Information asset network space mapping method and device, electronic equipment and storage medium

Abstract

The application provides an information asset network space mapping method and device, electronic equipment and storage medium, including determining a target basic mapping logic set from a basic mapping logic set constructed from a business layer based on a target to be mapped in an asset network space mapping request and determining a target workflow generation strategy from a preset workflow generation strategy set. In the logic layer, the target basic mapping logic set is configured according to the target workflow generation strategy, and the target workflow is run to obtain a target basic information asset set corresponding to the target to be mapped. In the data layer, each target basic information asset in the target basic information asset set is analyzed and processed to output an information asset network space mapping result in the interface layer. The application provides multiple basic mapping logics and workflow generation strategies to flexibly configure the workflow according to the actual scene, which can enrich the data source of the basic information asset and improve the accuracy and agility of the information asset mapping.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for mapping information assets in cyberspace. Background Technology

[0002] Existing cyberspace mapping schemes for information assets utilize the Domain Name System (DNS) to obtain the Internet Protocol (IP) addresses of all devices within the controlled area and store them on a cloud management server. Simultaneously, target devices are designated, and an initial 3D cyberspace model is created based on their location points. Then, network activity analysis is performed using IP address data from the target device's access records with other devices to obtain network activity relationships. Based on these relationships, the location points of all devices are determined to update the initial 3D cyberspace model, thus constructing the final cyberspace mapping model. However, existing cyberspace mapping schemes for information assets rely solely on the DNS system and are subject to limitations, requiring the acquisition of the IP addresses of all devices within the controlled area. Summary of the Invention

[0003] To address the limitations of existing cyberspace mapping schemes for information assets, which suffer from simplistic mapping methods and restrictive mapping conditions, this application provides a method, apparatus, electronic device, and storage medium for cyberspace mapping of information assets.

[0004] According to a first aspect of this application, a method for mapping information assets in cyberspace is provided, comprising:

[0005] In response to an asset cyberspace mapping request triggered by the asset mapping entry point, the target to be mapped is determined from the asset cyberspace mapping request; the target to be mapped can be any one of different types of basic information assets;

[0006] Based on the target to be surveyed, the target basic surveying logic set is determined from the basic surveying logic set constructed at the business layer; each basic surveying logic in the basic surveying logic set is used to determine different types of basic information assets.

[0007] Based on the target to be mapped, the target workflow generation strategy is determined from the preset workflow generation strategy set; the workflow generation strategies in the workflow generation strategy set represent the execution order between different basic mapping logics;

[0008] In the logic layer, the target basic mapping logic set is configured into a target workflow according to the target workflow generation strategy;

[0009] Run the target workflow to obtain the set of basic target information assets corresponding to the target to be mapped;

[0010] In the data layer, the basic information assets of each target in the target basic information asset set are analyzed and processed. Based on the results of the analysis and processing, the network space mapping results of the information assets of the target to be mapped are output in the interface layer.

[0011] According to a second aspect of this application, an information asset cyberspace mapping device is provided, comprising:

[0012] The response module is used to respond to asset cyberspace mapping requests triggered by the asset mapping entry point, and to determine the target to be mapped from the asset cyberspace mapping request; the target to be mapped can be any one of different types of basic information assets;

[0013] The first determination module is used to determine the target basic surveying logic set from the basic surveying logic set constructed by the business layer based on the target to be surveyed; each basic surveying logic in the basic surveying logic set is used to determine different types of basic information assets.

[0014] The second determination module is used to determine the target workflow generation strategy from a set of preset workflow generation strategies based on the target to be mapped; the workflow generation strategies in the set of workflow generation strategies represent the execution order between different basic mapping logics.

[0015] The generation module is used in the logic layer to configure the target basic mapping logic set into the target workflow according to the target workflow generation strategy;

[0016] The execution module is used to run the target workflow and obtain the set of basic target information assets corresponding to the target to be mapped.

[0017] The output module is used to analyze and process the basic information assets of each target in the target basic information asset set in the data layer, and output the network space mapping results of the information assets of the target to be mapped in the interface layer based on the analysis and processing results.

[0018] Optionally, the first determining module is used to determine the level attribute corresponding to the target to be mapped based on the target to be mapped; the level attribute represents the hierarchical position of the target to be mapped in different types of basic information assets;

[0019] From the basic surveying logic set constructed at the business layer, determine the basic surveying logic set whose level attribute is lower than the level attribute corresponding to the target to be surveyed, and obtain the target basic surveying logic set.

[0020] Optionally, the first determining module is used to determine the target basic surveying logic set from the basic surveying logic set constructed by the business layer based on the target to be surveyed, including:

[0021] Based on the target to be mapped, determine the level attribute corresponding to the target; the level attribute represents the hierarchical position of the target in different types of basic information assets.

[0022] From the basic surveying logic set constructed at the business layer, determine the basic surveying logic set whose level attribute is lower than the level attribute corresponding to the target to be surveyed, and the basic surveying logic set whose level attribute is higher than the level attribute corresponding to the target to be surveyed, to obtain the target basic surveying logic set.

[0023] Optionally, the basic surveying logic set includes a first-priority basic surveying logic set and a second-priority basic surveying logic set.

[0024] The workflow generation strategy set includes sequential execution strategies;

[0025] The generation module is used to determine at least one first-priority basic mapping logic from the first-priority basic mapping logic set of the target basic mapping logic set;

[0026] In the logic layer, the execution strategy follows the order of executing at least one set of first-priority basic surveying logic first, followed by the execution of a set of second-priority basic surveying logic. The basic surveying logic in at least one set of first-priority basic surveying logic and the basic surveying logic in the set of second-priority basic surveying logic are configured into the target workflow.

[0027] Optionally, the workflow generation strategy set includes conditional execution strategies;

[0028] The generation module is used to determine at least two first-priority basic mapping logics from the first-priority mapping logic set of the target basic mapping logic set;

[0029] In the logic layer, a conditional execution strategy is adopted to configure the basic surveying logic in the set of at least two first-priority basic surveying logics and the set of second-priority basic surveying logics into the target workflow if any one of the first-priority basic surveying logics fails to run.

[0030] The output module is used to analyze and process the basic information assets of each target in the target basic information asset set in the data layer, and sort out the subdomains, Internet protocol addresses, ports and services corresponding to the target to be surveyed;

[0031] In the interface layer, based on the subdomains, Internet Protocol addresses, ports, and service relationships of the target to be mapped, the network space mapping results of the information asset of the target to be mapped are output; the network space mapping results of the information asset include the asset profile and the asset list of the target to be mapped.

[0032] According to a third aspect of this application, an electronic device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement the information asset cyberspace mapping method of the first aspect of this application.

[0033] According to a fourth aspect of this application, a computer storage medium is provided, which stores at least one instruction or at least one program, wherein the at least one instruction or at least one program is loaded and executed by a processor to implement the information asset cyberspace mapping method of the first aspect of this application.

[0034] According to a fifth aspect of this application, a computer program product is provided, comprising at least one instruction or at least one program segment, wherein the at least one instruction or at least one program segment is loaded and executed by a processor to implement the information asset cyberspace mapping method of the first aspect of this application.

[0035] The information asset cyberspace mapping method, apparatus, electronic device, and storage medium provided in this application have the following technical effects:

[0036] In response to an asset network space mapping request triggered by an asset mapping entry point, the target to be mapped is determined from the asset network space mapping request. The target to be mapped can be any one of different types of basic information assets. Based on the target to be mapped, a target basic mapping logic set is determined from the basic mapping logic set constructed in the business layer. Each basic mapping logic in the basic mapping logic set is used to determine different types of basic information assets. Based on the target to be mapped, a target workflow generation strategy is determined from a pre-set workflow generation strategy set. The workflow generation strategy in the workflow generation strategy set represents the execution order between different basic mapping logics. In the logic layer, the target basic mapping logic set is configured into a target workflow according to the target workflow generation strategy. The target workflow is run to obtain the target basic information asset set corresponding to the target to be mapped. In the data layer, each target basic information asset in the target basic information asset set is analyzed and processed. Based on the analysis and processing results, the information asset network space mapping result of the target to be mapped is output in the interface layer. This application introduces workflow into the information asset surveying process, providing a variety of basic surveying logics and workflow generation strategies to flexibly configure the workflow according to the actual scenario. This not only reduces the pressure of surveying on the network system, but also enriches the data sources of basic information assets, improves the accuracy and agility of information asset surveying, and reduces the complexity of surveying. Attached Figure Description

[0037] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a schematic diagram of an application environment provided in an embodiment of this application;

[0039] Figure 2 This is a flowchart illustrating a method for mapping information assets in cyberspace provided in an embodiment of this application;

[0040] Figure 3 This is a schematic diagram of an information asset cyberspace mapping framework provided in an embodiment of this application;

[0041] Figure 4 This is a schematic diagram of an initial information asset profile provided in an embodiment of this application;

[0042] Figure 5 This is a schematic diagram of an information asset profile provided in an embodiment of this application;

[0043] Figure 6 This is a schematic diagram of the structure of an information asset cyberspace mapping device provided in an embodiment of this application;

[0044] Figure 7 This is a schematic diagram of the hardware structure of an electronic device used to implement the information asset cyberspace mapping method provided in this application embodiment. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely one embodiment of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0046] The term "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of this application. In the description of the embodiments of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. Furthermore, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data used can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. In addition, the terms "comprising," "having," and "being," and any variations thereof, are intended to cover non-exclusive inclusion.

[0047] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0048] Workflow: The automation of part or all of a business process in a computer application environment, that is, the automatic transfer of documents, information or tasks among multiple participants according to some predefined rules, so as to achieve a certain expected business goal or facilitate the achievement of the goal.

[0049] Subdomain enumeration: This method uses a dictionary to brute-force enumerate and find active subdomains. Implementation principle: It discovers existing and used subdomains by enumerating the A records of a domain.

[0050] Search engines: Based on certain strategies, search engines use specific computer programs to collect information from the internet, organize and process the information, and then provide users with retrieval services, displaying the retrieved information to the user's system. Mainstream search engines for subdomain queries include: Shodan, Censys, Zhongkui's Eye, Google, FoFa, and DNSDB.

[0051] Registration Information Inquiry: For information assets published on the Internet, the subdomains of the target to be surveyed can be queried through the Ministry of Industry and Information Technology's Government Service Platform (Internet Content Provider, ICP) / IP Address / Domain Name Information Registration Management System.

[0052] Port scanning: The principle of port scanning is that host A requests to establish a connection to a specific port on host B. If the other party has this service, it will respond; if the other party does not have this service installed, even if host A sends a request to the corresponding port, there will be no response. Using this principle, open port scanning can be performed. Mainstream port scanning tools can be used, such as Nmap (Network Mapper).

[0053] Please see Figure 1 , Figure 1 This is a schematic diagram of an application environment provided in an embodiment of this application. The application environment may include a client 10 and a server 20. The client 10 and the server 20 can be directly or indirectly connected via wired or wireless communication.

[0054] In some possible embodiments, client 10 may send an information asset mapping request to server 20. Server 20 may provide information asset mapping services, namely, obtaining the target to be mapped from the information asset mapping request, selecting the target's basic mapping logic set, generating a workflow according to the target workflow generation strategy, and generating the information asset mapping result of the target to be mapped.

[0055] In practical applications, information asset cyberspace mapping methods can be applied to projects or products such as enterprise information security construction, penetration testing information collection, Internet asset exposure analysis, and information asset management. By flexibly configuring workflows, they can adapt to various demand scenarios and improve the accuracy of information asset mapping.

[0056] Client 10 can be a physical device such as a smartphone, computer (e.g., desktop computer, tablet, laptop), augmented reality (AR) / virtual reality (VR) device, digital assistant, smart voice interaction device (smart speaker), smart wearable device, smart home appliance, in-vehicle terminal, etc., or it can be software running on the physical device, such as a computer program. The operating system corresponding to the client can be Android, iOS (a mobile operating system developed by Apple), Linux (an operating system), Microsoft Windows, etc.

[0057] Server 20 can be a standalone physical server, a service cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The server may include network communication units, processors, and memory, etc. The server can provide backend services to corresponding clients.

[0058] The following describes a specific embodiment of a cyberspace mapping method for information assets according to this application. Figure 2 This is a flowchart illustrating a method for mapping cyberspace information assets provided in an embodiment of this application. Figure 3 This is a schematic diagram of an information asset cyberspace mapping framework provided in an embodiment of this application. This specification provides method operation steps as shown in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one of many execution orders and does not represent the only execution order. In actual execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment).

[0059] Specific examples Figure 2 As shown, the information asset cyberspace mapping method may include:

[0060] S201: In response to an asset cyberspace mapping request triggered by an asset mapping entry point, determine the target to be mapped from the asset cyberspace mapping request; the target to be mapped is any one of different types of basic information assets.

[0061] In this embodiment, the server can respond to an asset cyberspace mapping request triggered by a user based on the asset mapping entry point, and parse the asset cyberspace mapping request to obtain the target to be mapped. The target to be mapped can be a domain name, such as a first-level domain, second-level domain, or third-level domain; it can also be an IP address; it can be a company name; or it can be other basic information assets. This embodiment does not impose specific limitations.

[0062] S203: Based on the target to be surveyed, determine the target basic surveying logic set from the basic surveying logic set constructed by the business layer; each basic surveying logic in the basic surveying logic set is used to determine different types of basic information assets.

[0063] In this embodiment, the information asset cyberspace mapping framework may include a business layer, a logic layer, a data layer, and a user interface layer. The basic mapping logic set may be the basic mapping tools provided by the business layer, also known as basic mapping methods. The basic mapping logic set may include a first-priority basic mapping logic set and a second-priority basic mapping logic set. The first-priority basic mapping logic may include, but is not limited to, subdomain enumeration, search engine queries, and filing information queries. The second-priority basic mapping logic may include, but is not limited to, port scanning and service scanning. During application, if the pressure on the network system caused by information asset cyberspace mapping is considered, passive methods such as search engine queries and filing information queries can be selected for information asset mapping to reduce the pressure on the network system. If the pressure on the network system caused by information asset cyberspace mapping is not considered, a combination of active and passive methods can be selected for information asset mapping. For example, a combination of subdomain enumeration and search engine queries can be used for information asset mapping. Providing multiple basic mapping logics through the business layer can enrich the sources of mapping data.

[0064] In this embodiment, after determining the target to be mapped, the level attribute corresponding to the target can be determined. This level attribute can characterize the hierarchical position of the target in different types of basic information assets. Then, from the basic mapping logic set constructed by the business layer, the basic mapping logic set with a level attribute lower than the level attribute corresponding to the target can be determined, thus obtaining the target basic mapping logic set. Optionally, It is possible to determine at least one sub-level association corresponding to the target to be mapped. The objective is to determine at least one sub-level associated target's corresponding basic mapping logic from the basic mapping logic set as the target base. Basic Surveying Logic Set The basic mapping logic corresponding to each sub-level associated target can be used to determine the type of basic information asset indicated by the sub-level associated target.

[0065] In some possible implementations, after determining the target to be mapped, if the target is determined to be a level corresponding to a domain name, the basic mapping logic for determining the subdomains corresponding to the domain name, the basic mapping logic for determining the IP addresses corresponding to each subdomain, and the basic mapping logic for determining the ports, services, and protocols corresponding to each IP address can be taken from the basic mapping tools built at the business layer as the target basic mapping logic set for the domain name. Optionally, the subdomains corresponding to the domain name, the IP addresses corresponding to each subdomain, the ports corresponding to each IP address, services, and protocols can be taken as the child-level associated targets of the domain name, and at least one of the subdomain enumeration, search engine query, and filing information query corresponding to the subdomain, as well as the filing information query corresponding to the IP address, the port scan corresponding to the port, and the service scan corresponding to the service can be taken as the target basic mapping logic set. For example, if the target to be mapped is a first-level domain name, at least one of the subdomain enumeration, search engine query, and filing information query, as well as the port scan and service scan can be taken as the target basic mapping logic set for the first-level domain name.

[0066] In some possible implementations, after determining the target to be mapped, if the target is determined to be the level corresponding to an IP address, the basic mapping logic for determining the port, service, and protocol corresponding to the IP address can be obtained from the basic mapping tools built at the business layer, and used as the target basic mapping logic set for the domain name. Optionally, the port, service, and protocol corresponding to the IP address can be used as the sub-level associated target of the IP address, and the port scan corresponding to the port and the service scan corresponding to the service in the basic mapping logic set can be used as the target basic mapping logic set. For example, if the target to be mapped is an IP address, port scan and service scan can be used as the target basic mapping logic set for the IP address.

[0067] In this embodiment, based on the target to be mapped, the level attribute corresponding to the target can be determined. Then, from the basic mapping logic set constructed by the business layer, a basic mapping logic set with a level attribute lower than that corresponding to the target and a basic mapping logic set with a level attribute higher than that corresponding to the target can be determined to obtain the target basic mapping logic set. Optionally, at least one child-level associated target and at least one parent-level associated target corresponding to the target can be determined, and the basic mapping logic corresponding to at least one child-level associated target and at least one parent-level associated target can be determined from the basic mapping logic set to form the target basic mapping logic set. Each child-level associated target's basic mapping logic can be used to determine the type of basic information asset indicated by the child-level associated target, and each parent-level associated target's basic mapping logic can be used to determine the type of basic information asset indicated by the parent-level associated target.

[0068] In some possible implementations, after determining the target to be mapped, if it is determined that the target to be mapped is the level corresponding to the domain name, the basic mapping logic for determining the subdomains corresponding to the domain name, the basic mapping logic for determining the IP addresses corresponding to each subdomain, the basic mapping logic for determining the ports, services, and protocols corresponding to each IP address, and the basic mapping logic for determining the parent domain name corresponding to the domain name can be taken from the basic mapping tools built at the business layer as the target basic mapping logic set for the domain name. Optionally, the subdomains, the IP addresses corresponding to each subdomain, the ports, services, and protocols corresponding to each IP address can be taken as the child-level associated targets of the domain name, and the parent domain name corresponding to the domain name can be taken as the parent-level associated targets of the domain name. At least one of the following in the basic mapping logic set: subdomain enumeration, search engine query, and filing information query, as well as filing information query corresponding to IP address, port scanning corresponding to port, service scanning corresponding to service, and determining the parent domain name based on the domain name can be taken as the target basic mapping logic set.

[0069] In some possible implementations, after determining the target to be mapped, if the target is determined to be the level corresponding to an IP address, the basic mapping logic set for the domain name can be obtained from the basic mapping tools built at the business layer, which includes the ports, services, and protocols corresponding to each IP address, as well as the basic mapping logic set for the domain name. Optionally, the ports, services, and protocols corresponding to the IP address can be used as child-level associated targets of the IP address, while the domain name corresponding to the IP address can be used as the parent-level associated target of the IP address. The basic mapping logic set can then include port scans corresponding to ports, service scans corresponding to services, and domain names determined based on IP addresses.

[0070] In this embodiment, the underlying mapping logic corresponding to the target to be mapped can be determined, and the associated underlying mapping logic corresponding to the underlying mapping logic can be determined from the set of underlying mapping logics as the target underlying mapping logic set. The associated underlying mapping logic can be used to determine the type of basic information asset indicated by the target to be mapped.

[0071] In some possible implementations, after determining the target to be surveyed, if it is determined that the target to be surveyed is the level corresponding to the domain name, at least one of the basic surveying logics among subdomain enumeration, search engine query and filing information query can be used as the basic surveying logic to be surveyed for the domain name, and port scanning and service scanning can be used as the associated basic surveying logic of at least one of the basic surveying logics among subdomain enumeration, search engine query and filing information query, so as to obtain the target basic surveying logic set.

[0072] This application enriches the surveying methods for information asset surveying by providing multiple basic surveying logics, enabling flexible selection of basic surveying logics according to the needs of different surveying scenarios.

[0073] S205: Based on the target to be mapped, determine the target workflow generation strategy from the preset workflow generation strategy set; the workflow generation strategies in the workflow generation strategy set represent the execution order between different basic mapping logics.

[0074] In this embodiment, the workflow generation strategy set may include sequential execution strategies and conditional execution strategies. The sequential execution strategy can be configured to run different basic mapping logics sequentially after configuring the target to be mapped. For example, after configuring the target, subdomain enumeration, search engine query, port scan, and service scan can be run sequentially. The conditional execution strategy can be configured to judge based on whether the subdomain enumeration runs successfully. If the subdomain enumeration runs successfully, different basic mapping logics continue to run sequentially; if the subdomain enumeration fails, a search engine query is run, and different basic mapping logics continue to run. For example, after configuring the target to be mapped, subdomain enumeration is run. If the subdomain enumeration runs successfully, port scan and service scan continue to run sequentially; if the subdomain enumeration fails, search engine query, port scan, and service scan are run sequentially. When subdomain enumeration fails, the workflow based on the conditional execution strategy can continue to run, while the workflow based on the sequential execution strategy will fail or the target information asset data will be incomplete. Generally, in order to reduce the complexity of surveying, the sequential execution strategy can be determined from the preset workflow generation strategy as the target workflow generation strategy.

[0075] S207: In the logic layer, configure the target basic mapping logic set into a target workflow according to the target workflow generation strategy.

[0076] In this embodiment, the logic layer can configure a workflow using the basic surveying tools provided by the business layer, executing strategies in a preset order or conditionally. For example, Figure 3 The information asset cyberspace mapping framework shown can be configured with workflow A (subdomain enumeration + search engine query + port scanning + service scanning) or workflow B (search engine query + filing information query + port scanning + service scanning) in its logical layer.

[0077] In some possible implementations, at least one first-priority basic mapping logic can be determined from the first-priority basic mapping logic set of the target basic mapping logic set. In the logic layer, the basic mapping logic from the at least one first-priority basic mapping logic set and the second-priority basic mapping logic set are configured into the target workflow, following an execution strategy where the at least one first-priority basic mapping logic set is executed first, followed by the second-priority basic mapping logic set. The execution order of the basic mapping logic in the at least one first-priority basic mapping logic set is random, and the execution order of the basic mapping logic in the second-priority basic mapping logic set is also random. For example, subdomain enumeration and search engine query can be determined from the first-priority basic mapping logic set, and the target workflow is configured in the logic layer according to the execution order of subdomain enumeration + search engine query + port scan + service scan. As another example, search engine query and filing information query can be determined from the first-priority basic mapping logic set, and the target workflow is configured in the logic layer according to the execution order of search engine query + filing information query + port scan + service scan.

[0078] In some possible implementations, at least two first-priority basic mapping logics can be determined from the first priority set of the target basic mapping logic set. At the logic layer, a conditional execution strategy is employed: if any one of the at least two first-priority basic mapping logics fails, then any remaining first-priority basic mapping logic from the at least two first-priority basic mapping logics is executed, followed by the execution of a second-priority basic mapping logic. This allows the basic mapping logics in the at least two first-priority basic mapping logic sets and the second-priority basic mapping logic set to be configured into the target workflow. For example, subdomain enumeration and search engine queries can be determined from the first-priority basic mapping logic set. At the logic layer, the target workflow is configured according to the execution order of search engine query + port scan + service scan if subdomain enumeration fails.

[0079] S209: Run the target workflow to obtain the set of basic target information assets corresponding to the target to be surveyed.

[0080] In some possible implementations, the target basic mapping logic includes, but is not limited to, the types listed above, and may also include other basic mapping logic. Therefore, by running the workflow, a set of target basic information assets, such as certificate information, middleware, and autonomous system (AS), corresponding to the target to be mapped can be obtained.

[0081] In some possible implementations, when the target workflow generation strategy is a sequential execution strategy, and the target basic mapping logic set includes search engine queries, filing information queries, port scans, and service scans, search engine queries and / or filing information queries can be run to obtain the domain name and IP address corresponding to the target to be mapped. Then, port scans can be run to obtain the port corresponding to the target to be mapped, and service scans can be run to obtain the service corresponding to the target to be mapped. Finally, the domain name, IP address, port, and service can be integrated to obtain the target basic information asset set corresponding to the target to be mapped. This not only reduces the pressure of mapping on the network system while enriching the data sources of basic information assets and improving the accuracy and agility of information asset mapping, but also reduces the complexity of mapping.

[0082] In some possible implementations, when the target workflow generation strategy is a sequential execution strategy, and the target basic mapping logic set includes subdomain enumeration, search engine query, port scanning, and service scanning, subdomain enumeration and search engine query can be run to obtain the domain name corresponding to the target to be mapped. Based on the domain name, the IP address corresponding to the target to be mapped can be determined. Then, port scanning can be run to obtain the port corresponding to the target to be mapped, and service scanning can be run to obtain the service corresponding to the target to be mapped. Finally, the domain name, IP address, port, and service can be integrated to obtain the target basic information asset set corresponding to the target to be mapped. In this way, not only can the data sources of basic information assets be enriched, and the accuracy and agility of information asset mapping be improved, but the complexity of mapping can also be reduced.

[0083] In some possible implementations, when the target workflow generation strategy is a sequential execution strategy, and the target basic mapping logic set includes subdomain enumeration, filing information query, port scanning, and service scanning, subdomain enumeration and filing information query can be run to obtain the domain name and Internet Protocol address (IP) corresponding to the target to be mapped. Then, port scanning can be run to obtain the port corresponding to the target to be mapped, and service scanning can be run to obtain the service corresponding to the target to be mapped. Finally, the domain name, IP address, port, and service can be integrated to obtain the target basic information asset set corresponding to the target to be mapped. This not only enriches the data sources of basic information assets and improves the accuracy and agility of information asset mapping, but also reduces the complexity of mapping.

[0084] In some possible implementations, when the target workflow generation strategy is a conditional execution strategy, and the target basic mapping logic set includes subdomain enumeration, search engine query, port scanning, and service scanning, subdomain enumeration can be run. If subdomain enumeration succeeds, the domain name corresponding to the target to be mapped is obtained. Based on the domain name, the IP address corresponding to the target to be mapped is determined. Then, port scanning can be run to obtain the port corresponding to the target to be mapped, and service scanning can be run to obtain the service corresponding to the target to be mapped. Then, the domain name, IP address, port, and service can be integrated to obtain the target basic information asset set corresponding to the target to be mapped. If subdomain enumeration fails, a search engine query can be run to obtain the domain name corresponding to the target to be mapped. Based on the domain name, the IP address corresponding to the target to be mapped is determined. Then, port scanning can be run to obtain the port corresponding to the target to be mapped, and service scanning can be run to obtain the service corresponding to the target to be mapped. Then, the domain name, IP address, port, and service can be integrated to obtain the target basic information asset set corresponding to the target to be mapped. In this way, when subdomain enumeration fails, the workflow based on the conditional execution strategy can continue to run, which can enrich the data sources of basic information assets, ensure the integrity of basic information assets, improve the accuracy and agility of information asset surveying, and reduce the complexity of surveying.

[0085] S211: In the data layer, analyze and process each target basic information asset in the target basic information asset set, and output the network space mapping result of the information asset of the target to be mapped in the interface layer based on the analysis and processing results.

[0086] In this embodiment, the data layer analyzes and processes each target basic information asset in the target basic information asset set, identifying the subdomains, IP addresses, ports, and services corresponding to the target to be mapped. The interface layer outputs the information asset mapping results of the target to be mapped based on the relationships between the target basic information assets in the target basic information asset set output by the data layer. That is, the interface layer outputs the information asset cyberspace mapping results based on the relationships between the subdomains, IP addresses, ports, and services corresponding to the target to be mapped. The specific display format of the information asset cyberspace mapping results can be various, such as a data list or asset profile, depending on requirements.

[0087] In one possible implementation, an information asset profile of the target to be mapped can be generated based on the relationships between the target basic information assets in the target basic information asset set. In an optional implementation, a first information asset sub-profile can be generated based on domain names and IP addresses in the target basic information asset set. Then, a second information asset sub-profile can be generated based on ports and services in the target basic information asset set. Finally, an information asset profile can be generated based on the first and second information asset sub-profiles. Specifically, an initial information asset profile can be constructed starting with a domain name, based on the relationships between domain names, subdomains, and IP addresses. Figure 4 This is a schematic diagram of an initial information asset profile provided in an embodiment of this application. Then, based on the initial information asset profile, a final information asset profile can be constructed according to the port, service, and protocol corresponding to each IP address. Figure 5 This is a schematic diagram of an information asset profile provided in an embodiment of this application. In practical applications, the information asset profile can be represented as a two-dimensional planar profile or a three-dimensional spatial profile.

[0088] The following example illustrates the method for mapping information assets in cyberspace. If the target to be mapped is a domain name, subdomain enumeration can be performed to obtain subdomains A, B, C, and BA. Then, the IP addresses corresponding to subdomains A and C, the certificate information and IP address corresponding to subdomain B, the certificate information, protocol, Autonomous System (AS), and middleware of subdomain C, and the certificate information, IP address, and middleware of subdomain BA can be determined. Next, port scanning and service scanning can be performed to determine the services, ports, and protocols of the IP addresses corresponding to subdomains A and C, the services, ports, and protocols of the IP address corresponding to subdomain B, and the services and ports of the IP address corresponding to subdomain BA. Finally, based on the domain name, subdomains A, B, C, BA, the IP addresses corresponding to subdomains A and C, the IP address corresponding to subdomain B, and the IP address corresponding to subdomain BA, an initial information asset profile can be constructed. Based on the services, ports, and protocols of the IP addresses corresponding to subdomains A and C, the services, ports, and protocols of the IP address corresponding to subdomain B, the certificate information, protocols, autonomous system (AS), and middleware of subdomain C, the certificate information, IP address, and middleware of subdomain BA, and the services and ports of the IP address corresponding to subdomain BA, the final information asset profile is constructed on the basis of the initial information asset profile.

[0089] In one possible implementation, an information asset list of the target to be mapped can be generated based on the relationships between the target basic information assets in the target basic information asset set. In an optional implementation, a first information asset sub-list can be generated based on the domain names and IP addresses in the target basic information asset set. Then, a second information asset sub-list can be generated based on the ports and services in the target basic information asset set. Finally, an information asset list can be generated based on the first and second information asset sub-lists. Specifically, an initial information asset list can be constructed based on the relationships between domain names, subdomains, and IP addresses. Table 1 is a schematic diagram of an initial information asset list provided in an embodiment of this application. Then, based on the initial information asset list, a final information asset list can be constructed according to the port, service, and protocol corresponding to each IP address. Table 2 is a schematic diagram of an information asset list provided in an embodiment of this application.

[0090] Table 1

[0091]

[0092] Table 2

[0093]

[0094] The information asset cyberspace mapping method provided in this application introduces a workflow into the information asset mapping process, providing a variety of basic mapping logics and workflow generation strategies to flexibly configure the workflow according to the actual scenario. This not only reduces the pressure of mapping on the network system, but also enriches the data sources of basic information assets, improves the accuracy and agility of information asset mapping, and reduces the complexity of mapping.

[0095] This application also provides an information asset cyberspace mapping device. Figure 6 This is a schematic diagram of the structure of an information asset cyberspace mapping device provided in an embodiment of this application, as shown below. Figure 6 As shown, the information asset cyberspace mapping device may include:

[0096] The response module 601 is used to respond to an asset network space mapping request triggered by the asset mapping entry point, and to determine the target to be mapped from the asset network space mapping request; the target to be mapped is any one of different types of basic information assets;

[0097] The first determining module 603 is used to determine the target basic surveying logic set from the basic surveying logic set constructed by the business layer based on the target to be surveyed; each basic surveying logic in the basic surveying logic set is used to determine different types of basic information assets.

[0098] The second determining module 605 is used to determine the target workflow generation strategy from a preset workflow generation strategy set based on the target to be mapped; the workflow generation strategies in the workflow generation strategy set represent the execution order between different basic mapping logics.

[0099] The generation module 607 is used to configure the target basic mapping logic set into a target workflow in the logic layer according to the target workflow generation strategy;

[0100] The execution module 609 is used to run the target workflow and obtain the set of target basic information assets corresponding to the target to be surveyed;

[0101] The output module 611 is used to analyze and process each target basic information asset in the target basic information asset set in the data layer, and output the network space mapping results of the information asset of the target to be mapped in the interface layer based on the analysis and processing results.

[0102] In some possible implementations, the first determining module 603 is used to determine the level attribute corresponding to the target to be mapped based on the target to be mapped; the level attribute represents the hierarchical position of the target to be mapped in different types of basic information assets;

[0103] From the basic surveying logic set constructed at the business layer, determine the basic surveying logic set whose level attribute is lower than the level attribute corresponding to the target to be surveyed, and obtain the target basic surveying logic set.

[0104] In some possible implementations, the first determining module 603 is used to determine the level attribute corresponding to the target to be mapped based on the target to be mapped; the level attribute represents the hierarchical position of the target to be mapped in different types of basic information assets;

[0105] From the basic surveying logic set constructed at the business layer, determine the basic surveying logic set whose level attribute is lower than the level attribute corresponding to the target to be surveyed, and the basic surveying logic set whose level attribute is higher than the level attribute corresponding to the target to be surveyed, to obtain the target basic surveying logic set.

[0106] In some possible implementations, the basic surveying logic set includes a first priority basic surveying logic set and a second priority basic surveying logic set.

[0107] The workflow generation strategy set includes sequential execution strategies;

[0108] The generation module is used to determine at least one first-priority basic mapping logic from the first-priority basic mapping logic set of the target basic mapping logic set;

[0109] In the logic layer, the execution strategy follows the order of executing at least one set of first-priority basic surveying logic first, followed by the execution of a set of second-priority basic surveying logic. The basic surveying logic in at least one set of first-priority basic surveying logic and the basic surveying logic in the set of second-priority basic surveying logic are configured into the target workflow.

[0110] In some possible implementations, the workflow generation strategy set includes conditional execution strategies;

[0111] The generation module is used to determine at least two first-priority basic mapping logics from the first-priority mapping logic set of the target basic mapping logic set;

[0112] In the logic layer, a conditional execution strategy is adopted to configure the basic surveying logic in the set of at least two first-priority basic surveying logics and the set of second-priority basic surveying logics into the target workflow if any one of the first-priority basic surveying logics fails to run.

[0113] In some possible implementations, the output module is used to analyze and process each target basic information asset in the target basic information asset set in the data layer, and sort out the subdomains, Internet protocol addresses, ports and services corresponding to the target to be mapped;

[0114] In the interface layer, based on the subdomains, Internet Protocol addresses, ports, and service relationships of the target to be mapped, the network space mapping results of the information asset of the target to be mapped are output; the network space mapping results of the information asset include the asset profile and the asset list of the target to be mapped.

[0115] The apparatus and method embodiments in this application are based on the same application concept.

[0116] This application provides an electronic device including a processor and a memory. The memory stores at least one instruction or at least one program, which is loaded and executed by the processor to implement the information asset cyberspace mapping method provided in the above method embodiments.

[0117] Figure 7 This is a schematic diagram of the hardware structure of an electronic device for implementing the information asset cyberspace mapping method provided in this application embodiment. The electronic device can participate in or include the information asset cyberspace mapping device provided in this application embodiment. Figure 7As shown, the electronic device may include one or more (shown as 701a and 701b in the figure) processors 701 (processor 701 may include, but is not limited to, microprocessors 701 MCUs or programmable logic devices FPGAs, etc.), memory 703 for storing data, and transmission devices 705 for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and / or a power supply. Those skilled in the art will understand that... Figure 7 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 7 The more or fewer components shown, or having the same Figure 7 The different configurations shown.

[0118] It should be noted that the aforementioned one or more processors 701 and / or other data processing circuits are generally referred to as "data processing circuits" in this application. The data processing circuit can be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuit can be a single, independent processing module, or it can be integrated, in whole or in part, into any other element within an electronic device (or mobile device). As involved in the embodiments of this application, the data processing circuit serves as a processor 701 control (e.g., selection of a variable resistor termination path connected to an interface).

[0119] The memory 703 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the information asset cyberspace mapping method in this embodiment. The processor 701 implements the above-mentioned information asset cyberspace mapping method by running the software programs and modules stored in the memory 703 and executing various functional applications and data processing. The memory 703 may include high-speed random access memory, and may also include non-volatile random access memory 703, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory 703. In some possible embodiments, the memory 703 may further include remotely configured memories 703 relative to the processing, which can be connected to electronic devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0120] The transmission device 705 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the electronic device. In one example, the transmission device 705 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 705 may be a radio frequency (RF) module used for wireless communication with the Internet.

[0121] The display can be, for example, a touchscreen liquid crystal display (LED), which allows users to interact with the user interface of an electronic device (or mobile device).

[0122] This application provides a computer-readable storage medium that can be disposed in an electronic device to store at least one instruction or at least one program related to implementing an information asset cyberspace mapping method in the method embodiment. The at least one instruction or at least one program is loaded and executed by the processor to implement the information asset cyberspace mapping method provided in the above method embodiment.

[0123] Optionally, in this embodiment, the storage medium may be located at at least one of the multiple network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0124] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, while this specification describes specific embodiments, other embodiments are also within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in the order shown in different embodiments and still achieve the desired results. Additionally, the processes depicted in the drawings do not necessarily require a specific order or sequence of connections to achieve the desired results; in some implementations, parallel processing of multiple tasks is possible or may be advantageous.

[0125] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, embodiments of apparatus and electronic devices are described simply because they are based on similar method embodiments; relevant parts can be referred to the descriptions of the method embodiments.

[0126] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for mapping information assets in cyberspace, characterized in that, include: In response to an asset network space mapping request triggered by an asset mapping entry point, the target to be mapped is determined from the asset network space mapping request; The target to be mapped can be any one of different types of basic information assets; Based on the target to be surveyed, a target basic surveying logic set is determined from the basic surveying logic set constructed at the business layer; each basic surveying logic in the basic surveying logic set is used to determine different types of basic information assets. The step of determining the target basic surveying logic set from the basic surveying logic set constructed by the business layer based on the target to be surveyed includes: Based on the target to be mapped, the level attribute corresponding to the target to be mapped is determined; the level attribute represents the hierarchical position of the target to be mapped in the different types of basic information assets; From the basic mapping logic set constructed by the business layer, determine the basic mapping logic set whose level attribute is lower than the level attribute corresponding to the target to be mapped, and obtain the target basic mapping logic set; or... From the basic surveying logic set constructed by the business layer, determine the basic surveying logic set whose level attribute is lower than the level attribute corresponding to the target to be surveyed and the basic surveying logic set whose level attribute is higher than the level attribute corresponding to the target to be surveyed, and obtain the target basic surveying logic set; Based on the target to be mapped, a target workflow generation strategy is determined from a preset set of workflow generation strategies; the workflow generation strategies in the set of workflow generation strategies represent the execution order between different basic mapping logics. In the logic layer, the target basic mapping logic set is configured into a target workflow according to the target workflow generation strategy; Run the target workflow to obtain the target basic information asset set corresponding to the target to be mapped; In the data layer, the target basic information assets in the target basic information asset set are analyzed and processed. Based on the analysis and processing results, the network space mapping results of the information asset of the target to be mapped are output in the interface layer.

2. The method according to claim 1, characterized in that, The basic surveying logic set includes a first priority basic surveying logic set and a second priority basic surveying logic set. The workflow generation strategy set includes sequential execution strategies; The step of configuring the target basic mapping logic set into a target workflow in the logic layer according to the target workflow generation strategy includes: At least one first-priority basic mapping logic is determined from the first priority basic mapping logic set of the target basic mapping logic set; In the logic layer, the basic surveying logic in at least one set of first-priority basic surveying logic is executed first, followed by the execution of a set of second-priority basic surveying logic. This strategy configures the basic surveying logic in at least one set of first-priority basic surveying logic and the set of second-priority basic surveying logic into the target workflow.

3. The method according to claim 2, characterized in that, The workflow generation strategy set includes conditional execution strategies; The logic layer configures the target basic mapping logic set into a target workflow according to the target workflow generation strategy, including: Determine at least two first-priority basic mapping logics from the first priority mapping logic set of the target basic mapping logic set; In the logic layer, the conditional execution strategy of executing any one of the at least two first-priority basic mapping logics and the second-priority basic mapping logic in the at least two first-priority basic mapping logics if any one of the first-priority basic mapping logics fails to run, and executing any one of the remaining first-priority basic mapping logics and the second-priority basic mapping logic is used to configure the basic mapping logics in the at least two first-priority basic mapping logic sets and the second-priority basic mapping logic sets into the target workflow.

4. The method according to claim 1, characterized in that, The step of analyzing and processing each target basic information asset in the target basic information asset set in the data layer, and outputting the information asset cyberspace mapping result of the target to be mapped in the interface layer based on the analysis and processing result, includes: In the data layer, the target basic information assets in the target basic information asset set are analyzed and processed to sort out the subdomains, Internet protocol addresses, ports and services corresponding to the target to be mapped. In the interface layer, based on the association between the subdomain, Internet Protocol address, port, and service corresponding to the target to be mapped, the network space mapping result of the information asset of the target to be mapped is output; the network space mapping result of the information asset includes the asset profile and the asset list corresponding to the target to be mapped.

5. An information asset cyberspace mapping device, characterized in that, include: The response module is used to respond to an asset network space mapping request triggered by the asset mapping entry point and to determine the target to be mapped from the asset network space mapping request. The target to be mapped can be any one of different types of basic information assets; The first determining module is used to determine the target basic surveying logic set from the basic surveying logic set constructed by the business layer based on the target to be surveyed; each basic surveying logic in the basic surveying logic set is used to determine different types of basic information assets. The first determining module is used for: Based on the target to be mapped, the level attribute corresponding to the target to be mapped is determined; the level attribute represents the hierarchical position of the target to be mapped in the different types of basic information assets; From the basic mapping logic set constructed by the business layer, determine the basic mapping logic set whose level attribute is lower than the level attribute corresponding to the target to be mapped, and obtain the target basic mapping logic set; or, From the basic surveying logic set constructed by the business layer, determine the basic surveying logic set whose level attribute is lower than the level attribute corresponding to the target to be surveyed and the basic surveying logic set whose level attribute is higher than the level attribute corresponding to the target to be surveyed, and obtain the target basic surveying logic set; The second determining module is used to determine the target workflow generation strategy from a preset set of workflow generation strategies based on the target to be mapped. The workflow generation strategies in the workflow generation strategy set represent the execution order between different basic surveying logics; The generation module is used to configure the target basic mapping logic set into a target workflow in the logic layer according to the target workflow generation strategy; The running module is used to run the target workflow and obtain the target basic information asset set corresponding to the target to be mapped. The output module is used to analyze and process each target basic information asset in the target basic information asset set in the data layer, and output the information asset network space mapping result of the target to be mapped in the interface layer based on the analysis and processing results.

6. The apparatus according to claim 5, characterized in that, The basic surveying logic set includes a first priority basic surveying logic set and a second priority basic surveying logic set. The workflow generation strategy set includes sequential execution strategies; The generation module is used to determine at least one first priority basic mapping logic from the first priority basic mapping logic set of the target basic mapping logic set; In the logic layer, the basic surveying logic in at least one set of first-priority basic surveying logic is executed first, followed by the execution of a set of second-priority basic surveying logic. This strategy configures the basic surveying logic in at least one set of first-priority basic surveying logic and the set of second-priority basic surveying logic into the target workflow.

7. The apparatus according to claim 6, characterized in that, The workflow generation strategy set includes conditional execution strategies; The generation module is used to determine at least two first-priority basic mapping logics from the first priority mapping logic set of the target basic mapping logic set; In the logic layer, the conditional execution strategy of executing any one of the at least two first-priority basic mapping logics and the second-priority basic mapping logic in the at least two first-priority basic mapping logics if any one of the first-priority basic mapping logics fails to run, and executing any one of the remaining first-priority basic mapping logics and the second-priority basic mapping logic is used to configure the basic mapping logics in the at least two first-priority basic mapping logic sets and the second-priority basic mapping logic sets into the target workflow.

8. The apparatus according to claim 5, characterized in that, The output module is used to analyze and process each target basic information asset in the target basic information asset set in the data layer, and sort out the subdomains, Internet protocol addresses, ports and services corresponding to the target to be mapped. In the interface layer, the network space mapping results of the information asset of the target to be mapped are output according to the association between the subdomain, Internet protocol address, port and service corresponding to the target to be mapped; The information asset cyberspace mapping results include an asset profile corresponding to the target to be mapped and a list of assets corresponding to the target to be mapped.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the information asset cyberspace mapping method as described in any one of claims 1-4.

10. A computer storage medium, characterized in that, The storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the information asset cyberspace mapping method as described in any one of claims 1-4.

11. A computer program product, characterized in that, The computer program product includes at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the information asset cyberspace mapping method as described in any one of claims 1-4.

Images