Enterprise internet deployment product environment troubleshooting method, system, terminal and medium

Abstract

The present application relates to the field of enterprise asset investigation, and specifically discloses a method and system for investigating the environment of enterprise internet deployment products, a terminal and a medium. An asset fingerprint feature library of enterprise recorded assets is established based on an enterprise recorded asset information table. Each asset search engine interface is called to aggregate search the assets, and the searched asset information is filled into an enterprise asset scanning table. Cross analysis is performed on the asset information in the enterprise asset scanning table to establish an asset aggregation table and an asset difference table. Cross verification is performed on the assets in the asset difference table to screen out to-be-determined asset information. The IP and port information contained in the to-be-determined asset information is compared with the IP and port information in the asset fingerprint feature library to determine suspicious assets. The present application improves the accuracy and efficiency of enterprise product investigation.

Description

Technical Field

[0001] This invention relates to the field of enterprise asset screening, specifically to a method, system, terminal, and medium for screening enterprise internet deployment product environments. Background Technology

[0002] Network asset collection refers to the process of tracking and understanding the status of network assets, which typically includes host discovery, operating system identification, and service identification. It is an important prerequisite for achieving network security management and has wide application value in network security-related work.

[0003] With the development of internet technology, internet assets are constantly increasing, and these assets also face more and more cyberattacks and risks. Deploying enterprise products on the internet increases the risk of attack. However, some employees, due to low security awareness, disregard company security regulations and may privately build product environments on the internet without filing or approval with the company's security department. These environments are usually not security-tested, making them vulnerable to cyberattacks, increasing the difficulty of managing enterprise assets, and exposing the enterprise to more security risks. Collecting information on enterprise product environments deployed on the internet and shutting down privately deployed product environments can effectively reduce the risk of attack.

[0004] Currently, network asset mapping technology can be used to investigate the internet-deployed product environments of enterprises. While various methods and tools exist for network asset mapping, single asset search methods or tools suffer from incomplete scan results, false alarms, reduced accuracy, and inefficient manual analysis of scan results, all of which inconvenience enterprises in investigating their internet-deployed product environments. Summary of the Invention

[0005] To address the aforementioned issues, this invention provides a method, system, terminal, and system for investigating enterprise internet-deployed product environments. It utilizes multiple asset search tools for aggregated searches and analyzes and verifies the search results to identify suspicious assets, thereby improving the accuracy and efficiency of investigating enterprise products deployed on the internet and reducing the risk of enterprise attacks.

[0006] In a first aspect, the technical solution of the present invention provides a method for troubleshooting enterprise internet deployment product environments, comprising the following steps: Establish an asset fingerprint feature database for the enterprise's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images; Using at least one element of the fingerprint feature information in the asset fingerprint feature database as a search condition, search for assets using various asset search engines, and populate the enterprise asset scanning table with the asset information found; the asset information includes the actual website product identifier and the actual website address information; there are no fewer than two asset search engines; Cross-analysis and verification of asset information in the enterprise asset scanning table are performed to filter out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. These are recorded as asset information to be determined. The actual website address information contained in the asset information to be determined is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined will be classified as a suspicious asset.

[0007] In one optional implementation, an asset fingerprint feature database of the enterprise's registered assets is established, specifically including: Query the company's registered asset information table; Fingerprint feature information of each asset in the registered asset information table is extracted through website crawling and manual analysis. The extracted asset fingerprint feature information is added to the asset fingerprint feature database.

[0008] In one optional implementation, the asset information in the enterprise asset scanning table is cross-analyzed and verified to filter out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. This information is recorded as asset information to be determined, specifically including: The asset information that appears only once in the enterprise asset scan table is stored in the asset difference table, and the asset information that appears at least twice in the actual website address table is stored in the asset aggregation table. The initial value for the number of cross-analysis steps for each actual website address information in the asset difference table and asset aggregation table; where the initial value for the number of cross-analysis steps is 0. Extract each asset information from the asset aggregation table sequentially, compare the actual website product identifier contained in the current asset information with the standard website product identifier in the asset fingerprint feature database; and increment the cross-analysis count of the actual website address information by 1. In response to the fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database, the number of cross-analysis counts of the actual website address contained in the current asset information is detected. If the number of cross-analysis counts for the actual website address contained in the current asset information is 1, then the current asset information will be transferred to the asset difference table; otherwise, the current asset information will be deleted. Extract each asset information from the asset difference table in sequence, use the actual website address information contained in the current asset information as input, and call other asset search engines to search for the asset; other asset search engines refer to asset search engines other than the asset search engine fingerprint to which the current asset information belongs. If other asset search engines can find the actual website address information contained in the current asset information, then the current asset information found by other asset search engines will be transferred to the asset aggregation table. If no other asset search engine can find the actual website address information contained in the current asset information, then the current asset information will be deleted. The final asset information included in the asset aggregation table is the asset information to be determined.

[0009] In one optional implementation, the website product identifier includes the website title and the website icon hash value; Correspondingly, the fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database means that neither the website title nor the website icon hash value contained in the current asset information is included in the asset fingerprint feature database.

[0010] In one optional implementation, assets whose actual website address information appears only once in the enterprise asset scan table are stored in the asset discrepancy table, while assets whose actual website address information appears at least twice are stored in the asset aggregation table. Specifically, this includes: Extract the actual website address information of the first asset information corresponding to the first search engine in the enterprise asset scan table; Detect whether the asset information searched by other asset search engines contains the same actual website address information; If not included, the first asset information corresponding to the first asset search engine is stored in the asset difference table; otherwise, the first asset information corresponding to the first asset search engine is stored in the asset aggregation table. This process continues until all asset information in the enterprise asset scan table has been traversed.

[0011] In one optional implementation, the website address information includes the website IP address and port information.

[0012] In an optional implementation, the actual website address information contained in the asset information to be determined is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined is classified as a suspicious asset. Specifically, this includes: The actual website address information contained in the asset information in the asset aggregation table is compared with the standard website address information in the asset fingerprint feature database; If the standard website address information in the asset fingerprint feature database does not exist in the asset aggregation table, the corresponding asset information will be recorded as a first-class suspicious asset and stored in the enterprise asset information confirmation table. If the actual website address information in the asset aggregation table does not exist in the asset fingerprint feature database, the corresponding asset information will be recorded as a second-class suspicious asset and stored in the enterprise asset information confirmation table. For the second category of suspicious assets in the Enterprise Asset Information Confirmation Table, determine whether the website IP address contained in the actual website address information is within the enterprise's public IP network segment; If so, it is still recorded as a Category II suspicious asset; otherwise, it is recorded as a Category III suspicious asset. Output the final Enterprise Asset Information Confirmation Form with Suspicious Asset Categories.

[0013] Secondly, the technical solution of the present invention provides an enterprise internet deployment product environment investigation system, including, Fingerprint Feature Database Establishment Module: Establishes an asset fingerprint feature database for the company's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images; Asset search module: Using at least one element of fingerprint feature information from the asset fingerprint feature database as a search condition, the module searches for assets using various asset search engines and populates the enterprise asset scanning table with the asset information found. The asset information includes the actual website product identifier and the actual website address information. There are no fewer than two asset search engines. Asset screening module: Cross-analyzes and verifies the asset information in the enterprise asset scanning table, and filters out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database, and records them as asset information to be determined; Asset screening module: The actual website address information contained in the asset information to be identified is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be identified does not exist in the asset fingerprint feature database, the corresponding asset information to be identified is screened as a suspicious asset.

[0014] Thirdly, the technical solution of the present invention provides a terminal, comprising: The storage device is used to store troubleshooting procedures for enterprise internet-deployed product environments. A processor is used to implement the steps of the enterprise internet deployment product environment investigation method as described above when executing the enterprise internet deployment product environment investigation program.

[0015] Fourthly, the present invention provides a computer-readable storage medium storing an enterprise internet deployment product environment troubleshooting program, wherein the enterprise internet deployment product environment troubleshooting program, when executed by a processor, implements the steps of the enterprise internet deployment product environment troubleshooting method as described in any of the above claims.

[0016] This invention provides a method, device, terminal, and medium for investigating the environment of enterprise internet-deployed products. Compared with existing technologies, it has the following advantages: It pre-configures a fingerprint feature database of the enterprise's registered assets, then uses multiple asset search tools to scan them. The fingerprint feature database is combined with the analysis and verification of the asset information scanned by these tools to identify suspicious assets. This invention uses multiple asset search tools for aggregated searches and analyzes and verifies the search results to identify suspicious assets, improving the accuracy and efficiency of investigating enterprise products deployed on the internet and reducing the risk of attacks. Simultaneously, this invention achieves automatic investigation of suspicious assets, eliminating the need for extensive manual analysis and improving investigation efficiency. Furthermore, this invention uses cross-analysis and verification of the information scanned by various asset search tools for asset screening, improving the screening accuracy and thus enhancing the accuracy and effectiveness of suspicious asset investigation. Additionally, classifying suspicious assets facilitates subsequent processing and improves processing efficiency. Attached Figure Description To more clearly illustrate the technical solutions of the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of a method for troubleshooting an enterprise's internet deployment product environment, provided by an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram illustrating the principle and flow of a specific embodiment of a method for investigating the enterprise internet deployment product environment provided by this invention.

[0019] Figure 3 yes Figure 2 The diagram shown is a schematic representation of the enterprise asset analysis process in a specific embodiment.

[0020] Figure 4 yes Figure 2 The diagram shown illustrates a specific embodiment of the enterprise suspicious asset screening process.

[0021] Figure 5 This is a schematic block diagram of an enterprise internet deployment product environment investigation system provided in an embodiment of the present invention.

[0022] Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0025] The key terms used in this invention will be explained below.

[0026] URL: Uniform Resource Locator, is a concise representation of the location and access method of a resource that can be obtained from the Internet. It is the address of a standard resource on the Internet.

[0027] Figure 1 This is a schematic diagram of a method for troubleshooting enterprise internet deployment product environments provided by an embodiment of the present invention, wherein... Figure 1 The executing entity can be a system for investigating the environment of enterprise internet deployment products. The method for investigating the environment of enterprise internet deployment products provided in this embodiment of the invention is executed by a computer device; correspondingly, the system for investigating the environment of enterprise internet deployment products runs on the computer device. Depending on different needs, the order of the steps in this flowchart can be changed, and some steps can be omitted.

[0028] like Figure 1 As shown, the method includes the following steps.

[0029] S1, Establish an asset fingerprint feature database for the company's registered assets.

[0030] The asset fingerprint feature database contains fingerprint feature information for each registered asset. This fingerprint feature information includes standard website product identifiers, standard website address information, and standard website homepage images. It should be noted that the standard website product identifiers, standard website address information, and standard website homepage images refer to the website product identifiers, website address information, and website homepage images of registered assets. Website product identifiers generally include the website title and website icon hash value. For a standard website, the website address information can be a specific URL.

[0031] Fingerprint information is used to uniquely identify assets. Each asset has a unique fingerprint. In addition to standard website product identifiers, standard website address information, and standard website homepage images, fingerprint information may also include other information, such as JS files.

[0032] S2, using at least one element of the fingerprint feature information in the asset fingerprint feature database as a search condition, search for the assets using each asset search engine, and fill the enterprise asset scanning table with the asset information found by each search.

[0033] The asset information includes the actual website product identifier and the actual website address information; there are no fewer than two asset search engines, such as fofa and quake.

[0034] Actual website product identifiers and actual website address information refer to the website product identifiers and website address information of the assets actually found by the asset search engine.

[0035] The fingerprint feature information in the asset fingerprint feature database is used as the search criteria. The fingerprint feature information contains a variety of elements. Users select the corresponding fingerprint feature elements for searching according to the usage rules or specifications of each asset search engine.

[0036] S3. Cross-analyze and verify the asset information in the enterprise asset scanning table, and filter out the asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. Record these as asset information to be determined.

[0037] The asset information is filtered using the actual website address information and the actual website product identifier contained within it. Assets awaiting further investigation are those whose actual website address information can be found by at least two asset search engines, and whose corresponding actual website product identifier exists in the asset fingerprint feature database. It should be noted that since the search criteria of asset search engines are not necessarily website product identifiers, the actual website product identifiers found in the search may not necessarily be in the fingerprint feature database.

[0038] S4. Compare the actual website address information contained in the asset information to be determined with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined will be identified as a suspicious asset.

[0039] The previous step has already filtered out asset information whose actual website product identifiers are included in the asset fingerprint feature database. Then, the actual website address information of these asset information is compared. If the actual website address information exists in the asset fingerprint feature database, it means that the asset is a normal and registered asset. If the actual website address information does not exist in the asset fingerprint feature database, it means that the asset is a suspicious asset and the product has been deployed on an unregistered website address.

[0040] This embodiment provides a method for investigating enterprise internet-deployed product environments. It pre-configures a fingerprint feature database of the enterprise's registered assets, then uses multiple asset search tools to scan them. The method combines the fingerprint feature database with the asset information scanned by these tools to analyze and verify the data, identifying suspicious assets. This embodiment uses multiple asset search tools for aggregated searches and analyzes and verifies the search results to identify suspicious assets, improving the accuracy and efficiency of investigating enterprise products deployed on the internet and reducing the risk of attacks. Furthermore, this embodiment achieves automatic investigation of suspicious assets, eliminating the need for extensive manual analysis and improving investigation efficiency.

[0041] To further understand the present invention, a specific embodiment is provided below to illustrate the invention in a more detailed manner. Figure 2 This is a schematic diagram of the principle and process of this specific embodiment. First, an asset fingerprint feature database is established based on the enterprise's registered asset information table. Then, an asset aggregation scan is performed. Next, the assets are analyzed through cross-analysis and cross-validation. Based on the analysis results, suspicious assets are screened out. Finally, an enterprise asset information confirmation table is output.

[0042] Step 1: Establish an asset fingerprint feature database.

[0043] The assets that a company has registered will be filled into the company's registered asset information table. First, the company's registered asset information table is queried to obtain all registered assets. Then, fingerprint feature information of each registered asset is extracted through web crawling and manual analysis. The extracted asset fingerprint feature information is added to the asset fingerprint feature database.

[0044] Fingerprint information should accurately describe a company's assets. Fingerprint information includes website product identifiers, website-specific addresses (i.e., website characteristic URLs), website homepage images, and website JS files, etc. Among them, website identifiers can be the website title and the website icon hash value.

[0045] It should be noted that a specific URL of a website contains the website's IP address and port information, which are part of the website's address information.

[0046] Step 2, aggregate scanning of enterprise assets.

[0047] Each asset search engine was used to scan the company's assets, and the extracted asset information was then populated into the company's asset scan table. Asset information includes actual website product identifiers and actual website address information.

[0048] Specifically, based on different fingerprint features in the asset fingerprint feature database, different asset search engine interfaces, such as fofa and quake, are called to establish fingerprint combination operations using "OR operation" or "AND operation" respectively, to perform enterprise asset aggregation scanning. The aggregation scan results are then analyzed to extract information such as IP, port, website title, and website icon hash value, which are stored in the enterprise asset scanning table. It should be noted that the enterprise asset scanning table should include the asset search engine number information.

[0049] It should be noted that different asset search engines use different operations. Some asset search engines use "OR" operations, while others use "AND" operations. Users should choose the operation rules and specific input conditions according to the usage rules of the asset search engine.

[0050] Since different asset search engine interfaces produce different scanning results, if information such as the website icon hash value cannot be extracted, relevant interfaces can be extracted by running a web crawler on the scanned website, and the website icon hash value can be obtained using a hash calculation tool and stored in the enterprise asset scanning table.

[0051] Step 3, Enterprise Asset Analysis.

[0052] The analysis of enterprise assets includes two parts: cross-analysis and cross-validation, which ultimately filters out the asset information to be determined.

[0053] Figure 3 This is a schematic diagram of the enterprise asset analysis process in this specific embodiment, which includes the following steps, wherein steps S302-S304 are the cross-analysis part, and steps S305-S307 are the cross-validation part.

[0054] S300 filters out assets from the enterprise asset scan table whose actual website address information appears only once and stores them in the asset difference table, while assets whose actual website address information appears at least twice are stored in the asset aggregation table.

[0055] Website address information includes website IP address and port information. First, analyze the IP and port, extract assets with the same IP and port from any two asset search engine IDs, and store them in the asset aggregation table. Other assets are stored in the asset difference table.

[0056] In an optional implementation, the asset information is classified and stored through the following process: extract the actual website address information of the first asset information corresponding to the first asset search engine in the enterprise asset scanning table; detect whether the asset information searched by other asset search engines contains the same actual website address information; if not, store the first asset information corresponding to the first asset search engine in the asset difference table; otherwise, store the first asset information corresponding to the first asset search engine in the asset aggregation table; and so on, until all asset information in the enterprise asset scanning table has been traversed.

[0057] S301 is the initial value for the number of cross-analysis steps for each actual website address in the asset difference table and the asset aggregation table.

[0058] The initial number of cross-analysis iterations was 0.

[0059] The cross-analysis count is used to record the number of cross-analysis analyses performed on asset information that contains the same website address. The cross-analysis count is incremented by 1 each time a cross-analysis is completed.

[0060] S302, sequentially extract each asset information from the asset aggregation table, compare the actual website product identifier contained in the current asset information with the standard website product identifier in the asset fingerprint feature database; and configure the cross-analysis count of the actual website address information to be incremented by 1.

[0061] S303, in response to the fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database, detect the number of cross-analysis of the actual website address contained in the current asset information.

[0062] Website product identification includes the website title and the website icon hash value.

[0063] The fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database means that neither the website title nor the website icon hash value contained in the current asset information is included in the asset fingerprint feature database.

[0064] If either the website title or the website icon hash value exists in the asset fingerprint feature database, the corresponding asset information is retained in the asset aggregation table.

[0065] S304. If the number of cross-analysis counts for the actual website address contained in the current asset information is 1, then the current asset information is transferred to the asset difference table; otherwise, the current asset information is deleted.

[0066] If neither the website title nor the website icon hash value is included in the asset fingerprint feature database, the cross-analysis count of the actual website address information contained in the asset information is then checked. If it is 1, it indicates the first analysis for the current actual website address, and the asset information is transferred to the asset difference table for cross-validation. If it is not 1, but at most 2, it indicates the second analysis for the current actual website address. If the second analysis also finds that the actual website product identifier does not exist in the asset fingerprint feature database, the current asset information is directly deleted. The second analysis involves transferring the asset information from the asset aggregation table to the asset difference table, and simultaneously satisfying the cross-validation conditions in the asset difference table, before transferring it back to the asset aggregation table. It should be noted that the asset information transferred back to the asset aggregation table is obtained by searching using other asset search engines, using the actual website address information contained in the original asset information (referring to the asset information transferred from the asset aggregation table to the asset difference table) as input conditions. The actual website product identifier contained in the new asset information may be different from that contained in the original asset information.

[0067] S305: Extract the asset information from the asset difference table in sequence, use the actual website address information contained in the current asset information as input, and call other asset search engines to search for the asset.

[0068] Other asset search engines refer to asset search engines other than the asset search engine fingerprint to which the current asset information belongs.

[0069] Steps S302-S304 above involve cross-analysis of asset information in the asset aggregation table, while steps S305-S307 involve cross-validation of asset information in the asset difference table. Since the asset information retrieved by the asset search engine is generally cached information from a certain period ago, the actual website address information is used as a search criterion for the asset information in the asset difference table to verify whether the actual website address is still active.

[0070] The asset information in the asset difference table includes the initial asset information and asset information transferred from the asset aggregation table. For cross-validation of the asset information in the asset difference table, the actual website address information contained in the current asset information is used as input to call other asset search engines to search for the assets. Other asset search engines refer to asset search engines other than the asset search engine fingerprint to which the current asset information belongs. It should be noted that asset information transferred from the asset aggregation table is originally searchable by multiple asset search engines; it can be transferred to any of these asset search engines during the transfer process.

[0071] S306 If other asset search engines can find the actual website address information contained in the current asset information, then the current asset information found by other asset search engines will be transferred to the asset aggregation table.

[0072] S307 If other asset search engines cannot find the actual website address information contained in the current asset information, then the current asset information will be deleted.

[0073] If other asset search engines can find the actual website address information contained in the current asset information, it means that the actual website address information contained in the current asset information is alive. In this case, the new current asset information found by other asset search engines is transferred to the asset aggregation table and cross-analysis is performed again. This will increase the number of cross-analysis operations for the actual website address information contained in the asset information.

[0074] Based on the above cross-analysis and cross-validation, the asset information ultimately included in the asset aggregation table is the asset information to be determined.

[0075] Step 4: Screening for suspicious assets of the enterprise.

[0076] Figure 4 This is a schematic diagram of the enterprise suspicious asset screening process in this specific embodiment, which includes the following steps.

[0077] S401 compares the actual website address information contained in the asset information in the asset aggregation table with the standard website address information in the asset fingerprint feature database.

[0078] S402, if the standard website address information in the asset fingerprint feature database does not exist in the asset aggregation table, the corresponding asset information will be recorded as a first-class suspicious asset and stored in the enterprise asset information confirmation table.

[0079] If the standard website address information in the asset fingerprint feature database does not exist in the asset aggregation table, the asset service may no longer be in use and is classified as a Category I suspicious asset. S403 If the actual website address information in the asset aggregation table does not exist in the asset fingerprint feature database, the corresponding asset information shall be recorded as a second-class suspicious asset and stored in the enterprise asset information confirmation table.

[0080] If the actual website address information in the asset aggregation table does not exist in the asset fingerprint feature database, the asset may be a service privately deployed by an employee and is marked as a Category II suspicious asset.

[0081] S404, for Category 2 suspicious assets in the Enterprise Asset Information Confirmation Form, determine whether the website IP address contained in the actual website address information is within the enterprise's public IP network segment.

[0082] S405 If so, it is still recorded as a Category II doubtful asset; otherwise, it is recorded as a Category III doubtful asset.

[0083] S406 outputs the final Enterprise Asset Information Confirmation Form with Suspicious Asset Categories.

[0084] Once the first type of suspicious asset is confirmed, if the service has been discontinued, it should be removed from the enterprise's registered asset information table. Once the second type of suspicious asset is confirmed, the relevant service should be disabled or the asset should be entered into the enterprise's registered asset information table after registration. The third type of suspicious asset may be customer assets or assets of enterprises deployed in public clouds. If it is an asset of an enterprise deployed in public clouds, it should be entered into the enterprise's registered asset information table after registration. If it is a customer asset, the customer should be notified of the relevant security risks.

[0085] The foregoing has described in detail an embodiment of a method for troubleshooting enterprise internet deployment product environments. Based on the enterprise internet deployment product environment troubleshooting method described in the above embodiment, this invention also provides an enterprise internet deployment product environment troubleshooting system corresponding to the method.

[0086] Figure 5 This is a schematic block diagram of an enterprise internet deployment product environment troubleshooting system 500 provided in an embodiment of the present invention. The enterprise internet deployment product environment troubleshooting system 500 can be divided into multiple functional modules according to its functions, such as... Figure 5 As shown. The functional modules may include: a fingerprint feature database establishment module 501, an asset search module 502, an asset screening module 503, and an asset investigation module 504. The module referred to in this invention is a series of computer program segments that can be executed by at least one processor and perform a fixed function, and which are stored in memory.

[0087] Fingerprint Feature Database Establishment Module 501: Establishes an asset fingerprint feature database for the enterprise's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images.

[0088] Asset search module 502: Uses at least one element of fingerprint feature information in the asset fingerprint feature database as a search condition, searches for assets using various asset search engines, and populates the asset information found into the enterprise asset scanning table; the asset information includes the actual website product identifier and the actual website address information; there are no fewer than two asset search engines.

[0089] Asset Screening Module 503: Performs cross-analysis and verification on the asset information in the enterprise asset scanning table, and filters out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. These are recorded as asset information to be determined.

[0090] Asset screening module 504: Compare the actual website address information contained in the asset information to be identified with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be identified does not exist in the asset fingerprint feature database, the corresponding asset information to be identified will be screened as a suspicious asset.

[0091] In an optional implementation, the fingerprint feature database establishment module 501 is specifically configured to query the enterprise's registered asset information table; extract the fingerprint feature information of each asset in the registered asset information table through web crawling and manual analysis; and add the extracted asset fingerprint feature information to the asset fingerprint feature database.

[0092] In an optional implementation, the asset screening module 503 is specifically configured to: The asset information that appears only once in the enterprise asset scan table is stored in the asset difference table, and the asset information that appears at least twice in the actual website address table is stored in the asset aggregation table. The initial value for the number of cross-analysis steps for each actual website address information in the asset difference table and asset aggregation table; where the initial value for the number of cross-analysis steps is 0. Extract each asset information from the asset aggregation table sequentially, compare the actual website product identifier contained in the current asset information with the standard website product identifier in the asset fingerprint feature database; and increment the cross-analysis count of the actual website address information by 1. In response to the fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database, the number of cross-analysis counts of the actual website address contained in the current asset information is detected. If the number of cross-analysis counts for the actual website address contained in the current asset information is 1, then the current asset information will be transferred to the asset difference table; otherwise, the current asset information will be deleted. Extract each asset information from the asset difference table in sequence, use the actual website address information contained in the current asset information as input, and call other asset search engines to search for the asset; other asset search engines refer to asset search engines other than the asset search engine fingerprint to which the current asset information belongs. If other asset search engines can find the actual website address information contained in the current asset information, then the current asset information found by other asset search engines will be transferred to the asset aggregation table. If other asset search engines cannot find the actual website address information contained in the current asset information, then the current asset information will be deleted.

[0093] The asset information ultimately included in the asset aggregation table is the asset information to be determined.

[0094] In one optional implementation, the website product identifier includes the website title and the website icon hash value; correspondingly, the fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database means that neither the website title nor the website icon hash value contained in the current asset information is included in the asset fingerprint feature database.

[0095] In an optional implementation, the asset filtering module 503 filters out asset information from the enterprise asset scan table where the actual website address information appears only once and stores it in the asset discrepancy table; asset information where the actual website address information appears at least twice and stores it in the asset aggregation table. Specifically, this includes: Extract the actual website address information of the first asset information corresponding to the first search engine in the enterprise asset scan table; Detect whether the asset information searched by other asset search engines contains the same actual website address information; If not included, the first asset information corresponding to the first asset search engine is stored in the asset difference table; otherwise, the first asset information corresponding to the first asset search engine is stored in the asset aggregation table. This process continues until all asset information in the enterprise asset scan table has been traversed.

[0096] In one optional implementation, the website address information includes the website IP address and port information.

[0097] In an optional implementation, the asset screening module 504 is specifically configured to: The actual website address information contained in the asset information in the asset aggregation table is compared with the standard website address information in the asset fingerprint feature database; If the standard website address information in the asset fingerprint feature database does not exist in the asset aggregation table, the corresponding asset information will be recorded as a first-class suspicious asset and stored in the enterprise asset information confirmation table. If the actual website address information in the asset aggregation table does not exist in the asset fingerprint feature database, the corresponding asset information will be recorded as a second-class suspicious asset and stored in the enterprise asset information confirmation table. For the second category of suspicious assets in the Enterprise Asset Information Confirmation Table, determine whether the website IP address contained in the actual website address information is within the enterprise's public IP network segment; If so, it is still recorded as a Category II suspicious asset; otherwise, it is recorded as a Category III suspicious asset. Output the final Enterprise Asset Information Confirmation Form with Suspicious Asset Categories.

[0098] Since the enterprise internet deployment product environment investigation system in this embodiment is used to implement the aforementioned enterprise internet deployment product environment investigation method, its function corresponds to the function of the above method, and will not be repeated here.

[0099] Figure 6 A schematic diagram of a terminal 600 provided in an embodiment of the present invention includes: a processor 610, a memory 620, and a communication unit 630. The processor 610 is used to implement the following steps when executing the enterprise internet deployment product environment troubleshooting program stored in the memory 620: Establish an asset fingerprint feature database for the enterprise's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images; Using at least one element of the fingerprint feature information in the asset fingerprint feature database as a search condition, search for assets using various asset search engines, and populate the enterprise asset scanning table with the asset information found; the asset information includes the actual website product identifier and the actual website address information; there are no fewer than two asset search engines; Cross-analysis and verification of asset information in the enterprise asset scanning table are performed to filter out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. These are recorded as asset information to be determined. The actual website address information contained in the asset information to be determined is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined will be classified as a suspicious asset.

[0100] This invention utilizes multiple asset search tools for aggregated searches and analyzes and verifies the search results to identify suspicious assets. This improves the accuracy and efficiency of screening products deployed by enterprises on the internet, reducing the risk of attacks. Furthermore, this invention automates the screening of suspicious assets, eliminating the need for extensive manual analysis and thus increasing screening efficiency. The terminal 600 includes a processor 610, a memory 620, and a communication unit 630. These components communicate via one or more buses. Those skilled in the art will understand that the server structure shown in the figures does not constitute a limitation of the present invention. It can be a bus topology or a star topology, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0101] The memory 620 can be used to store the execution instructions of the processor 610. The memory 620 can be implemented by any type of volatile or non-volatile storage terminal or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. When the execution instructions in the memory 620 are executed by the processor 610, the terminal 600 is able to perform some or all of the steps in the above method embodiments.

[0102] The processor 610 serves as the control center of the storage terminal, connecting various parts of the electronic terminal via various interfaces and lines. It executes software programs and / or modules stored in the memory 620, and calls data stored in the memory to perform various functions of the electronic terminal and / or process data. The processor can be composed of integrated circuits (ICs), such as a single packaged IC or multiple packaged ICs with the same or different functions connected together. For example, the processor 610 may only include a central processing unit (CPU). In this embodiment of the invention, the CPU may have a single processing core or include multiple processing cores.

[0103] The communication unit 630 is used to establish a communication channel, enabling the storage terminal to communicate with other terminals. It can receive user data sent by other terminals or send user data to other terminals.

[0104] The present invention also provides a computer storage medium, which may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM), etc.

[0105] The computer storage medium stores an enterprise internet deployment product environment troubleshooting program. When the enterprise internet deployment product environment troubleshooting program is executed by the processor, it performs the following steps: Establish an asset fingerprint feature database for the enterprise's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images; Using at least one element of the fingerprint feature information in the asset fingerprint feature database as a search condition, search for assets using various asset search engines, and populate the enterprise asset scanning table with the asset information found; the asset information includes the actual website product identifier and the actual website address information; there are no fewer than two asset search engines; Cross-analysis and verification of asset information in the enterprise asset scanning table are performed to filter out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. These are recorded as asset information to be determined. The actual website address information contained in the asset information to be determined is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined will be classified as a suspicious asset.

[0106] This invention utilizes multiple asset search tools for aggregated searches and analyzes and verifies the search results to identify suspicious assets. This improves the accuracy and efficiency of screening products deployed by enterprises on the internet, reducing the risk of attacks. Furthermore, this invention automates the screening of suspicious assets, eliminating the need for extensive manual analysis and thus increasing screening efficiency. Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium such as a USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, or other media capable of storing program code. It includes several instructions to cause a computer terminal (which may be a personal computer, server, or a second terminal, network terminal, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0107] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0108] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0109] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0110] The above-disclosed embodiments are merely preferred embodiments of the present invention, but the present invention is not limited thereto. Any non-creative variations that can be conceived by those skilled in the art, as well as any improvements and modifications made without departing from the principles of the present invention, should fall within the protection scope of the present invention.

Claims

1. A method for troubleshooting enterprise internet deployment product environments, characterized in that, Includes the following steps: Establish an asset fingerprint feature database for the enterprise's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images; Using at least one element of the fingerprint feature information in the asset fingerprint feature database as a search condition, search for assets using various asset search engines, and populate the enterprise asset scanning table with the asset information found; the asset information includes the actual website product identifier and the actual website address information; there are no fewer than two asset search engines; Cross-analysis is performed on the asset information in the enterprise asset scan table to filter out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. This information is recorded as asset information to be determined. Specifically, this includes: filtering out asset information in the enterprise asset scan table whose actual website address information appears only once and storing it in the asset difference table; storing asset information whose actual website address information appears at least twice and storing it in the asset aggregation table; setting the initial value for the cross-analysis count for each actual website address information in the asset difference table and the asset aggregation table; where the initial value for the cross-analysis count is 0; sequentially extracting each asset information in the asset aggregation table, comparing the actual website product identifier contained in the current asset information with the standard website product identifier in the asset fingerprint feature database; and incrementing the cross-analysis count for the actual website address information by 1; responding to situations where the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database. The system uses a fingerprint feature database to detect the number of cross-analysis results for the actual website addresses contained in the current asset information. If the number of cross-analysis results for the actual website addresses contained in the current asset information is 1, the current asset information is transferred to the asset difference table; otherwise, the current asset information is deleted. Each asset information in the asset difference table is extracted sequentially, and using the actual website address information contained in the current asset information as input, other asset search engines are called to search for the asset. Other asset search engines refer to asset search engines other than the asset search engine fingerprint to which the current asset information belongs. If other asset search engines can find the actual website address information contained in the current asset information, the current asset information found by other asset search engines is transferred to the asset aggregation table. If no other asset search engine can find the actual website address information contained in the current asset information, the current asset information is deleted. The asset information ultimately contained in the asset aggregation table is the asset information to be determined. The actual website address information contained in the asset information to be determined is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined will be classified as a suspicious asset.

2. The method for investigating the enterprise internet deployment product environment according to claim 1, characterized in that, Establish an asset fingerprint database for the company's registered assets, specifically including: Query the company's registered asset information table; Fingerprint feature information of each asset in the registered asset information table is extracted through website crawling and manual analysis. The extracted asset fingerprint feature information is added to the asset fingerprint feature database.

3. The method for investigating the enterprise internet deployment product environment according to claim 1, characterized in that, Website product identification includes the website title and website icon hash value; Correspondingly, the fact that the actual website product identifier contained in the current asset information is not included in the asset fingerprint feature database means that neither the website title nor the website icon hash value contained in the current asset information is included in the asset fingerprint feature database.

4. The method for investigating the enterprise internet deployment product environment according to claim 3, characterized in that, Assets whose actual website address appears only once in the enterprise asset scan table are stored in the asset discrepancy table, while assets whose actual website address appears at least twice are stored in the asset aggregation table. Specifically, this includes: Extract the actual website address information of the first asset information corresponding to the first search engine in the enterprise asset scan table; Detect whether the asset information searched by other asset search engines contains the same actual website address information; If not included, the first asset information corresponding to the first asset search engine is stored in the asset difference table; otherwise, the first asset information corresponding to the first asset search engine is stored in the asset aggregation table. This process continues until all asset information in the enterprise asset scan table has been traversed.

5. The method for investigating the enterprise internet deployment product environment according to claim 4, characterized in that, Website address information includes the website's IP address and port information.

6. The method for investigating the enterprise internet deployment product environment according to claim 5, characterized in that, The actual website address information contained in the asset information to be determined is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be determined does not exist in the asset fingerprint feature database, the corresponding asset information to be determined is classified as a suspicious asset, specifically including: The actual website address information contained in the asset information in the asset aggregation table is compared with the standard website address information in the asset fingerprint feature database; If the standard website address information in the asset fingerprint feature database does not exist in the asset aggregation table, the corresponding asset information will be recorded as a first-class suspicious asset and stored in the enterprise asset information confirmation table. If the actual website address information in the asset aggregation table does not exist in the asset fingerprint feature database, the corresponding asset information will be recorded as a second-class suspicious asset and stored in the enterprise asset information confirmation table. For the second category of suspicious assets in the Enterprise Asset Information Confirmation Table, determine whether the website IP address contained in the actual website address information is within the enterprise's public IP network segment; If so, it is still recorded as a Category II suspicious asset; otherwise, it is recorded as a Category III suspicious asset. Output the final Enterprise Asset Information Confirmation Form with Suspicious Asset Categories.

7. A system for troubleshooting enterprise internet-deployed product environments, characterized in that, include, Fingerprint Feature Database Establishment Module: Establishes an asset fingerprint feature database for the company's registered assets; the asset fingerprint feature database contains fingerprint feature information for each registered asset, including standard website product identifiers, standard website address information, and standard website homepage images; Asset search module: Using at least one element of fingerprint feature information from the asset fingerprint feature database as a search condition, the module searches for assets using various asset search engines and populates the enterprise asset scanning table with the asset information found. The asset information includes the actual website product identifier and the actual website address information. There are no fewer than two asset search engines. The asset screening module performs cross-analysis verification on the asset information in the enterprise asset scanning table, filtering out asset information whose actual website address information can be found by at least two asset search engines and whose corresponding actual website product identifier exists in the asset fingerprint feature database. This information is recorded as asset information to be determined. Specifically, this includes: filtering asset information in the enterprise asset scanning table where the actual website address information appears only once and storing it in the asset difference table; storing asset information where the actual website address information appears at least twice and storing it in the asset aggregation table; setting the initial value for the cross-analysis count for each actual website address information in the asset difference table and the asset aggregation table; where the initial value for the cross-analysis count is 0; sequentially extracting each asset information from the asset aggregation table, comparing the actual website product identifier contained in the current asset information with the standard website product identifier in the asset fingerprint feature database; and incrementing the cross-analysis count for the actual website address information by 1; responding to situations where the actual website product identifier contained in the current asset information is not found in the asset fingerprint feature database. The asset fingerprint feature database is used to detect the number of cross-analysis results for the actual website address contained in the current asset information. If the number of cross-analysis results for the actual website address contained in the current asset information is 1, the current asset information is transferred to the asset difference table; otherwise, the current asset information is deleted. Each asset information in the asset difference table is extracted sequentially, and the actual website address information contained in the current asset information is used as input to call other asset search engines to search for the asset. Other asset search engines refer to asset search engines other than the asset search engine fingerprint to which the current asset information belongs. If other asset search engines can find the actual website address information contained in the current asset information, the current asset information found by other asset search engines is transferred to the asset aggregation table. If no other asset search engine can find the actual website address information contained in the current asset information, the current asset information is deleted. The asset information ultimately contained in the asset aggregation table is the asset information to be determined. Asset screening module: The actual website address information contained in the asset information to be identified is compared with the standard website address information in the asset fingerprint feature database. If the actual website address information contained in the asset information to be identified does not exist in the asset fingerprint feature database, the corresponding asset information to be identified is screened as a suspicious asset.

8. A terminal, characterized in that, include: The storage device is used to store troubleshooting procedures for enterprise internet-deployed product environments. A processor is configured to implement the steps of the enterprise internet deployment product environment investigation method as described in any one of claims 1-6 when executing the enterprise internet deployment product environment investigation program.

9. A computer-readable storage medium, characterized in that, The readable storage medium stores an enterprise internet deployment product environment troubleshooting program, which, when executed by a processor, implements the steps of the enterprise internet deployment product environment troubleshooting method as described in any one of claims 1-6.

Images