword with the keyword fingerprint in the fingerprint database and to initially determine the network element component based on the successfully matched keyword fingerprint;

[0024] The component fingerprint matching module is used to match the fingerprint of the component to be identified with the component fingerprint corresponding to the preliminarily determined network element component and to identify the component fingerprint based on the successfully matched component fingerprint, or to match the unmatched fingerprint of the component to be identified with the component fingerprints in the fingerprint database in sequence and to identify the component fingerprint based on the successfully matched known component fingerprint.

[0025] Furthermore, updating the fingerprint database based on the recognition result of the fingerprint to be identified includes:

[0026] The component fingerprints in the fingerprint database are sorted according to their hit rates. Matching is performed based on the sorting order, prioritizing the matching of component fingerprints with higher hit rates. If a match is successful, the hit rate of the corresponding component fingerprint is updated. If a match fails, the component fingerprint to be identified is stored as an unknown component fingerprint in the fingerprint database. The hit rate of a component fingerprint refers to the number of times that component fingerprint is successfully matched.

[0027] The present invention can achieve at least one of the following beneficial effects:

[0028] By matching the keywords obtained from the network element detection response messages with the keyword fingerprints in the fingerprint database, the components are initially identified. Then, the components are further accurately identified by matching the component fingerprints based on the hit rate ranking, which significantly improves the efficiency of component identification.

[0029] By automatically crawling the component fingerprints of network element components to build a fingerprint database, the problem of traditional component fingerprint databases relying on manual collection and organization is solved, which is time-consuming and labor-intensive.

[0030] Other features and advantages of the invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained from what is particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0031] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0032] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0033] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0034] Method Implementation Examples

[0035] A specific embodiment of the present invention discloses a method for identifying network element components in a mobile communication network, which specifically includes the following steps:

[0036] Step S01: Match the keywords obtained from the network element detection response message with the keyword fingerprints in the fingerprint database; if the match is successful, preliminarily determine the network element component based on the keyword fingerprint and proceed to step S02; if the match fails, proceed to step S03.

[0037] Specifically, in the fingerprint database, one network element component corresponds to one or more corresponding keyword fingerprints.

[0038] Specifically, after receiving the probe message, i.e., the HTTP request message, the network element replies with a network element probe response message, which includes a status line, response headers, a blank line, and response body, i.e., HTML text information.

[0039] Specifically, keywords are extracted from the response header information and HTML text information of the network element detection response message, including extracting the X-Powered-By, Server, and Set-Cookie fields as keywords, and matching the extracted keywords with the keyword fingerprints in the fingerprint database.

[0040] For example, if the component mysql in the fingerprint database has the keyword fingerprint Server:mysql, when the Server field value in the response header information or HTML text information of the probe response message is mysql, i.e. Server:mysql, then the keyword matches the keyword fingerprint in the fingerprint database, and the network element component can be preliminarily identified as mysql.

[0041] Step S02: Match the fingerprint of the component to be identified constructed based on the network element detection response message with the component fingerprint corresponding to the preliminarily determined network element component; if the match is successful, the preliminarily determined network element component is the component identification result; if the match fails, proceed to step S03.

[0042] Specifically, one network element component corresponds to one or more corresponding known component fingerprints.

[0043] Specifically, the JS and CSS files in the network element detection response message are obtained, and a static address fingerprint is constructed based on the file name and the corresponding static file address. The static address fingerprint consists of the file name and the static file address string. A static file fingerprint is constructed based on the file name and the corresponding file MD5 value. The static file fingerprint consists of the file name and the file MD5 value. The static address fingerprint and the static file fingerprint together form the fingerprint of the component to be identified.

[0044] Specifically, the number of times each component fingerprint in the fingerprint database is successfully matched is recorded as the hit rate of that component fingerprint; when the hit rate of a component fingerprint is lower than a preset threshold, the component fingerprint is recorded as an unknown component fingerprint, otherwise the component fingerprint is recorded as a known component fingerprint, and the component corresponding to the component fingerprint and the corresponding keyword fingerprint of the component are determined.

[0045] Specifically, the preset threshold is a positive integer, set based on experience; for example, the preset threshold is equal to 5. Specifically, when the hit rate of a component fingerprint is greater than or equal to the preset threshold, it indicates that the component fingerprint has been verified multiple times. The corresponding component can be manually identified, the component fingerprint recorded as a known component fingerprint, and the corresponding keyword fingerprint determined based on the component fingerprint and the corresponding component.

[0046] For example, in step S01, the network element component is initially determined to be mysql. Based on the network element detection response message, the mysql.css and mysql.js files are obtained. The corresponding static address fingerprint and static file fingerprint of the two files are constructed as the fingerprint of the component to be identified. They are matched with one or more component fingerprints corresponding to the component mysql in the fingerprint database. If there is a successfully matched component fingerprint, the hit rate of the successfully matched component fingerprint is incremented by 1, and the component identification result is mysql. Otherwise, proceed to step S03.

[0047] Step S03: Match the fingerprint of the component to be identified with the component fingerprints in the fingerprint database in sequence; if a known component fingerprint is matched, the network element component corresponding to the known component fingerprint is the component identification result; otherwise, the component identification fails.

[0048] Specifically, the component fingerprints in the fingerprint database are sorted according to their hit rates. Based on the sorting order, component fingerprints with higher hit rates are matched first. If a known component fingerprint is matched, the network element component corresponding to the known component fingerprint is the component identification result, and the hit rate of the known component fingerprint is incremented by 1. Otherwise, the component identification fails.

[0049] Specifically, if a component identification fails, the fingerprint of the component to be identified is stored in the fingerprint database as an unknown component fingerprint, and its initial hit rate is 0; this indicates that the component fingerprint has not been verified and the corresponding component is unknown.

[0050] After an unknown component fingerprint has been identified multiple times and the hit rate reaches a preset threshold, its corresponding component can be determined through manual identification and comparison, and the fingerprint can be identified as a known component fingerprint.

[0051] The method for identifying network element components in a mobile communication network disclosed in this embodiment can automatically discover and identify network element component fingerprints in the network based on publicly available known component fingerprints before conducting network vulnerability detection, so as to build and update the network element component fingerprint database with each identification.

[0052] For example, an initial fingerprint database is constructed based on publicly available component fingerprints on the network. Then, ten thousand network element nodes are crawled in the mobile communication network, and the initial fingerprint database is updated according to the following steps to obtain the constructed network element component fingerprint database:

[0053] Step S11: Match the keywords obtained from the web page information crawled from the network element with the keyword fingerprints in the initial fingerprint database; if the match is successful, preliminarily determine the network element component based on the keyword fingerprint and proceed to step S12; if the match fails, proceed to step S13. Specifically, the matching process is the same as step S01;

[0054] Step S12: Match the fingerprint of the component to be identified, constructed based on the webpage information of the crawled network element, with the component fingerprints corresponding to the initially determined network element components; if the match is successful, update the hit rate of the corresponding component fingerprint; if the match fails, proceed to step S13. Specifically, the matching process is the same as step S02;

[0055] Step S13: Match the fingerprint of the component to be identified with the component fingerprints in the fingerprint database in turn; if a known component fingerprint is matched, update the hit rate of the corresponding component fingerprint; otherwise, store the fingerprint of the component to be identified as an unknown component fingerprint in the fingerprint database, and its initial hit rate is 0.

[0056] In this example, by crawling 10,000 mobile communication network elements, 227 unknown component fingerprints were discovered. After updating the hit rate of these 227 unknown component fingerprints during the crawling process and comparing it with a preset threshold, 147 of these component fingerprints were manually identified as known components in the initial fingerprint database, and these 147 component fingerprints were saved as known component fingerprints. 80 of these component fingerprints were manually identified as corresponding to 31 newly discovered components, and these 80 component fingerprints were saved as known component fingerprints. Based on these 80 component fingerprints and the corresponding components, component-related keyword fingerprints were determined. The constructed network element component fingerprint database includes the initial fingerprint database and the 227 component fingerprints saved as known component fingerprints.

[0057] This embodiment discloses a method for identifying network element components in a mobile communication network. The method performs preliminary identification of components by matching keywords obtained from network element detection response messages with keyword fingerprints in a fingerprint database. Then, it performs component fingerprint matching based on hit rate ranking to further accurately identify components, which significantly improves the efficiency of component identification. By automatically crawling component fingerprints of network element components in the network to build a fingerprint database, the method solves the problem of time-consuming and labor-intensive manual collection and organization of traditional component fingerprint databases.

[0058] System Implementation Examples

[0059] A specific embodiment of the present invention discloses an apparatus for identifying network element components in a mobile communication network, including a fingerprint detection module, a component identification module, and a fingerprint database management module.

[0060] Specifically, the fingerprint detection module is used to construct a mobile communication network element detection request, obtain keywords and construct the fingerprint of the component to be identified based on the corresponding network element detection response message.

[0061] Specifically, the fingerprint detection module includes a detection request module and a fingerprint construction module:

[0062] The probe request module is used to send network element probe requests to mobile communication network elements in the network;

[0063] The fingerprint construction module is used to obtain keywords and construct the fingerprint of the component to be identified based on the corresponding network element detection response message.

[0064] Specifically, the component identification module is used to match the keyword with the fingerprint to be identified and the fingerprint in the fingerprint database, and identify the component based on the matching result.

[0065] Specifically, the component failure module includes a keyword matching module and a component fingerprint matching module:

[0066] The keyword matching module is used to match the keyword with the keyword fingerprint in the fingerprint database and to initially determine the network element component based on the successfully matched keyword fingerprint;

[0067] The component fingerprint matching module is used to match the fingerprint of the component to be identified with the component fingerprint corresponding to the preliminarily determined network element component and to identify the component fingerprint based on the successfully matched component fingerprint, or to match the unmatched fingerprint of the component to be identified with the component fingerprints in the fingerprint database in sequence and to identify the component fingerprint based on the successfully matched known component fingerprint.

[0068] Specifically, the fingerprint database management module is used to build the fingerprint database and update the fingerprint database based on the recognition results of the fingerprint to be identified.

[0069] Specifically, updating the fingerprint database based on the recognition result of the fingerprint to be identified includes: sorting the component fingerprints in the fingerprint database according to their respective hit rates, matching them based on the sorting order, prioritizing matching component fingerprints with high hit rates, updating the hit rate of the corresponding component fingerprint if the match is successful, and storing the component fingerprint to be identified as an unknown component fingerprint in the fingerprint database if the match fails; the hit rate of the component fingerprint refers to the number of times the component fingerprint has been successfully matched.

[0070] Compared with the prior art, the beneficial effects of the device for identifying network element components in a mobile communication network provided in this embodiment are basically the same as those provided in the method embodiment, and will not be described in detail here.

[0071] It should be noted that the above embodiments are based on the same inventive concept, and any parts not described repeatedly can be referenced from each other.

[0072] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying network element components in a mobile communication network, characterized in that, Includes the following steps: Step S01: Match the keywords obtained from the network element detection response message with the keyword fingerprints in the fingerprint database; if the match is successful, preliminarily determine the network element component based on the keyword fingerprints and proceed to step S02; if the match fails, proceed to step S03. Step S02: Match the fingerprint of the component to be identified constructed based on the network element detection response message with the component fingerprint corresponding to the preliminarily determined network element component; if the match is successful, the preliminarily determined network element component is the component identification result; If the match fails, proceed to step S03; Step S03: Match the fingerprint of the component to be identified with the component fingerprints in the fingerprint database sequentially; if a known component fingerprint is matched, the network element component corresponding to the known component fingerprint is the component identification result; otherwise, the component identification fails; after the component identification fails, the component fingerprint to be identified is stored in the fingerprint database as an unknown component fingerprint; the number of times each component fingerprint in the fingerprint database is successfully matched is recorded as the hit rate of the component fingerprint; when the hit rate of a component fingerprint is lower than a preset threshold, the component fingerprint is recorded as an unknown component fingerprint; otherwise, the component corresponding to the fingerprint is manually determined, the component fingerprint is recorded as a known component fingerprint, and the component corresponding to the component fingerprint and the keyword fingerprint corresponding to the component are determined. The step of matching the fingerprint of the component to be identified with the component fingerprints in the fingerprint database in sequence includes: sorting the component fingerprints in the fingerprint database according to their hit rates, and prioritizing the matching of component fingerprints with higher hit rates based on the sorting order.

2. The method for identifying network element components in a mobile communication network according to claim 1, characterized in that, In the fingerprint database, one network element component corresponds to one or more corresponding keyword fingerprints, and one network element component corresponds to one or more corresponding known component fingerprints.

3. The method for identifying network element components in a mobile communication network according to claim 1, characterized in that, Keyword extraction is performed based on the response header and HTML text information of the network element detection response message, including extracting the XPoweredBy, Server, and SetCookie fields as keywords.

4. The method for identifying network element components in a mobile communication network according to claim 1, characterized in that, The fingerprint of the component to be identified is constructed based on the network element detection response message, including: Obtain the JS and CSS files from the network element detection response message, construct a static address fingerprint based on the file name and the corresponding static file address, construct a static file fingerprint based on the file name and the corresponding file MD5 value, and use the static address fingerprint and static file fingerprint as the fingerprint of the component to be identified.

5. A device for identifying network element components in a mobile communication network, characterized in that, include: The fingerprint detection module is used to construct a mobile communication network element detection request, obtain keywords and construct the fingerprint of the component to be identified based on the corresponding network element detection response message; The fingerprint detection module includes a detection request module and a fingerprint construction module. The detection request module is used to send a network element detection request to the mobile communication network element in the network. The fingerprint construction module is used to obtain keywords and construct the fingerprint of the component to be identified based on the corresponding network element detection response message. A component identification module is used to match the keyword with the fingerprint to be identified and the fingerprints in the fingerprint database, and to identify the component based on the matching result. The component identification module includes a keyword matching module and a component fingerprint matching module. The keyword matching module is used to match the keyword with the keyword fingerprints in the fingerprint database and to initially determine the network element component based on the successfully matched keyword fingerprints. The component fingerprint matching module is used to match the fingerprint of the component to be identified with the component fingerprints corresponding to the initially determined network element component and to identify the component based on the successfully matched component fingerprints, or to match the unmatched fingerprint of the component to be identified with the component fingerprints in the fingerprint database in sequence and to identify the component based on the successfully matched known component fingerprints. After a component identification fails, the module also includes storing the fingerprint of the component to be identified as an unknown component fingerprint in the fingerprint database. The number of times each component fingerprint in the fingerprint database is successfully matched is recorded as the hit rate of that component fingerprint. When the hit rate of a component fingerprint is lower than a preset threshold, the component fingerprint is recorded as an unknown component fingerprint; otherwise, the component corresponding to the fingerprint is manually determined, the component fingerprint is recorded as a known component fingerprint, and the component corresponding to the component fingerprint and the keyword fingerprint corresponding to the component are determined. The fingerprint database management module is used to construct a fingerprint database and update the fingerprint database based on the recognition results of the fingerprint to be identified. Updating the fingerprint database based on the recognition results of the fingerprint to be identified includes: sorting component fingerprints in the fingerprint database according to their respective hit rates, matching them based on the sorting order, prioritizing matching component fingerprints with higher hit rates, updating the hit rate of the corresponding component fingerprint if a match is successful, and storing the component fingerprint to be identified as an unknown component fingerprint in the fingerprint database if a match fails. The hit rate of a component fingerprint refers to the number of times that component fingerprint has been successfully matched.

Images