Distributed service address detection method, device and equipment and readable storage medium

Abstract

Embodiments of the present application provide a distributed service address detection method, device and equipment and readable storage medium, comprising: establishing a first address binary tree according to a plurality of IP addresses and determining information entropy of each node and confusion degree of non-leaf nodes; postorder traversal of the first address binary tree, when the first address binary tree contains a first target node, for any first target node, two lower branches connected with the first target node are respectively split from the first address binary tree, and finally a plurality of second address binary trees are obtained; preorder traversal of any second address binary tree, when the second address binary tree contains a second target node, for any second target node, two lower branches connected with the second target node are respectively split from the second address binary tree, and finally a plurality of third address binary trees are obtained; and connection devices of IP addresses belonging to the same third address binary tree are determined to belong to the same distributed service system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more particularly to a distributed service address detection method, apparatus, device, and readable storage medium. Background Technology

[0002] For large-scale distributed network systems, identifying the service devices exposed to the internet is a crucial step in network security protection. However, there is currently no satisfactory solution for identifying service devices belonging to the same distributed service system. Summary of the Invention

[0003] This invention provides a distributed service address detection method, apparatus, device, and readable storage medium, which provides a technical solution for determining service devices belonging to the same distributed service system.

[0004] This invention provides a distributed service address detection method, comprising:

[0005] Obtain the Internet Protocol (IP) addresses of multiple connected devices to be detected, as well as the connection record information of each device;

[0006] Build a first address binary tree based on the obtained multiple IP addresses;

[0007] For any leaf node in the first address binary tree, determine the information entropy corresponding to the leaf node based on the connection record information of the connection device corresponding to the leaf node;

[0008] The first address binary tree is traversed in post-order traversal order: during the post-order traversal, the disorder of the non-leaf nodes being traversed is determined sequentially; when the non-leaf node being traversed is the first target node, the two lower branches connected to the first target node are split from the first address binary tree to obtain two second address binary trees, and the first target node is deleted from the first address binary tree; when the non-leaf node being traversed is not the first target node, the information entropy of the non-leaf node is determined; when the traversal ends, the non-leaf nodes in the first address binary tree that contain only one lower-level node are deleted to form a second address binary tree; wherein, the first target node is the non-leaf node whose disorder satisfies the first grouping condition; for any non-leaf node, the disorder of the non-leaf node is the absolute value of the difference in information entropy between the next-level nodes corresponding to the non-leaf node.

[0009] For any second address binary tree, traverse the second address binary tree in preorder traversal order: when the traversed non-leaf node is the second target node, split the two lower branches connected to the second target node from the second address binary tree to obtain two third address binary trees, and delete the second target node from the second address binary tree; when the traversal ends, treat the second address binary tree as a third address binary tree; wherein, the second target node is the non-leaf node whose corresponding information entropy satisfies the second grouping condition;

[0010] Connecting devices whose IP addresses belong to the same third address binary tree are identified as connecting devices belonging to the same distributed service system.

[0011] Optionally, the step of establishing a first address binary tree based on the acquired multiple IP addresses includes:

[0012] Set the node set;

[0013] The IP addresses of the multiple connected devices are respectively determined as leaf nodes of the first address binary tree and added to the node set;

[0014] Select the first node with the longest occupied bits from the node set and perform the following steps until only one node remains in the node set. Then stop performing the following steps and determine the first address binary tree based on the connection relationship of each node:

[0015] A second node corresponding to the first node is determined from the set of nodes; wherein the IP address of the second node has the longest common prefix with the IP address of the first node;

[0016] The common prefix of the first node and the second node is determined as the common parent node of the first node and the second node. The first node and the second node are deleted from the node set, and the parent node is added to the node set.

[0017] Optionally, the first grouping condition includes that the disorder of the current non-leaf node is not less than a preset first threshold.

[0018] Optionally, the second grouping condition includes the information gain corresponding to the current non-leaf node being greater than a preset second threshold;

[0019] The information gain corresponding to the non-leaf node is the difference between the information entropy of the non-leaf node and the conditional information entropy of the next-level node corresponding to the non-leaf node.

[0020] Optionally, the information entropy H(x) of the leaf node x satisfies the following relationship:

[0021]

[0022] Where n is the total number of peer devices that the connection device corresponding to the current leaf node x has previously connected to, i is the sequence number of the peer device, and N i (x) represents the number of times the current leaf node x has been connected to its peer device i, N. sum (x) represents the total number of times the current leaf node x has been connected to each peer device;

[0023] The information entropy H(y) of a non-leaf node y satisfies the following relationship:

[0024]

[0025] Where j is the index of the next-level child node of the current non-leaf node y, and N sum (j) represents the total number of times that the next-level child node j of the current non-leaf node y has connected with each peer device, N. sum (y) represents the total number of times the connected device corresponding to the current non-leaf node y has been connected to each peer device;

[0026] The conditional information entropy H(j|y) of the next-level child node j corresponding to a non-leaf node y satisfies the following relationship:

[0027]

[0028] As an optional implementation, after determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes:

[0029] For the first distributed service system, the port information of the second connected device is determined based on the port information of the first connected device; wherein the first connected device and the second connected device are different connected devices in the first distributed service system.

[0030] As an optional implementation, after determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes:

[0031] For the second distributed service system, the valid port of the fourth connection device is determined based on the valid ports of the preset third connection device; wherein, the third connection device and the fourth connection device are different connection devices in the second distributed service system;

[0032] Port detection is performed on the fourth connection device, and open ports that are not among the legitimate ports are identified as risky ports.

[0033] As an optional implementation, after determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes:

[0034] For the third distributed service system, the operation behavior of the first target port of the fifth connection device is used as the operation behavior benchmark. Based on the difference between the operation behavior of the first target port of the sixth connection device and the operation behavior benchmark, it is determined whether the status of the first target port of the sixth connection device is normal. The first target port is any port of the fifth connection device, or the first target port is a specified port in the fifth connection device.

[0035] The fifth and sixth connection devices are different connection devices in the third distributed service system.

[0036] As an optional implementation, after determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes:

[0037] For the fourth distributed service system, it is detected whether the open port of the seventh connection device includes the second target port; wherein, the second target port is the preset open port of the eighth connection device, and the seventh connection device and the eighth connection device are different connection devices in the fourth distributed service system;

[0038] If the open port of the seventh connection device is detected to contain the second target port, the device type of the seventh connection device is determined according to the device type of the eighth connection device.

[0039] Based on the same inventive concept, embodiments of the present invention also provide a distributed service address detection device, comprising:

[0040] The network information acquisition module acquires the IP addresses of multiple connected devices to be detected, as well as the connection record information of each connected device.

[0041] The address binary tree module is used to build a first address binary tree based on multiple obtained IP addresses;

[0042] The Entropy Analysis Model (EAM) module is used to determine the information entropy of any leaf node in the first address binary tree based on the connection record information of the connected device corresponding to the leaf node; traverse the first address binary tree in post-order traversal: during the post-order traversal, determine the disorder of the traversed non-leaf nodes sequentially; when the traversed non-leaf node is the first target node, split the two lower branches connected to the first target node from the first address binary tree to obtain two second address binary trees, and delete the first target node from the first address binary tree; when the traversed non-leaf node is not the first target node, determine the information entropy of the non-leaf node; when the traversal ends, delete the non-leaf node in the first address binary tree that contains only one lower-level node and use it as a second address binary tree; wherein, the first target node is the non-leaf node whose disorder satisfies the first grouping condition; for any non-leaf node, the disorder of the non-leaf node is the absolute value of the difference in information entropy between the non-leaf node and its corresponding next-level node.

[0043] The ER-DSPO module, based on entropy reduction, optimizes distributed service partitioning. For any given second address binary tree, it traverses the second address binary tree in preorder traversal order: when the traversed non-leaf node is the second target node, the two lower branches connected to the second target node are split from the second address binary tree to obtain two third address binary trees, and the second target node is deleted from the second address binary tree; when the traversal ends, the second address binary tree is treated as a third address binary tree; wherein the second target node is a non-leaf node whose corresponding information entropy satisfies the second grouping condition.

[0044] The conclusion determination module is used to determine the connection devices whose IP addresses belong to the same third address binary tree as connection devices belonging to the same distributed service system.

[0045] Based on the same inventive concept, embodiments of the present invention also provide an electronic device, including: a processor and a memory for storing processor-executable instructions;

[0046] The processor is configured to execute the instructions to implement the distributed service address detection method.

[0047] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing computer program code, which, when executed on a computer, causes the computer to perform the distributed service address detection method.

[0048] The beneficial effects of this invention are as follows:

[0049] The distributed service address detection method, apparatus, device, and readable storage medium provided in this invention establish an address binary tree based on the similarity relationship of the IP addresses of connected devices, and introduce information entropy as the basis for determining whether corresponding IP addresses belong to the same distributed service system. The address binary tree is segmented according to the information entropy, and the IP addresses belonging to the same distributed service system are finally determined based on the segmented binary tree. This can obtain relatively accurate device information of the distributed service system even when the specific connected devices exposed to the Internet by the unknown distributed service system are unknown. This enables network security analysis and protection of each connected device in the distributed service system, and helps the operator of the distributed service system to manage network assets. Attached Figure Description

[0050] Figure 1 A flowchart of a distributed service address detection method provided in an embodiment of the present invention;

[0051] Figure 2 This is one of the flowcharts of the distributed service address detection method provided in the embodiments of the present invention;

[0052] Figure 3 This is a schematic diagram illustrating the process of establishing the first address binary tree in an embodiment of the present invention;

[0053] Figure 4 This is a second partial flowchart of the distributed service address detection method provided in this embodiment of the invention;

[0054] Figure 5 This is a schematic diagram of the partitioning process of the second address binary tree in an embodiment of the present invention;

[0055] Figure 6 This is the third flowchart of a distributed service address detection method provided in an embodiment of the present invention;

[0056] Figure 7 This is a schematic diagram of the partitioning process of the third address binary tree in an embodiment of the present invention;

[0057] Figure 8 This is a schematic diagram of the structure of the distributed service address detection device provided in an embodiment of the present invention;

[0058] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0059] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described below in conjunction with the accompanying drawings and embodiments. However, the exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided to make the present invention more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the figures denote the same or similar structures, and therefore repeated descriptions of them will be omitted. Terms describing position and direction in the present invention are illustrative based on the accompanying drawings, but changes can be made as needed, and all such changes are included within the scope of protection of the present invention. The accompanying drawings of the present invention are for illustrative purposes only and do not represent actual proportions.

[0060] It should be noted that specific details are set forth in the following description to provide a full understanding of the invention. However, the invention can be practiced in many ways other than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below. The following description is a preferred embodiment for carrying out the present application; however, the description is for the purpose of illustrating the general principles of the application and is not intended to limit the scope of the application. The scope of protection of this application shall be determined by the appended claims.

[0061] The following description, in conjunction with the accompanying drawings, details the distributed service address detection method, apparatus, device, and readable storage medium provided in the embodiments of the present invention.

[0062] This invention provides a distributed service address detection method, such as... Figure 1 As shown, it includes:

[0063] S110. Obtain the Internet Protocol (IP) addresses of the multiple connected devices to be detected, as well as the connection record information of each connected device.

[0064] In practical implementation, network analysis techniques can be used to extract specific fields (such as the Transmission Control Protocol Flag (TCPflag) field) from network data packets to obtain the IP addresses of connected devices and their connection records. For example, for Cisco routers or switches, Netflow can be used to obtain the IP addresses of connected devices and their connection records; for Huawei routers or switches, NetStream can be used to obtain the IP addresses of connected devices and their connection records.

[0065] In specific implementation, the distributed service address detection method provided in this embodiment of the invention can be applied to IPv4 addresses or IPv6 addresses, and is not limited here.

[0066] S120. Build a first address binary tree based on the multiple obtained IP addresses.

[0067] In the specific implementation process, since the IP addresses of connected devices belonging to the same distributed system generally belong to a continuous range, the IP addresses of connected devices belonging to the same distributed system will be quite similar. Therefore, it is necessary to build a first address binary tree based on the similarity of the multiple IP addresses, so that the more similar IP addresses are placed in the closer branches of the first address binary tree, so as to facilitate the analysis of IP addresses belonging to the same distributed system in subsequent steps.

[0068] Optionally, such as Figure 2 As shown, step S120, establishing a first address binary tree based on the acquired multiple IP addresses, specifically includes:

[0069] S121, Set the node set.

[0070] S122. The IP addresses of the multiple connected devices are respectively determined as leaf nodes of the first address binary tree and added to the node set.

[0071] S123. Determine whether the number of nodes in the node set is 1.

[0072] If the result of step S123 is negative, proceed to step S124; if the result of step S123 is positive, proceed to step S127.

[0073] S124. Select the first node with the longest occupied space from the set of nodes.

[0074] S125. Determine a second node from the node set that corresponds to the first node. The second node's IP address shares the longest common prefix with the first node's IP address.

[0075] In practice, either bits or bytes can be used as the smallest unit for determining if two IP addresses have the same prefix. For example, for two IP addresses, 192.168.20.1 and 192.168.21.42 (represented in decimal for readability), if bits are used as the smallest unit for determining if two IP addresses have the same prefix, then their common prefix is ​​(11000000.10101000.0001010). B(This is represented in binary for ease of understanding); if the smallest unit for judging the same prefix is ​​the byte, then the common prefix of the two is 192.168 (represented in decimal for ease of reading). In order to place the most similar IP addresses as close as possible in the first address binary tree, it is preferable to use the bit as the smallest unit for judging the same prefix.

[0076] S126. Determine the common prefix of the first node and the second node as the common parent node corresponding to the first node and the second node, delete the first node and the second node from the node set, and add the parent node to the node set. Return to step S123.

[0077] S127. Determine the first address binary tree based on the connection relationship of each node.

[0078] For example, using bits as the smallest unit for judging the same prefix, the initial node set contains 4 leaf nodes: N1 = 192.168.20.1.66.3, N2 = 192.168.20.1.67.5, N3 = 192.168.21.4.128.7, and N4 = 192.168.40.8.15.6 (represented in decimal for ease of reading). At this time, each leaf node in the node set occupies 48 bits, and any leaf node can be selected as the first node. Assuming that leaf node N1 is selected as the first node in step S124, leaf node N2 is selected as the second node in step S125. Then, N1 and N2 are deleted from the node set, and N5 = (11000000.10101000.00010100.00000001.0100001). B (For ease of understanding, binary representation is used here) These are added to the node set as the parent nodes of both. At this point, the node set includes N3, N4, and N5. Either N3 or N4 can be chosen as the first node. Assuming that in step S124, leaf node N3 is selected as the first node, then in step S125, leaf node N4 is selected as the second node. Afterwards, N3 and N4 are deleted from the node set, and N6 = (11000000.10101000.00) B The node is added to the node set as the parent node of both nodes. At this point, the node set includes N5 and N6. In step S124, when non-leaf node N5 was selected as the first node, in step S125, non-leaf node N6 was selected as the second node. Afterwards, N5 and N6 are deleted from the node set, and N7 is set to (11000000.10101000.00). BAs the parent node of both, it is added to the node set. Since the node set currently only contains the root node N7, executing step S127 will result in... Figure 3 The connection relationship shown is determined as the first address binary tree.

[0079] S130. For any leaf node in the first address binary tree, determine the information entropy corresponding to the leaf node based on the connection record information of the connection device corresponding to the leaf node.

[0080] Optionally, the information entropy H(x) of the leaf node x satisfies the following relationship:

[0081]

[0082] Where n is the total number of peer devices that the connection device corresponding to the current leaf node x has previously connected to, i is the sequence number of the peer device, and N i (x) represents the number of times the current leaf node x has been connected to its peer device i, N. sum (x) represents the total number of times the current leaf node x has been connected to each peer device.

[0083] For example, for a certain connected device A, according to its corresponding connection record information, it has been connected to 5 other devices B, C, D, E, and F. Specifically, connected device A connected to device B 3 times, to device C 5 times, to device D 2 times, to device E 10 times, and to device F 1 time. That is, N sum (A) = 21. Therefore, the information entropy H(A) of the leaf node corresponding to connected device A is:

[0084]

[0085] S140. Traverse the first address binary tree in post-order traversal order: During the post-order traversal, determine the disorder of the non-leaf nodes being traversed in turn; when the non-leaf node being traversed is the first target node, split the two lower branches connected to the first target node from the first address binary tree to obtain two second address binary trees, and delete the first target node from the first address binary tree; when the non-leaf node being traversed is not the first target node, determine the information entropy of the non-leaf node; when the traversal ends, delete the non-leaf node in the first address binary tree that contains only one lower node and use it as a second address binary tree.

[0086] For any non-leaf node, the disorder of the non-leaf node is the absolute value of the difference in information entropy between the next-level nodes corresponding to the non-leaf node. For example, for a non-leaf node N1, connected to two next-level child nodes N2 and N3, its disorder M(N1) = |H(N2) - H(N3)|.

[0087] Optionally, the information entropy H(y) of a non-leaf node y satisfies the following relationship:

[0088]

[0089] Where j is the index of the next-level child node of the current non-leaf node y, and N sum (j) represents the total number of times that the next-level child node j of the current non-leaf node y has connected with each peer device, N. sum (y) represents the total number of times the connected device corresponding to the current non-leaf node y has connected with each peer device. If the next-level child node j of the current non-leaf node y is also a non-leaf node, then this total number of connections is actually the sum of the total number of connections between the connected devices of all leaf nodes corresponding to node j and other devices.

[0090] For example, for a non-leaf node N1, it connects to two next-level child nodes N2 and N3. The total number of connections between the connected device and other devices for N2 is 100, and the total number of connections between the connected device and other devices for N3 is 200. That is, N... sum (y) = 300. Therefore, the information entropy H(N1) of the non-leaf node N1 is:

[0091]

[0092] The first target node is a non-leaf node whose disorder level satisfies the first grouping condition.

[0093] Optionally, the first grouping condition includes that the disorder of the current non-leaf node is not less than a preset first threshold.

[0094] Specifically, such as Figure 4 As shown, step S140 specifically includes the following steps:

[0095] S141. For the first address binary tree, determine a non-leaf node in sequence according to the post-order traversal order.

[0096] If a non-leaf node is successfully identified, proceed to step S142; if all non-leaf nodes have been traversed, proceed to step S145.

[0097] S142. Determine whether the non-leaf node is the first target node.

[0098] If the result of step S142 is yes, proceed to step S143; if the result of step S142 is no, proceed to step S144.

[0099] S143. Split the two lower-level branches connected to the first target node from the first address binary tree to obtain two second address binary trees, and delete the first target node from the first address binary tree. Return to step S141.

[0100] S144. Determine the information entropy of the non-leaf nodes. Return to step S141.

[0101] S145. Delete the non-leaf nodes in the first address binary tree that contain only one subordinate node and use them as a second address binary tree.

[0102] For example, such as Figure 5 As shown, for a given first address binary tree Tree1, if a first target node N4 is determined during the post-order traversal, then the two lower branches connected to the first target node N4 are split from the first address binary tree Tree1 to obtain two second address binary trees Tree2 and Tree3. Then, the post-order traversal continues for the remaining first address binary tree Tree1. If another first target node N5 is determined, then the two lower branches connected to the first target node N5 are again split from the first address binary tree Tree1 to obtain two second address binary trees Tree4 and Tree5, and so on, until all non-leaf nodes in the first address binary tree Tree1 have been traversed. At this point, the remaining first address binary tree Tree1 is also considered as a second address binary tree.

[0103] S150. For any second address binary tree, traverse the second address binary tree in preorder traversal order: when the non-leaf node being traversed is the second target node, split the two lower branches connected to the second target node from the second address binary tree to obtain two third address binary trees, and delete the second target node in the second address binary tree; when the traversal ends, treat the second address binary tree as a third address binary tree.

[0104] The second target node is a non-leaf node whose information entropy satisfies the second grouping condition.

[0105] Optionally, the second grouping condition includes the information gain corresponding to the current non-leaf node being greater than a preset second threshold.

[0106] The information gain corresponding to the non-leaf node is the difference between the information entropy of the non-leaf node and the conditional information entropy of the next-level node corresponding to the non-leaf node.

[0107] For example, for a non-leaf node N1, which is connected to two next-level child nodes N2 and N3, the information gain of the non-leaf node N1 is g(N1) = H(N1) - H(N2|N1) - H(N3|N1).

[0108] Optionally, the conditional information entropy H(j|y) of the next-level child node j corresponding to a non-leaf node y satisfies the following relationship:

[0109]

[0110] Specifically, such as Figure 6 As shown, step S150 specifically includes the following steps:

[0111] S151. Select a second address binary tree without repetition.

[0112] If a second address binary tree is successfully selected, proceed to step S152; if all second address binary trees have been selected, proceed to step S160.

[0113] S152. For the second address binary tree, determine a non-leaf node in sequence according to the preorder traversal order.

[0114] If a non-leaf node is successfully identified, proceed to step S153; if all non-leaf nodes have been traversed, proceed to step S155.

[0115] S153. Determine whether the non-leaf node is the second target node.

[0116] If the result of step S153 is yes, proceed to step S154; if the result of step S153 is no, return to step S152.

[0117] S154. Split the two lower-level branches connected to the second target node from the second address binary tree to obtain two third address binary trees, and delete the second target node from the second address binary tree. Return to step S152.

[0118] S155. Treat the second address binary tree as a third address binary tree. Return to step S151.

[0119] For example, such as Figure 7As shown, for a certain second address binary tree Tree6, if a second target node N6 is determined during the preorder traversal, then the two lower branches connected to the second target node N6 are split from the second address binary tree Tree6 to obtain two third address binary trees Tree7 and Tree8. Then, the preorder traversal continues for the remaining second address binary tree Tree6. If another second target node N7 is determined, then the two lower branches connected to the second target node N7 are again split from the second address binary tree Tree6 to obtain two third address binary trees Tree9 and Tree10, and so on, until all non-leaf nodes in the second address binary tree Tree6 have been traversed. At this point, the remaining second address binary tree Tree6 is also considered as a third address binary tree.

[0120] S160. Connecting devices whose IP addresses belong to the same third address binary tree are identified as connecting devices belonging to the same distributed service system.

[0121] For example, if a third address binary tree Tree11 is obtained through the previous steps, and the leaf nodes of the third address binary tree Tree11 are IP1, IP2, IP3, and IP4, then the four connected devices corresponding to IP1, IP2, IP3, and IP4 belong to the same distributed service system.

[0122] The distributed service address detection method provided in this invention establishes an address binary tree based on the similarity relationship of the IP addresses of connected devices, and introduces information entropy as the basis for determining whether corresponding IP addresses belong to the same distributed service system. The address binary tree is then segmented according to the information entropy, and finally the IP addresses belonging to the same distributed service system are determined based on the segmented binary tree. This method can obtain relatively accurate device information of the distributed service system even when the specific connected devices exposed to the Internet by the unknown distributed service system are unknown. This enables network security analysis and protection of each connected device in the distributed service system, and also helps the operator of the distributed service system to manage network assets.

[0123] Since, in most cases, the ports opened by multiple connected devices in a distributed service system are consistent, and the purpose of setting up multiple connected devices in a distributed system is to achieve load balancing, for the same distributed service system, from a long-term macro perspective, the probability of any client device connecting and interacting with each connected device in the distributed service system should be the same when requesting business services from the distributed service system (i.e., the peer device mentioned above). Therefore, if we consider the connection status of a certain connected device in the distributed service system as a set, storing the historical connection records of that connected device, these historical connection records contain information entropy. Based on the previous understanding, the information entropy between connected devices under the same distributed service should be similar. If the disorder of the current non-leaf node is not less than a preset first threshold is used as the first grouping condition, then the method achieves refined segmentation of whether IP addresses belong to the same distributed service system by introducing information entropy.

[0124] Because the first grouping condition uses only the information entropy of child nodes as the criterion for dividing the first address binary tree, and information entropy only considers the overall information of historical connection records, ignoring the specific units of historical connections, it is possible that two connected devices may have completely different historical peer devices connected to them, but the information entropy of the leaf nodes corresponding to the two connected devices may be the same, causing the two connected devices to be misclassified as belonging to the same distributed service system. If the information gain corresponding to the current non-leaf node is greater than a preset second threshold is used as the second grouping condition, then the method uses information gain to decide whether to perform secondary pruning on the second address binary tree during the top-down secondary traversal of the second address binary tree, alleviating the problem that information entropy only considers overall information and ignores specific historical connection units, and can effectively improve the accuracy of prediction.

[0125] After determining whether connected devices belong to the same distributed service system using the distributed service address detection method described above, network security analysis and protection can be performed on each connected device in the distributed service system based on this correspondence. This also helps the operator of the distributed service system manage network assets. Several operations that can be performed using the above analysis results are given below.

[0126] (1) For the first distributed service system, the port information of the second connected device is determined based on the port information of the first connected device. Wherein, the first connected device and the second connected device are different connected devices in the first distributed service system.

[0127] For example, for operators of some distributed service systems, when the number of connected devices in the system is too large, they may be unable to accurately grasp all connected devices exposed to the internet due to management oversights, let alone the port information of connected devices exposed to the internet that are not recorded. Since the functions of each connected device in a distributed service system are generally the same, the purpose of setting up each connected device is load balancing. Therefore, through the steps described above, the port information of a second connected device belonging to the same distributed service system can be determined based on the known port information of the first connected device. This allows for the management of the ports of the second connected device, helping the operator of the distributed service system to efficiently understand the status of their digital assets and the connection status of digital assets with other devices. By analyzing the port information of the second connected device, risk management decisions can be made. For example, if connected device P is known to have ports a and b open, although based on existing data it is impossible to know the open port status of connected device Q belonging to the same distributed service system, it can still be predicted that connected device Q has also opened ports a and b.

[0128] (2) For the second distributed service system, the valid port of the fourth connection device is determined based on the preset valid ports of the third connection device. The third connection device and the fourth connection device are different connection devices within the second distributed service system.

[0129] Port detection is performed on the fourth connection device, and open ports that are not among the legitimate ports are identified as risky ports.

[0130] For example, in some distributed service systems, when the number of connected devices is too large, the system operator may fail to accurately track all internet-exposed devices due to management oversight. In such cases, these unrecorded internet-exposed devices may inadvertently open risky ports due to hacker attacks, virus / Trojan attacks, or operator negligence, posing a serious security risk to the distributed service system. Since the functions of connected devices in a distributed service system are generally similar, and the purpose of setting up these devices is load balancing, their legitimate ports should also be identical. Therefore, by following the steps described above, the legitimate ports of a fourth connected device belonging to the same distributed service system can be determined based on the known legitimate ports of a third connected device. Then, port detection is performed on the fourth connected device to identify open ports that are not legitimate, thus identifying risky ports. This allows the distributed service system operator to manage the open ports of the fourth connected device, discover exposure surfaces and potential vulnerabilities, and help identify and fix weaknesses that could be abused by attackers early, preventing intrusions. It also allows for the identification of unnecessary or high-risk services, enabling appropriate measures to be taken to close or restrict them, thereby ensuring the security of the distributed service system.

[0131] (3) For the third distributed service system, the operation behavior of the first target port of the fifth connection device is used as the operation behavior benchmark. Based on the difference between the operation behavior of the first target port of the sixth connection device and the operation behavior benchmark, it is determined whether the status of the first target port of the sixth connection device is normal.

[0132] Wherein, the first target port is any port of the fifth connecting device; or, the first target port is a designated port of the fifth connecting device. The fifth connecting device and the sixth connecting device are different connecting devices in the third distributed service system.

[0133] For example, in some distributed service systems, when the number of connected devices is too large, the system operator may be unable to accurately track all internet-exposed devices due to management oversights. In such cases, these unrecorded internet-exposed devices may exhibit abnormal behavior due to hacker attacks, virus / Trojan attacks, or operator misconduct. This includes abnormally frequent opening / closing of target ports, abnormal port connection occupation, abnormally high / low port call counts, abnormally high / low data transmission volumes, and interaction between target ports and abnormal IP addresses. Such abnormal behavior severely impacts the normal operation of the connected devices, causing economic losses to the distributed service system operator. Since the functions of connected devices in a distributed service system are generally similar, and the purpose of configuring these devices is load balancing, the operational behavior of the same ports on each device should also be similar. Therefore, by utilizing protection modules such as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) through the above steps, the normal operation of the same first target port of a sixth connected device belonging to the same distributed service system can be determined based on the known operational behavior of the first target port of the fifth connected device. If the operational behavior of the first target port of the sixth connected device differs significantly from that of the same first target port of the fifth connected device, it is determined that the operational behavior of the first target port of the sixth connected device is abnormal and poses a security risk. This may indicate potential malicious traffic or intrusion attempts, requiring network security protection measures for the sixth connected device. This facilitates the identification of unusual port activity patterns of connected devices. Further analysis combined with threat intelligence can better identify port activities and malicious traffic related to known threats, triggering alarms and further security responses. This helps the operators of the distributed service system to investigate network security risks and manage digital assets.

[0134] (4) For the fourth distributed service system, detect whether the open port of the seventh connection device includes the second target port. Wherein, the second target port is the preset open port of the eighth connection device, and the seventh connection device and the eighth connection device are different connection devices in the fourth distributed service system.

[0135] If the open port of the seventh connection device is detected to contain the second target port, the device type of the seventh connection device is determined according to the device type of the eighth connection device.

[0136] For example, in some distributed service systems, when the number of connected devices is too large, the system operator may be unable to accurately track all internet-exposed devices due to management oversights. In such cases, the actual function of these unrecorded internet-exposed devices may also remain unknown. Since the function of a connected device is closely related to its open ports, the device type can be determined based on these open ports. Especially for connected devices designed to perform specific functions, their functions are closely related to their open registration ports. Connecting devices belonging to the same distributed service system and opening the same registration port can be used to determine that these connected devices belong to the same device type and have the same function. For example, if the eighth connected device is a web server, and the web server function uses the well-known port 80, and if the seventh connected device, belonging to the same distributed service system as the eighth connected device, also has port 80 open, it can be determined that the seventh connected device is also a web server. For example, if the eighth connected device is a Web Application Firewall (WAF) device, and the WAF function uses the registered port 50000, and if the seventh connected device, which belongs to the same distributed service system as the eighth connected device, is also found to have port 50000 in its open ports, it can be determined that the seventh connected device is also a WAF device.

[0137] Based on the same inventive concept, such as Figure 8 As shown, this embodiment of the invention also provides a distributed service address detection device, comprising:

[0138] The network information acquisition module M1 acquires the IP addresses of multiple connected devices to be detected, as well as the connection record information of each connected device.

[0139] The address binary tree module M2 is used to build a first address binary tree based on multiple obtained IP addresses;

[0140] The Entropy Analysis Model (EAM) module M3 is used to determine the information entropy of any leaf node in the first address binary tree based on the connection record information of the connected device corresponding to the leaf node; traverse the first address binary tree in post-order traversal order: during the post-order traversal, determine the disorder of the traversed non-leaf nodes sequentially; when the traversed non-leaf node is the first target node, split the two lower branches connected to the first target node from the first address binary tree to obtain two second address binary trees, and delete the first target node from the first address binary tree; when the traversed non-leaf node is not the first target node, determine the information entropy of the non-leaf node; when the traversal ends, delete the non-leaf node in the first address binary tree that contains only one lower-level node and use it as a second address binary tree; wherein, the first target node is the non-leaf node whose disorder satisfies the first grouping condition; for any non-leaf node, the disorder of the non-leaf node is the absolute value of the difference in information entropy between the non-leaf node and its corresponding next-level node.

[0141] The Distributed Service Partition Optimization based on Entropy Reduction (ER-DSPO) module M4 is used to traverse any second address binary tree in preorder traversal order: when the traversed non-leaf node is the second target node, the two lower branches connected to the second target node are split from the second address binary tree to obtain two third address binary trees, and the second target node is deleted from the second address binary tree; when the traversal ends, the second address binary tree is treated as a third address binary tree; wherein, the second target node is the non-leaf node whose corresponding information entropy satisfies the second grouping condition;

[0142] The conclusion determination module M5 is used to determine the connection devices whose IP addresses belong to the same third address binary tree as the connection devices belonging to the same distributed service system.

[0143] Optionally, the address binary tree module M2 is specifically used for:

[0144] Set the node set;

[0145] The IP addresses of the multiple connected devices are respectively determined as leaf nodes of the first address binary tree and added to the node set;

[0146] Select the first node with the longest occupied bits from the node set and perform the following steps until only one node remains in the node set. Then stop performing the following steps and determine the first address binary tree based on the connection relationship of each node:

[0147] A second node corresponding to the first node is determined from the set of nodes; wherein the IP address of the second node has the longest common prefix with the IP address of the first node;

[0148] The common prefix of the first node and the second node is determined as the common parent node of the first node and the second node. The first node and the second node are deleted from the node set, and the parent node is added to the node set.

[0149] Optionally, the first grouping condition includes that the disorder of the current non-leaf node is not less than a preset first threshold.

[0150] Optionally, the second grouping condition includes the information gain corresponding to the current non-leaf node being greater than a preset second threshold;

[0151] The information gain corresponding to the non-leaf node is the difference between the information entropy of the non-leaf node and the conditional information entropy of the next-level node corresponding to the non-leaf node.

[0152] Optionally, the information entropy H(x) of the leaf node x satisfies the following relationship:

[0153]

[0154] Where n is the total number of peer devices that the connection device corresponding to the current leaf node x has previously connected to, i is the sequence number of the peer device, and N i (x) represents the number of times the current leaf node x has been connected to its peer device i, N. sum (x) represents the total number of times the current leaf node x has been connected to each peer device;

[0155] The information entropy H(y) of a non-leaf node y satisfies the following relationship:

[0156]

[0157] Where j is the index of the next-level child node of the current non-leaf node y, and N sum (j) represents the total number of times that the next-level child node j of the current non-leaf node y has connected with each peer device, N. sum (y) represents the total number of times the connected device corresponding to the current non-leaf node y has been connected to each peer device;

[0158] The conditional information entropy H(j|y) of the next-level child node j corresponding to a non-leaf node y satisfies the following relationship:

[0159]

[0160] As an optional implementation, the conclusion determination module M5 is further used for:

[0161] For the first distributed service system, the port information of the second connected device is determined based on the port information of the first connected device; wherein the first connected device and the second connected device are different connected devices in the first distributed service system.

[0162] As an optional implementation, the conclusion determination module M5 is further used for:

[0163] For the second distributed service system, the valid port of the fourth connection device is determined based on the valid ports of the preset third connection device; wherein, the third connection device and the fourth connection device are different connection devices in the second distributed service system;

[0164] Port detection is performed on the fourth connection device, and open ports that are not among the legitimate ports are identified as risky ports.

[0165] As an optional implementation, the conclusion determination module M5 is further used for:

[0166] For the third distributed service system, the operation behavior of the first target port of the fifth connection device is used as the operation behavior benchmark. Based on the difference between the operation behavior of the first target port of the sixth connection device and the operation behavior benchmark, it is determined whether the status of the first target port of the sixth connection device is normal. The first target port is any port of the fifth connection device, or the first target port is a specified port in the fifth connection device.

[0167] The fifth and sixth connection devices are different connection devices in the third distributed service system.

[0168] As an optional implementation, the conclusion determination module M5 is further used for:

[0169] For the fourth distributed service system, it is detected whether the open port of the seventh connection device includes the second target port; wherein, the second target port is the preset open port of the eighth connection device, and the seventh connection device and the eighth connection device are different connection devices in the fourth distributed service system;

[0170] If the open port of the seventh connection device is detected to contain the second target port, the device type of the seventh connection device is determined according to the device type of the eighth connection device.

[0171] It should be understood that the embodiments of the distributed service address detection device described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. The functional modules in the embodiments may be integrated into one processing module, or each unit module may exist physically, or two or more modules may be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional units. If the integrated unit is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0172] Since the principle of the distributed service address detection device in solving the problem is basically the same as that of the distributed service address detection method, the implementation of the distributed service address detection device can be referred to the implementation of the distributed service address detection method, and will not be repeated here.

[0173] Based on the same inventive concept, embodiments of the present invention also provide an electronic device, such as... Figure 9 As shown, it includes: a processor 110 and a memory 120 for storing instructions executable by the processor 110;

[0174] The processor 110 is configured to execute the instructions to implement the distributed service address detection method.

[0175] In specific implementations, the device may vary significantly due to differences in configuration or performance. It may include one or more processors 110, memory 120, and computer-readable storage media 130. The memory 120 and / or computer-readable storage media 130 may contain one or more application programs 131 or data 132. The memory 120 and / or computer-readable storage media 130 may also contain one or more operating systems 133, such as Windows, Mac OS, Linux, iOS, Android, Unix, FreeBSD, etc. The memory 120 and computer-readable storage media 130 may be temporary or persistent storage. The application program 131 may include one or more of the aforementioned modules (…). Figure 9(Not shown in the image), each module may include a series of instruction operations. Furthermore, the processor 110 may be configured to communicate with the computer-readable storage medium 130 and execute a series of instruction operations in the computer-readable storage medium 130 on the device. The device may also include one or more power supplies (…). Figure 9 (not shown in the image); one or more network interfaces 140, including wired network interface 141 and / or wireless network interface 142; one or more input / output interfaces 143.

[0176] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when the computer program code is run on a computer, causes the computer to execute the distributed service address detection method.

[0177] Based on the same inventive concept, embodiments of the present invention also provide a computer program product, the computer program product comprising: computer program code, which, when the computer program code is run on a computer, causes the computer to execute the distributed service address detection method.

[0178] The distributed service address detection method, apparatus, device, and readable storage medium provided in this invention establish an address binary tree based on the similarity relationship of the IP addresses of connected devices, and introduce information entropy as the basis for determining whether corresponding IP addresses belong to the same distributed service system. The address binary tree is segmented according to the information entropy, and the IP addresses belonging to the same distributed service system are finally determined based on the segmented binary tree. This can obtain relatively accurate device information of the distributed service system even when the specific connected devices exposed to the Internet by the unknown distributed service system are unknown. This enables network security analysis and protection of each connected device in the distributed service system, and helps the operator of the distributed service system to manage network assets.

[0179] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0181] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0183] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A distributed service address detection method, characterized in that, include: Obtain the Internet Protocol (IP) addresses of multiple connected devices to be detected, as well as the connection record information of each device; Build a first address binary tree based on the obtained multiple IP addresses; For any leaf node in the first address binary tree, determine the information entropy corresponding to the leaf node based on the connection record information of the connection device corresponding to the leaf node; The first address binary tree is traversed in post-order traversal order: during the post-order traversal, the disorder of the non-leaf nodes being traversed is determined sequentially; when the non-leaf node being traversed is the first target node, the two lower branches connected to the first target node are split from the first address binary tree to obtain two second address binary trees, and the first target node is deleted from the first address binary tree; when the non-leaf node being traversed is not the first target node, the information entropy of the non-leaf node is determined; when the traversal ends, the non-leaf nodes in the first address binary tree that contain only one lower-level node are deleted to form a second address binary tree; wherein, the first target node is the non-leaf node whose disorder satisfies the first grouping condition; for any non-leaf node, the disorder of the non-leaf node is the absolute value of the difference in information entropy between the next-level nodes corresponding to the non-leaf node. For any second address binary tree, traverse the second address binary tree in preorder traversal order: when the traversed non-leaf node is the second target node, split the two lower branches connected to the second target node from the second address binary tree to obtain two third address binary trees, and delete the second target node from the second address binary tree; when the traversal ends, treat the second address binary tree as a third address binary tree; wherein, the second target node is the non-leaf node whose corresponding information entropy satisfies the second grouping condition; Connecting devices whose IP addresses belong to the same third address binary tree are identified as connecting devices belonging to the same distributed service system.

2. The method as described in claim 1, characterized in that, The step of building a first address binary tree based on the obtained multiple IP addresses includes: Set the node set; The IP addresses of the multiple connected devices are respectively determined as leaf nodes of the first address binary tree and added to the node set; Select the first node with the longest occupied bits from the node set and perform the following steps until only one node remains in the node set. Then stop performing the following steps and determine the first address binary tree based on the connection relationship of each node: A second node corresponding to the first node is determined from the set of nodes; wherein the IP address of the second node has the longest common prefix with the IP address of the first node; The common prefix of the first node and the second node is determined as the common parent node of the first node and the second node. The first node and the second node are deleted from the node set, and the parent node is added to the node set.

3. The method as described in claim 1, characterized in that, The first grouping condition includes that the disorder of the current non-leaf node is not less than a preset first threshold.

4. The method as described in claim 1, characterized in that, The second grouping condition includes that the information gain of the current non-leaf node is greater than a preset second threshold. The information gain corresponding to the non-leaf node is the difference between the information entropy of the non-leaf node and the conditional information entropy of the next-level node corresponding to the non-leaf node.

5. The method as described in claim 4, characterized in that, The information entropy H(x) of leaf node x satisfies the following relationship: Where n is the total number of peer devices that the connection device corresponding to the current leaf node x has previously connected to, i is the sequence number of the peer device, and N i (x) represents the number of times the current leaf node x has been connected to its peer device i, N. sum (x) represents the total number of times the current leaf node x has been connected to each peer device; The information entropy H(y) of a non-leaf node y satisfies the following relationship: Where j is the index of the next-level child node of the current non-leaf node y, and N sum (j) represents the total number of times that the next-level child node j of the current non-leaf node y has connected with each peer device, N. sum (y) represents the total number of times the connected device corresponding to the current non-leaf node y has been connected to each peer device; The conditional information entropy H(j|y) of the next-level child node j corresponding to a non-leaf node y satisfies the following relationship: 。 6. The method as described in claim 1, characterized in that, After determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes: For the first distributed service system, the port information of the second connected device is determined based on the port information of the first connected device; wherein the first connected device and the second connected device are different connected devices in the first distributed service system.

7. The method as described in claim 1, characterized in that, After determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes: For the second distributed service system, the valid port of the fourth connection device is determined based on the valid ports of the preset third connection device; wherein, the third connection device and the fourth connection device are different connection devices in the second distributed service system; Port detection is performed on the fourth connection device, and open ports that are not among the legitimate ports are identified as risky ports.

8. The method as described in claim 1, characterized in that, After determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes: For the third distributed service system, the operation behavior of the first target port of the fifth connection device is used as the operation behavior benchmark. Based on the difference between the operation behavior of the first target port of the sixth connection device and the operation behavior benchmark, it is determined whether the status of the first target port of the sixth connection device is normal. The first target port is any port of the fifth connection device, or the first target port is a specified port in the fifth connection device. The fifth and sixth connection devices are different connection devices in the third distributed service system.

9. The method as described in claim 1, characterized in that, After determining that connection devices with IP addresses belonging to the same third address binary tree are connection devices belonging to the same distributed service system, the method further includes: For the fourth distributed service system, it is detected whether the open port of the seventh connection device includes the second target port; wherein, the second target port is the preset open port of the eighth connection device, and the seventh connection device and the eighth connection device are different connection devices in the fourth distributed service system; If the open port of the seventh connection device is detected to contain the second target port, the device type of the seventh connection device is determined according to the device type of the eighth connection device.

10. A distributed service address detection device, characterized in that, include: The network information acquisition module acquires the IP addresses of multiple connected devices to be detected, as well as the connection record information of each connected device. The address binary tree module is used to build a first address binary tree based on multiple obtained IP addresses; The Entropy Analysis Model (EAM) module is used to determine the information entropy of any leaf node on the first address binary tree based on the connection record information of the connection device corresponding to the leaf node. The first address binary tree is traversed in post-order traversal order: during the post-order traversal, the disorder of the non-leaf nodes being traversed is determined sequentially; when the non-leaf node being traversed is the first target node, the two lower branches connected to the first target node are split from the first address binary tree to obtain two second address binary trees, and the first target node is deleted from the first address binary tree; when the non-leaf node being traversed is not the first target node, the information entropy of the non-leaf node is determined; when the traversal ends, the non-leaf nodes in the first address binary tree that contain only one lower-level node are deleted to form a second address binary tree; wherein, the first target node is the non-leaf node whose disorder satisfies the first grouping condition; for any non-leaf node, the disorder of the non-leaf node is the absolute value of the difference in information entropy between the next-level nodes corresponding to the non-leaf node. The ER-DSPO module, based on entropy reduction, optimizes distributed service partitioning. For any given second address binary tree, it traverses the second address binary tree in preorder traversal order: when the traversed non-leaf node is the second target node, the two lower branches connected to the second target node are split from the second address binary tree to obtain two third address binary trees, and the second target node is deleted from the second address binary tree; when the traversal ends, the second address binary tree is treated as a third address binary tree; wherein the second target node is a non-leaf node whose corresponding information entropy satisfies the second grouping condition. The conclusion determination module is used to determine the connection devices whose IP addresses belong to the same third address binary tree as connection devices belonging to the same distributed service system.

11. An electronic device, characterized in that, include: A processor and a memory for storing processor-executable instructions; The processor is configured to execute the instructions to implement the distributed service address detection method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program code, which, when executed on a computer, causes the computer to perform the distributed service address detection method as described in any one of claims 1-9.

Images