A method and electronic device for identifying enterprise IP assets

Abstract

The embodiment of the present application discloses a method and electronic device for enterprise IP asset identification, which constructs a graph by combining website data with historical data stored in PDNS data, and determines a target search path with the target domain name corresponding to the enterprise to be identified as the source node and the IP as the terminal node based on the constructed graph, and inputs the target feature vector of each target node in the target search path into the asset sequence classification model based on the first feature vector of each node in the pre-stored graph and the pre-trained asset sequence classification model to determine whether the IP and the target domain name belong to the same enterprise asset, thereby realizing the identification of the enterprise IP assets. Thus, multiple data historical source IPs in a complex network environment are effectively integrated, thereby ensuring the comprehensiveness and accuracy of identifying IP assets.

Description

Technical Field

[0001] The present application relates to the technical field of network asset management, and in particular to a method and electronic device for identifying enterprise IP assets. Background Art

[0002] In the modern network asset competition, the identification and development of corporate IP assets are crucial. The quality of the identification and development of corporate IP assets directly affects the brand protection and market competitiveness of the enterprise. With the complexity and changeability of the network environment, enterprises are facing increasing risks of network attacks and information leakage. Therefore, timely and comprehensive identification and management of corporate IP assets has become an important task to ensure corporate security and competitive advantage.

[0003] The existing enterprise IP asset identification method is mainly based on website data to search and match enterprise IP assets. Only when the matching information is completely consistent can it be determined whether the IP asset belongs to the enterprise. However, if there are some data historical source IPs on the website that belong to the enterprise, but they are not completely consistent with the queried information, it is not possible to accurately identify that the IP asset belongs to the enterprise. Therefore, this method cannot effectively integrate and utilize multiple data historical source IPs on the website in a complex network environment, thus affecting the comprehensiveness and accuracy of identifying IP assets. Summary of the invention

[0004] The present application provides a method and electronic device for identifying enterprise IP assets, so as to solve the problem that enterprise IP assets cannot be fully identified.

[0005] In a first aspect, a method for identifying enterprise IP assets is provided, the method comprising:

[0006] Obtain target identification information of the target enterprise to be identified; determine the target domain name corresponding to the target identification information according to the corresponding relationship between each enterprise identification information and the first domain name in the Internet content ICP database record;

[0007] According to each search path in the pre-constructed graph, determine a target search path with the target domain name as the source node and the IP as the terminal node; wherein the graph is constructed based on the website data and the PDNS data;

[0008] According to the first feature vectors of each node saved in advance, the target feature vector of each target node in the target search path is determined; the target feature vector of each target node is input into a pre-trained asset sequence classification model, and based on the asset sequence classification model, it is determined whether the IP and the target domain name belong to the same enterprise asset.

[0009] Furthermore, the process of pre-constructing the graph includes:

[0010] Determine the website data and PDNS data of each enterprise according to the enterprise identification information and the first domain name corresponding to each enterprise recorded in the ICP database, as well as the network database and the domain name system DNS database;

[0011] Using the website data and PDNS data of each enterprise as nodes, a graph structure is constructed;

[0012] According to the pre-saved search relationship between the nodes in the graph structure, each search path from the source node to the terminal node in the graph structure is determined, and a graph is constructed according to each search path.

[0013] Furthermore, using the website data and PDNS data of each enterprise as nodes, constructing a graph structure includes:

[0014] For each enterprise, using the website data and PDNS data of the enterprise as nodes, and according to preset connection rules, construct a subgraph structure of the enterprise;

[0015] For the subgraph structure of each enterprise, a node of a domain name or an IP address in the subgraph structure is used as a first node to be connected;

[0016] The different subgraph structures are connected according to the same first node to be connected to construct the graph structure.

[0017] Further, the PDNS data includes: a second domain name, at least one third domain name corresponding to the second domain name, and a first IP corresponding to each of the second domain name and the at least one third domain name; the website data includes: a uniform resource locator URL, a fourth domain name, a certificate cert, and a second IP;

[0018] According to the preset connection rules, constructing the subgraph structure of the enterprise includes:

[0019] The second domain name is connected to the at least one third domain name; the second domain name and the at least one third domain name are respectively connected to the corresponding first IP; the uniform resource locator URL is respectively connected to the fourth domain name, the certificate cert, and the second IP;

[0020] The data of the domain name or IP type in the PDNS data and the website data are used as the second nodes to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

[0021] Furthermore, the process of pre-saving the first feature vector of each node includes:

[0022] Determining an initial feature vector of each node in the graph;

[0023] For each search path in the graph, determine each sub-search path of the search path according to a preset sliding window;

[0024] For each of the sub-search paths, the initial feature vectors of the nodes in the sub-search path except the central node are added to obtain a second feature vector; the second feature vector is input into a vector prediction model, and a predicted feature vector is determined based on the vector prediction model; a first loss value is determined according to the predicted feature vector and the initial feature vector of the central node; according to the first loss value and a model parameter update algorithm, the model parameters of the vector prediction model and the initial feature vectors of the nodes except the central node are updated to obtain the first feature vectors of the nodes except the central node.

[0025] Furthermore, the process of pre-training the asset sequence classification model includes:

[0026] Determine a sample search path according to each search path in the pre-constructed graph; determine a first feature vector of each sample node in the sample search path according to the first feature vector of each node saved in advance;

[0027] The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained, and the enterprise affiliation confidence of the sample search path is predicted based on the asset sequence classification model; a second loss value is determined according to the enterprise affiliation label and the enterprise affiliation confidence; and the asset sequence classification model is trained according to the second loss value.

[0028] Furthermore, predicting the enterprise affiliation confidence of the sample search path based on the asset sequence classification model includes:

[0029] Based on the asset sequence classification model, the first feature vectors of each sample node are average-pooled to obtain a third feature vector; and the enterprise affiliation confidence of the sample search path is predicted based on the third feature vector.

[0030] Furthermore, before training the asset sequence classification model according to the second loss value, the method further includes:

[0031] Input the type label of each sample node into the asset sequence classification model to be trained, perform feature extraction on the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model, and obtain the first type feature vector of each sample node; predict the type confidence of each sample node according to the first type feature vector of each sample node; determine the third loss value according to the type label of each sample node and the type confidence of each sample node;

[0032] Training the asset sequence classification model according to the second loss value includes:

[0033] Determine the sum of the second loss value and the third loss value, update the sum to the second loss value, and train the asset sequence classification model according to the updated second loss value.

[0034] Further, predicting the type confidence of each sample node according to the first type feature vector of each sample node includes:

[0035] For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain a second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted according to the updated first type feature vector of the sample node.

[0036] In a second aspect, a device for identifying enterprise IP assets is provided, the device comprising:

[0037] A processing module, used for obtaining target identification information of a target enterprise to be identified;

[0038] A determination module is used to determine the target domain name corresponding to the target identification information according to the corresponding relationship between each enterprise identification information and the first domain name in the Internet content ICP database record; determine the target search path with the target domain name as the source node and the IP as the terminal node according to each search path in the pre-constructed graph; wherein the graph is constructed based on website data and PDNS data; determine the target feature vector of each target node in the target search path according to the first feature vector of each node saved in advance; input the target feature vector of each target node into the pre-trained asset sequence classification model, and determine whether the IP and the target domain name belong to the same enterprise asset based on the asset sequence classification model.

[0039] Furthermore, the determination module is specifically used to determine the website data and PDNS data of each enterprise according to the identification information of each enterprise and the first domain name corresponding to each enterprise recorded in the ICP database, as well as the network database and the domain name system DNS database;

[0040] The processing module is specifically used to construct a graph structure using the website data and PDNS data of each enterprise as nodes; determine each search path from the source node to the terminal node in the graph structure based on the pre-saved search relationship between the nodes in the graph structure, and construct a graph based on each search path.

[0041] Furthermore, the processing module is specifically used to construct a subgraph structure of each enterprise with the website data and PDNS data of the enterprise as nodes according to preset connection rules; for the subgraph structure of each enterprise, the node of the domain name or IP type in the subgraph structure is used as the first node to be connected; different subgraph structures are connected according to the same first node to be connected to construct the graph structure.

[0042] Furthermore, the processing module is specifically used to connect the second domain name with the at least one third domain name; the second domain name and the at least one third domain name are respectively connected with the corresponding first IP; the uniform resource locator URL is respectively connected with the fourth domain name, the certificate cert, and the second IP; the data of the domain name or IP type in the PDNS data and the website data is used as the second node to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

[0043] Furthermore, the determination module is specifically used to determine the initial feature vector of each node in the graph; for each search path in the graph, determine each sub-search path of the search path according to a preset sliding window;

[0044] The processing module is specifically used to add the initial feature vectors of the nodes in the sub-search path except the central node for each sub-search path to obtain a second feature vector; input the second feature vector into a vector prediction model, and determine a predicted feature vector based on the vector prediction model; determine a first loss value according to the predicted feature vector and the initial feature vector of the central node; and update the model parameters of the vector prediction model and the initial feature vectors of the nodes except the central node according to the first loss value and a model parameter update algorithm to obtain a first feature vector of the nodes except the central node.

[0045] Furthermore, the determination module is specifically used to determine the sample search path according to each search path in the pre-constructed graph; determine the first feature vector of each sample node in the sample search path according to the first feature vector of each node saved in advance;

[0046] The processing module is specifically used to input the first feature vector of each sample node and the enterprise affiliation label of the sample search path into the asset sequence classification model to be trained, predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model; determine the second loss value according to the enterprise affiliation label and the enterprise affiliation confidence; and train the asset sequence classification model according to the second loss value.

[0047] Furthermore, the processing module is specifically used to perform mean pooling on the first feature vectors of each sample node based on the asset sequence classification model to obtain a third feature vector; and predict the enterprise affiliation confidence of the sample search path based on the third feature vector.

[0048] Furthermore, the processing module is also used to input the type label of each sample node into the asset sequence classification model to be trained, perform feature extraction on the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model, and obtain the first type feature vector of each sample node; predict the type confidence of each sample node according to the first type feature vector of each sample node; determine a third loss value according to the type label of each sample node and the type confidence of each sample node; and train the asset sequence classification model according to the second loss value, including: determining the sum of the second loss value and the third loss value, updating the sum to the second loss value, and training the asset sequence classification model according to the updated second loss value.

[0049] Furthermore, the processing module is specifically used to, for each sample node, concatenate the first type feature vector of the sample node with the first type feature vector of the previous sample node to obtain a second type feature vector; update the second type feature vector to the first type feature vector of the sample node, and predict the type confidence of the sample node based on the updated first type feature vector of the sample node.

[0050] In a third aspect, an electronic device is provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0051] The memory is used to store computer programs;

[0052] The processor is used to implement any of the above methods when executing the program stored in the memory.

[0053] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program or instruction is stored in the storage medium, and when the computer program or instruction is executed by a communication device, any of the methods described above is implemented.

[0054] In a fifth aspect, a computer program product is provided, the computer program product comprising: a computer program code, and when the computer program code is executed on a computer, the method described in any one of the above is implemented.

[0055] In the embodiment of the present application, a graph is constructed through website data and PDNS data, and based on the constructed graph, a target search path with the target domain name corresponding to the enterprise to be identified as the source node and the IP as the termination node is determined. According to the first feature vector of each node in the pre-saved graph, based on the pre-trained asset sequence classification model, the target feature vector of each target node in the target search path is input into the asset sequence classification model to determine whether the IP and the target domain name belong to the same enterprise asset, thereby realizing the identification of the enterprise IP assets. Compared with searching and matching the enterprise IP assets based on website data, when the matching information is completely consistent, it can be determined whether the IP asset belongs to the enterprise, this application comprehensively obtains the data history source IP in the website data by combining the historical data stored in the PDNS data and constructing the graph based on the website data, and effectively integrates multiple data history source IPs in a complex network environment, thereby ensuring the comprehensiveness and accuracy of identifying IP assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0057] Figure 1 A schematic diagram of an enterprise IP asset identification process provided in an embodiment of the present application;

[0058] Figure 2 A schematic diagram of a process of constructing a map provided in an embodiment of the present application;

[0059] Figure 3 A schematic diagram of the structure of the graph provided in the embodiment of the present application;

[0060] Figure 4A schematic diagram of a process of constructing a graph structure provided in an embodiment of the present application;

[0061] Figure 5 A schematic diagram of a process of training the first feature vector of each node provided in an embodiment of the present application;

[0062] Figure 6 A schematic diagram of a specific process of training the first feature vector of each node provided in an embodiment of the present application;

[0063] Figure 7 One of the process diagrams of training an asset sequence classification model provided in an embodiment of the present application;

[0064] Figure 8 A schematic diagram of a specific process of training an asset sequence classification model provided in an embodiment of the present application;

[0065] Fig. 9 A second schematic diagram of a process for training an asset sequence classification model provided in an embodiment of the present application;

[0066] Fig.10 A schematic diagram of the overall process of the IP asset identification method provided in the embodiment of the present application;

[0067] Fig.11 A schematic diagram of the structure of an apparatus for enterprise IP asset identification provided in an embodiment of the present application;

[0068] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0070] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0071] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0072] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0073] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0075] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations. Embodiment 1:

[0076] Figure 1 A schematic diagram of an enterprise IP asset identification process provided in an embodiment of the present application includes the following steps:

[0077] S101: Acquire target identification information of a target enterprise to be identified.

[0078] The enterprise IP asset identification method provided in the embodiment of the present application is applied to an electronic device, which may be a computer (Personal Computer, PC), a server, etc.

[0079] The electronic device obtains identification information of the enterprise to be identified, such as the enterprise name, enterprise organization code, etc. The present application does not limit the process of obtaining the target identification information of the target enterprise to be identified. For example, the target identification information of the target enterprise to be identified is input by a user.

[0080] S102: Determine the target domain name corresponding to the target identification information according to the corresponding relationship between each piece of enterprise identification information and the first domain name in the Internet content ICP database record.

[0081] The ICP database records all the information provided by each website during the filing process. Specifically, the ICP database contains all the information of each enterprise when registering, such as enterprise identification, enterprise domain name, enterprise production address, etc. Therefore, based on the ICP database, the domain name corresponding to the target identification information of the enterprise to be identified can be obtained. The first domain name refers to the primary domain name corresponding to the target identification information of the enterprise in the ICP database, so the target domain name is the primary domain name corresponding to the target identification information of the enterprise to be identified.

[0082] A domain name is a unique identifier for a website on the Internet, for example, xxxx.com. The domain name can be used to quickly search and access the corresponding website. Users enter the domain name in the browser, and the domain name and IP address are mapped to each other through the domain name system (DNS), and the corresponding website can be opened.

[0083] S103: According to each search path in the pre-constructed graph, determine the target search path with the target domain name as the source node and the IP as the terminal node; wherein the graph is constructed based on the website data and the PDNS data.

[0084] PDNS data refers to data in the DNS database, including: the second domain name, at least one third domain name corresponding to the second domain name, and the first IP corresponding to the second domain name and at least one third domain name. Among them, the second domain name refers to the main domain name corresponding to the enterprise, the at least one third domain name corresponding to the second domain name refers to at least one historical subdomain name corresponding to the main domain name, and the first IP corresponding to the second domain name and at least one third domain name refers to the IP corresponding to the main domain name and at least one historical subdomain name.

[0085] Website data refers to the data in the network database, including: Uniform Resource Locator URL, fourth domain name, certificate cert and second IP.

[0086] In the embodiment of the present application, the URL is constructed by adding prefixes to the second domain name and the third domain name. Specifically, the second domain name is respectively added with a prefix of "http: / / " or "https: / / " to construct the URL, for example, http: / / +second domain name, https: / / +second domain name. The third domain name is respectively added with a prefix of http: / / or https: / / to construct the URL, for example, http: / / +third domain name, https: / / +third domain name. The fourth domain name, certificate cert, and second IP corresponding to each URL in the website data are obtained by performing a web crawler on each constructed URL.

[0087] Using URL, second domain name, third domain name, fourth domain name, cert, first IP, second IP and other data information as nodes, all nodes in the graph are connected through preset connection rules, and each search path in the graph is determined according to the preset search rules.

[0088] The preset connection rules refer to connection rules such as URL connecting to the fourth domain name, URL connecting to cert, URL connecting to the second IP, and the second domain name connecting to the third domain name; the preset search rules refer to search rules such as domain name searching for IP; IP searching for URL; URL searching for IP.

[0089] A search path refers to a path that can be used to find another piece of data through a certain piece of data.

[0090] The pre-constructed graph contains nodes composed of data information such as URL, second domain name, third domain name, fourth domain name, cert, first IP, second IP, and multiple search paths formed according to the search relationship between different nodes.

[0091] Each search path in the pre-constructed graph of the present application has a different source node or a different terminal node. The source node of each search path is the first node in the search path according to the search direction. The terminal node of each search path is the last node in the search path according to the search direction. The number of nodes contained in each search path can be the same or different.

[0092] According to the target domain name determined in step 102, that is, the primary domain name of the enterprise to be identified, a search path with the target domain name as the source node and any IP as the termination node is found in the pre-constructed graph. In an embodiment of the present application, in the pre-constructed graph, the search path of the enterprise to be identified may be one or more. For example, for enterprise a to be identified, the domain name a corresponding to the target identification information of enterprise a to be identified in the pre-constructed graph is respectively connected to the termination node IP1, the termination node IP2 and the termination node IP3, so at this time, enterprise a to be identified has three target search paths, namely, the search path from domain name a to IP1, the search path from domain name a to IP2, and the search path from domain name a to IP3.

[0093] S104: Determine a target feature vector of each target node in the target search path according to the first feature vectors of each node saved in advance.

[0094] When performing enterprise IP asset identification, a first feature vector is obtained according to the pre-stored data content of the node as the first feature vector of the node. Based on the pre-stored first feature vector of each node, a target feature vector of each target node in the target search path is obtained.

[0095] S105: Input the target feature vector of each target node into the pre-trained asset sequence classification model, and determine whether the IP and the target domain name belong to the same enterprise asset based on the asset sequence classification model.

[0096] The electronic device is pre-deployed with a trained asset sequence classification model, which can calculate the target feature vector of each target node based on the target feature vector of each target node in the input target search path and output a "yes" or "no" result. Through the result output by the asset sequence classification model, it is determined whether the terminal node IP and the source node target domain name of the input target search path belong to the same enterprise asset.

[0097] The source node of the target search path is the domain name information of the target enterprise. If the asset sequence classification model outputs a "yes" result, it proves that the terminal node IP in the target search path and the source node target domain name belong to the same enterprise asset, that is, the terminal node IP is the IP asset of the target enterprise; if the asset sequence classification model outputs a "no" result, the terminal node IP in the target search path and the source node target domain name do not belong to the same enterprise asset, that is, the terminal node IP is not the IP asset of the target enterprise.

[0098] In the embodiment of the present application, a graph is constructed through website data and PDNS data, and based on the constructed graph, a target search path with the target domain name corresponding to the enterprise to be identified as the source node and the IP as the termination node is determined. According to the first feature vector of each node in the pre-saved graph, based on the pre-trained asset sequence classification model, the target feature vector of each target node in the target search path is input into the asset sequence classification model to determine whether the IP and the target domain name belong to the same enterprise asset, thereby realizing the identification of the enterprise IP assets. Compared with searching and matching the enterprise IP assets based on website data, when the matching information is completely consistent, it can be determined whether the IP asset belongs to the enterprise, this application comprehensively obtains the data history source IP in the website data by combining the historical data stored in the PDNS data and constructing the graph based on the website data, and effectively integrates multiple data history source IPs in a complex network environment, thereby ensuring the comprehensiveness and accuracy of identifying IP assets. Embodiment 2:

[0099] In order to integrate multiple data historical source IPs in a complex network environment and ensure the comprehensiveness of identifying IP assets, this application combines the historical data stored in the PDNS data and pre-builds a graph based on the website data. Figure 2 A schematic diagram of a process of constructing a map provided in an embodiment of the present application, the process includes the following steps:

[0100] S201: Determine the website data and PDNS data of each enterprise according to the identification information of each enterprise and the first domain name corresponding to each enterprise recorded in the ICP database, as well as the network database and the domain name system DNS database.

[0101] Based on the ICP database, the corresponding first domain names are determined through the identification information of each enterprise; based on the domain name system DNS database, the corresponding first domain names are used to determine the multiple historical subdomain names corresponding to the corresponding first domain names and the IP corresponding to each domain name, which is the PDNS data; based on the network database, the website data of each enterprise is obtained through the first domain name and multiple historical subdomain names.

[0102] Specifically, obtain the website data and PDNS data of each enterprise through the following steps:

[0103] (1) Collect a large amount of corporate identification information, such as company names.

[0104] (2) Input each enterprise identification information into the ICP database to obtain the primary domain name registered by each enterprise.

[0105] (3) Input each main domain name into the DNS database, obtain the historical subdomain names of each main domain name and the IP addresses corresponding to each main domain name and each historical subdomain name, where each main domain name has at least one historical subdomain name.

[0106] Specifically, the PDNS data includes two types of data information, namely, the main domain name of each enterprise, at least one historical subdomain name corresponding to the main domain name, and the IP addresses corresponding to the main domain name and the historical subdomain name.

[0107] (4) Add the prefix http: / / or https: / / to each main domain name and each historical subdomain name to construct a URL. For example, the URL constructed by http: / / +main domain name, the URL constructed by https: / / +main domain name, the URL constructed by http: / / +historical subdomain name, and the URL constructed by https: / / +historical subdomain name.

[0108] (5) Based on the network database, crawl the constructed URL to obtain the website data of each enterprise.

[0109] Specifically, the website data includes four types of data information: URL, fourth domain name, certificate cert, second IP, etc.

[0110] S202: Using the website data and PDNS data of each enterprise as nodes, a graph structure is constructed.

[0111] According to the preset connection rules, for each enterprise, the website data URL, the fourth domain name, the certificate cert, and the second IP, these four types of data information are used as nodes and connected to obtain different edges. The specific connection method is: the URL node is the center to connect the other three nodes, that is, the URL is connected to the fourth domain name, the URL is connected to the cert, and the URL is connected to the second IP.

[0112] For each enterprise, the PDNS data includes the main domain name of each enterprise, at least one historical subdomain name corresponding to the main domain name, and the IP corresponding to the main domain name and the historical subdomain name. These two types of data information are used as nodes and connected to obtain different edges. The specific connection method is: the main domain name is connected to the IP corresponding to the main domain name, and the historical subdomain name is connected to the IP corresponding to the historical subdomain name, that is, the "A / AAAA" IP record of the domain name corresponding to each identifier in the physical meaning; the main domain name is connected to the historical subdomain name, that is, the pointing relationship between the domain names recorded in the alias record (CNAME). In a possible implementation method, when the IP corresponding to the historical subdomain name is the same as the IP corresponding to the main domain name, the historical subdomain name is connected to the IP corresponding to the main domain name.

[0113] like Figure 3 As shown in the left figure, different types of nodes and different edges are used to store website data and PDNS data in the same graph structure. The graph structure includes four types of nodes: domain name, URL, cert, and IP, as well as different connection edges determined by different connection methods.

[0114] S203: Determine each search path from a source node to a terminal node in the graph structure according to the search relationship between nodes in the pre-saved graph structure, and construct a graph according to each search path.

[0115] For different types of nodes, set the search relationship between nodes in the graph structure. Specifically: for PDNS data, the main domain name finds the historical subdomain name, and each domain name finds the corresponding IP; for website data, the fourth domain name / certificate / second IP finds the URL, the URL finds the fourth domain name / second IP, and the fourth domain name finds the cert.

[0116] In the embodiment of the present application, starting from any node as the source node, the source node may have search paths in multiple directions. Figure 3 As shown in the second figure from the left, after the PDNS data and website data are connected, the search relationships between the main types of nodes contained in the graph structure are: domain name search for domain name, domain name search for IP, domain name / cert / IP search for URL, URL search for domain name / IP, and domain name search for cert.

[0117] In the embodiment of the present application, based on the ICP database, the first domain name corresponding to each enterprise is determined through the identification information of each enterprise; based on the domain name system DNS database, the multiple historical subdomains corresponding to each first domain name and the IP corresponding to each domain name are determined through the first domain name corresponding to each enterprise, which is the PDNS data; based on the network database, the website data of each enterprise is obtained through the first domain name and multiple historical subdomains. Integrating the website data and PDNS data into the same graph, and establishing a search relationship between the website data and PDNS data, not only integrates multiple data historical source IPs in a complex network environment to ensure the comprehensiveness of identifying IP assets, but also makes it simple and fast to use the graph to search for IP assets. Embodiment 3:

[0118] This application provides a comprehensive and complete map for enterprise IP asset identification. When constructing the map structure, the website data and PDNS data of multiple enterprises are collected. Through the embodiment of this application, the connection method of website data and PDNS data between different enterprises is clearly explained.

[0119] Figure 4 A schematic diagram of a process of constructing a graph structure provided in an embodiment of the present application, the process includes the following steps:

[0120] S401: For each enterprise, the enterprise's website data and PDNS data are used as nodes, and a subgraph structure of the enterprise is constructed according to preset connection rules.

[0121] The preset connection rule is consistent with the above step 202 and will not be described again.

[0122] The subgraph structure refers to the graph structure of each enterprise consisting of the website data and PDNS data of each enterprise.

[0123] S402: For the subgraph structure of each enterprise, a node of a domain name or IP type in the subgraph structure is used as a first node to be connected.

[0124] The subgraph structure contains the website data and PDNS data of the same enterprise. According to the data types in the website data and PDNS data of the same enterprise, the four types of nodes, namely domain name, IP, URL, and cert, are determined; according to the connection rules between different types of nodes, the connection edges are determined.

[0125] The first node to be connected refers to a node whose type is a domain name or an IP in the subgraph structure. In other words, the first node to be connected can be a domain name or an IP.

[0126] S403: Connect different subgraph structures according to the same first node to be connected to construct a graph structure.

[0127] For every two subgraph structures, the first nodes to be connected with the same data content in the two subgraph structures are identified, and the first nodes to be connected with the same data content are connected respectively, so that the subgraph structures between different enterprises are stored in the same graph structure.

[0128] For example, (1) for the subgraph structure a of enterprise A and the subgraph structure b of enterprise B, it is identified that domain name 1 and domain name 2 exist in subgraph structure a, and domain name 1 and domain name 2 also exist in subgraph structure b, then these two domain name 1 and two domain name 2 are the same first nodes to be connected in these two subgraphs, at this time, the two domain name 1 will be connected, and the two domain name 2 will be connected to obtain a constructed graph structure. (2) for the subgraph structure a of enterprise A and the subgraph structure b of enterprise B, it is identified that IP1 and IP2 exist in subgraph structure a, and IP1 and IP2 also exist in subgraph structure b, then these two IP1 and two IP2 are the same first nodes to be connected in these two subgraphs, at this time, the two IP1 will be connected, and the two IP2 will be connected to obtain a constructed graph structure. (3) For the subgraph structure a of enterprise A and the subgraph structure b of enterprise B, it is identified that domain name 1 and IP2 exist in subgraph structure a, and domain name 1 and IP2 also exist in subgraph structure b. Then these two domain names 1 and two IP2 are the same first nodes to be connected in these two subgraphs. At this time, the two domain names 1 will be connected, and the two IP2 will be connected to obtain a constructed graph structure.

[0129] In one possible implementation, in order to make the constructed graph structure data simple and clear, when connecting sub-graph structures between different enterprises, the present application retains only one of the two first nodes to be connected with the same identified data content, and then connects the sub-graph structures of different enterprises. Embodiment 4:

[0130] This application provides a comprehensive and complete graph for enterprise IP asset identification. When constructing the graph structure, the website data and PDNS data of the same enterprise are collected. Through the embodiment of this application, it is introduced how to connect the website data and PDNS data of the same enterprise and construct a subgraph structure.

[0131] According to the above step 201, the PDNS data includes: the second domain name, at least one third domain name corresponding to the second domain name, and the first IP corresponding to the second domain name and at least one third domain name. The website data includes: the uniform resource locator URL, the fourth domain name, the certificate cert and the second IP.

[0132] According to the above step 202, the preset connection rules include: the second domain name is connected to at least one third domain name; the second domain name and at least one third domain name are respectively connected to the corresponding first IP; the uniform resource locator URL is respectively connected to the fourth domain name, the certificate cert, and the second IP.

[0133] For the same enterprise, the data of the domain name or IP type in the PDNS data and the website data are used as the second nodes to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

[0134] That is to say, for the PDNS data and website data of the same enterprise, you can choose to first connect the PDNS data according to the preset connection rules to obtain the PDNS data graph; and connect the website data according to the preset connection rules to obtain the website data graph. Based on these two data graphs, identify the second nodes to be connected with the same data content in the PDNS data graph and the website data graph, and connect the second nodes to be connected with the same data content respectively, so that the PDNS data graph and the website data graph of the same enterprise are stored in the same subgraph structure.

[0135] For example, (1) for the PDNS data graph and website data graph of enterprise A, it is identified that domain name 1 and domain name 2 exist in the PDNS data graph, and domain name 1 and domain name 2 also exist in the website data graph, then these two domain name 1 and two domain name 2 are the same second nodes to be connected in the PDNS data graph and the website data graph, at this time, the two domain name 1 will be connected, and the two domain name 2 will be connected to obtain the subgraph structure constructed by enterprise A. (2) for the PDNS data graph and website data graph of enterprise A, it is identified that IP1 and IP2 exist in the PDNS data graph, and IP1 and IP2 also exist in the website data graph, then these two IP1 and two IP2 are the same second nodes to be connected in the PDNS data graph and the website data graph, at this time, the two IP1 will be connected, and the two IP2 will be connected to obtain the subgraph structure constructed by enterprise A. (3) For the PDNS data graph and website data graph of enterprise A, it is identified that domain name 1 and IP2 exist in the PDNS data graph, and domain name 1 and IP2 also exist in the website data graph. Then these two domain names 1 and two IP2s are the same second nodes to be connected in the PDNS data graph and the website data graph. At this time, the two domain names 1 will be connected, and the two IP2s will be connected to obtain the subgraph structure constructed by enterprise A.

[0136] In one possible implementation, in order to make the constructed graph structure data simple and clear, when connecting the graph structure between the same enterprises, the present application only retains one of the two second nodes to be connected with the same data content, and then connects the PDNS data and website data of the same enterprise to obtain the subgraph structure of the enterprise. Embodiment 5:

[0137] In order to solve the problem of being unable to effectively integrate and utilize multiple data source IPs in a website in a complex network environment, this application integrates PDNS data and website data into a graph, and trains the feature vector of each node in the graph based on the co-occurrence of the nodes. Figure 5 A schematic diagram of a process of training the first feature vector of each node provided in an embodiment of the present application, the process comprising the following steps:

[0138] S501: Determine the initial feature vector of each node in the graph.

[0139] The feature vectors of all nodes in the constructed graph are randomly initialized to obtain the initial feature vectors of each node in the graph.

[0140] S502: For each search path in the graph, determine each sub-search path of the search path according to a preset sliding window.

[0141] Combined with the graph constructed in step 203, and the relationship between the connected rules and searches in step 202, a search path is obtained, as shown in the third from the left of 3. The graph structure contains a search path of domain name-domain name-cert-URL-IP-URL-cert. Modeling is performed using the co-occurrence of each node in the search path.

[0142] When determining each sub-search path of the search path, the size of the sliding window is fixed, for example, a sliding window of 5, a sliding window of 3, and so on.

[0143] For the obtained search path, multiple sub-search paths are determined based on the preset sliding window. For example, if the search path contains 7 nodes, namely abcdefg, and the preset sliding window is 5, then the sub-search paths are abcde, bcdef, and cdefg.

[0144] S503: For each sub-search path, the initial feature vectors of the nodes in the sub-search path except the central node are added to obtain a second feature vector.

[0145] The central node is the node at the center of a search path. In each sliding window, the central node is hidden. The specific process diagram of the first feature vector training of each node provided in the embodiment of the present application is as follows: Figure 6As shown, for the sub-search paths in the same search path, the position of the central node removed in each sub-search path should be consistent. For example, the search path A contains 7 nodes, namely abcdefg, and the preset sliding window is 5, then the sub-search paths are abcde, bcdef, and cdefg. For the sub-search path abcde, the sub-search path bcdef, and the sub-search path cdefg, remove the initial feature vector of the middle node c, remove the initial feature vector of the middle node d, and remove the initial feature vector of the middle node e. After removing the initial feature vector of the central node, add the initial feature vectors of the remaining nodes to obtain the second feature vector.

[0146] In a possible implementation, the central node may also be a node that is not the exact center. At this time, for the sub-search paths in the same search path, the position of the central node removed in each sub-search path should also be consistent. For example, the search path A contains 7 nodes, namely abcdefg, and the preset sliding window is 5, then the sub-search paths are abcde, bcdef, and cdefg. If the sub-search path abcde chooses to remove the initial feature vector of the second position b when removing the initial feature vector of the intermediate node, then the sub-search path bcdef also chooses to remove the initial feature vector of the second position c when removing the initial feature vector of the intermediate node. Similarly, at this time, the sub-search path cdefg also chooses to remove the initial feature vector of the second position d when removing the initial feature vector of the intermediate node. After removing the initial feature vector of the non-exact center node, add the initial feature vectors of the remaining nodes to obtain the second feature vector.

[0147] S504: Input the second feature vector into the vector prediction model, and determine a predicted feature vector based on the vector prediction model.

[0148] The second feature vector is input into the fully connected layer of the vector prediction model for feature extraction to obtain a predicted feature vector.

[0149] S505: Determine a first loss value according to the predicted feature vector and the initial feature vector of the central node.

[0150] A first loss value is obtained by calculating the predicted feature vector obtained in step 404 and the initial feature vector of the hidden node in the sliding window through a cross entropy loss function. The first loss value may represent the difference between the predicted feature vector and the initial feature vector of the central node.

[0151] S506: According to the first loss value and the model parameter updating algorithm, the model parameters of the vector prediction model and the initial feature vectors of the nodes except the central node are updated to obtain the first feature vectors of the nodes except the central node.

[0152] The model parameter updating algorithm may be a gradient descent method, Newton's method, etc. The specific model parameter updating algorithm used is not limited here.

[0153] Gradient descent is performed according to the cross entropy loss function, and the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the central node are updated to obtain the first feature vectors of the nodes other than the central node. The updated model parameters and the first feature vectors of the nodes other than the central node are adjusted based on the first sliding window, and when the second sliding window is updated, the updated first feature vectors of the nodes in the second sliding window are used as the initial feature vectors to execute step 503 and subsequent steps.

[0154] In a possible implementation, for each sliding window, the model parameters are adjusted and updated based on the initial feature vector of each node, and the first feature vector of each node is updated.

[0155] The embodiment of the present application updates the initial feature vector of each node in the constructed graph through iterative training based on a preset target value of the loss value to obtain the first feature vector of all the nodes in the graph.

[0156] In the embodiment of the present application, the data of the nodes in the graph are initialized, a sliding window is set for each search path in the graph, and a sub-search path is determined; the loss value is calculated based on the predicted feature vector of the feature vectors of the surrounding nodes in the sub-search path and the feature vector of the hidden central node; according to the loss value and the model parameter update algorithm, the model parameters are adjusted and the first feature vector of the nodes other than the central node is updated, and the first feature vector of each node in the graph is obtained through iterative training. The first feature vector of each node in the graph effectively integrates the problem of multiple data history source IPs in the website. Embodiment 6:

[0157] In order to facilitate the rapid identification of a company's IP assets, this application also pre-trains an asset sequence classification model that can be directly identified. Figure 7 This is one of the process diagrams of a training asset sequence classification model provided in an embodiment of the present application, and the process includes the following steps:

[0158] S701: Determine a sample search path based on each search path in a pre-constructed graph.

[0159] The sample search path includes a positive sample search path and a negative sample search path. Among them, the positive sample search path refers to a sample search path with the domain name of the enterprise to be identified as the source node and the IP of the enterprise as the terminal node. The negative sample search path refers to a sample search path with the domain name of the enterprise to be identified as the source node and the IP that is not the enterprise as the terminal node. Optionally, the number of positive sample search paths obtained by this application is greater than the number of negative sample search paths.

[0160] Through the ICP database, the domain name information of the enterprise and the known enterprise IP are obtained. Based on the domain name and the known enterprise IP, a positive sample search path with the domain name of the enterprise as the source node and the IP of the enterprise as the end node is determined in the constructed graph. And based on the domain name and the known enterprise IP that is not the enterprise, a negative sample search path with the domain name of the enterprise as the source node and the IP that is not the enterprise as the end node is determined in the constructed graph.

[0161] S702: Determine the first feature vector of each sample node in the sample search path according to the first feature vector of each node saved in advance.

[0162] According to the first feature vector of each node in the graph, the first feature vector of each sample node in each sample search path is obtained. The above embodiment has described the process of determining the first feature vector of each node in the graph, which will not be repeated here.

[0163] S703: Input the first feature vector of each sample node and the enterprise affiliation label of the sample search path into the asset sequence classification model to be trained, and predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model.

[0164] The enterprise affiliation labels of the sample search path are 0 and 1. When the input sample search path is a positive sample search path, the enterprise affiliation label is 1; when the input sample search path is a negative sample search path, the enterprise affiliation label is 0.

[0165] The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained. The asset sequence classification model outputs the predicted enterprise affiliation confidence of each input sample search path. The predicted enterprise affiliation confidence of the sample search path is a value between 0 and 1.

[0166] S704: Determine a second loss value according to the enterprise affiliation label and the enterprise affiliation confidence; and train the asset sequence classification model according to the second loss value.

[0167] According to the enterprise affiliation label and the enterprise affiliation confidence, based on the cross entropy loss function, the second loss value is calculated, and the model parameters of the asset sequence classification model are adjusted according to the second loss value. The asset sequence classification model is iteratively trained by inputting the first feature vector of each node of the multiple sample search path, and when the loss value reaches the preset target loss value, the trained asset sequence classification model is obtained. Or when the number of training times meets the preset target value, the trained asset sequence classification model is obtained.

[0168] In the embodiment of the present application, the trained asset sequence classification model AssetSeqNet can directly determine whether the enterprise IP asset to be identified belongs to the enterprise. Compared with searching and then matching information, it is quick and simple, and improves the speed of enterprise IP asset identification. Embodiment 7:

[0169] The embodiment of the present application fully illustrates the process of predicting the enterprise affiliation confidence of the sample search path based on the asset sequence classification model in the above embodiment.

[0170] The confidence of enterprise affiliation based on the asset sequence classification model predicting sample search paths includes:

[0171] Based on the asset sequence classification model, the first eigenvector of each sample node is mean-pooled to obtain the third eigenvector; the enterprise affiliation confidence of the sample search path is predicted based on the third eigenvector.

[0172] like Figure 8 As shown in FIG. 1 , the input of the asset sequence classification model is the first feature vector of each sample node in the sample search path. The asset sequence classification model performs mean pooling on the first feature vector output of each node in the sample search path to obtain the third feature vector.

[0173] The third eigenvector represents the eigenvector of the entire sample search path. The eigenvector obtains the logit value through the fully connected layer of the neural network and the sigmoid activation function in the asset sequence classification model. , which is the confidence of the enterprise affiliation of the predicted sample search path.

[0174] Leveraging corporate affiliation confidence And label y, determine the cross entropy loss function, the specific formula is: Based on the cross loss function, the second loss value L in step 704 of the above embodiment is calculated. cls . Embodiment 8:

[0175] In order to better integrate the acquired PDNS data and network data, the present application also performs relationship modeling on the node type of each node. Fig. 9 The second schematic diagram of a process for training an asset sequence classification model provided in an embodiment of the present application includes the following steps:

[0176] S901: Input the type label of each sample node into the asset sequence classification model to be trained, perform feature extraction on the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model, and obtain the first type feature vector of each sample node.

[0177] Set labels of "0" and "1" for different sample node types. For example, when the node type is a domain name type loss value, the label of the domain name type is "1" and the labels of other types are "0"; when the node type is an IP type loss value, the label of the IP type is "1" and the labels of other types are "0"; when the node type is a URL type loss value, the label of the URL type is "1" and the labels of other types are "0"; when the node type is a cert type loss value, the label of the cert type is "1" and the labels of other types are "0".

[0178] The first feature vector of each node in the sample search path is input into the asset sequence classification model, and the first feature vector of each sample node is extracted based on the type extraction subnetwork in the asset sequence classification model to obtain the first type feature vector of each sample node. The type extraction subnetwork can be a recurrent neural network RNN ​​or a convolutional neural network CNN, which is not limited.

[0179] The first type of feature vector is a feature vector related to the type of each sample node.

[0180] S902: predicting the type confidence of each sample node according to the first type feature vector of each sample node.

[0181] The first type feature vector of each sample node is predicted through the asset sequence classification model. The type confidence of each sample node predicted It is a value between 0 and 1.

[0182] S903: Determine a third loss value according to the type label of each sample node and the type confidence of each sample node.

[0183] According to the type label of each sample node input in step 901 and the type confidence of each sample node predicted in step 902 , based on the cross entropy loss function , calculate the third loss value Lpos of each type in each sample node.

[0184] S904: Training the asset sequence classification model according to the second loss value includes: determining the sum of the second loss value and the third loss value, updating the sum to the second loss value, and training the asset sequence classification model according to the updated second loss value.

[0185] The step 704 of training the asset sequence classification model according to the second loss value includes: cls And the third loss value L of the type of each sample node in the sample search path pos After adding, we get the new second loss value , specifically , where i represents the i-th sample search path, N is the total number of sample search paths; j represents the j-th node of the i-th sample search path, and the sample search path has L nodes. The asset sequence classification model is trained using the updated second loss value.

[0186] In the embodiment of the present application, when training the asset sequence classification model, on the one hand, the relationship between the source node and the terminal node in the search path is modeled; on the other hand, the type of each node in the search path is modeled. By adding the extraction of the type feature vector of each node in the sample search path, the third loss value is calculated for the type feature vector of each node; by calculating and summing the double loss values ​​of the first feature vector and the first type feature vector of each sample node, the model parameters of the asset sequence classification model are adjusted based on the summed loss value, which not only ensures the modeling of the overall characteristics of each sample node, but also combines the modeling of the type characteristics of each sample node, effectively captures the dependency between the types of each sample node in the sample search path, thereby enhancing the robustness and predictive ability of the asset sequence classification model. Embodiment 9:

[0187] The embodiment of the present application fully illustrates the process of predicting the type confidence of each sample node according to the first type feature vector of each sample node in the above-mentioned embodiment 8.

[0188] For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain a second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted according to the updated first type feature vector of the sample node.

[0189] In the embodiment of the present application, the types of the nodes in the sample search path affect each other, and the asset sequence classification model models the type of each node in the sample search path. The asset sequence classification model concatenates the first type feature vector of the current position with the first type feature vector of the previous position, and uses the new type feature vector obtained after concatenation as the first type feature vector of the current position.

[0190] For example, Figure 8 As shown, the sample search path is domain name→domain name→cert→URL→IP. When modeling the type of each node, the type of each sample node in the sample search path is only related to the type of the previous sample node. In other words, the asset sequence classification model will first initialize a type feature vector. When modeling the type of each node, the asset sequence classification model will concatenate the initialized type feature vector with the first type feature vector of the first position node "domain name" to obtain the concatenated first type feature vector, and update the concatenated first type feature vector to the first position node "domain name"; concatenate the first type feature vector of the second position node "domain name" with the first type feature vector of the first position node "domain name" to obtain the concatenated first type feature vector, and update the concatenated first type feature vector to the first type feature vector of the second position node "domain name"; and concatenate the first type feature vector of the third position node "cert" with the second position node "domain name". " are spliced ​​to obtain a spliced ​​first type feature vector, and the spliced ​​first type feature vector is updated to the first type feature vector of the third position node "cert"; the first type feature vector of the fourth position node "URL" and the first type feature vector of the third position node "cert" are spliced ​​to obtain a spliced ​​first type feature vector, and the spliced ​​first type feature vector is updated to the first type feature vector of the fourth position node "URL"; the first type feature vector of the fifth position node "IP" and the first type feature vector of the fourth position node "URL" are spliced ​​to obtain a spliced ​​first type feature vector, and the spliced ​​first type feature vector is updated to the first type feature vector of the fifth position node "IP".

[0191] When the first type feature vector of each node is updated in the sample search path, the electronic device performs splicing calculation based on the first type feature vector extracted by the type extraction subnetwork in the asset sequence classification model. In a possible implementation, the electronic device can perform splicing calculation based on the first type feature vector updated at the previous position node.

[0192] The updated first-type feature vector of the sample node is input into the fully connected layer and sigmoid activation function of the asset sequence classification model to obtain the logit value , that is, the type confidence of the predicted sample node. The type confidence of the predicted sample node is classified into four categories to obtain the type confidence of each sample node, for example, the type confidence of the label can be the domain name, the type confidence of the label can be the IP, the type confidence of the label can be the URL, and the type confidence of the label can be the cert.

[0193] According to the confidence of each type and the label of each type, the cross entropy loss function is determined. The specific formula is: The cross entropy loss function is used to calculate the third loss value in step 903 above.

[0194] Embodiment 10:

[0195] Fig.10 A schematic diagram of the overall process of the IP asset identification method provided in the embodiment of the present application.

[0196] (1) Data acquisition process, that is, the above-mentioned step 201.

[0197] Specifically: 1) Enterprise name collection: collect a large amount of enterprise identification information, such as enterprise names. 2) ICP data to obtain the main domain name: enter each enterprise identification information into the ICP database to obtain the main domain name registered by each enterprise. 3) Obtain some historical subdomains based on DNS: enter each main domain name into the DNS database, obtain the historical subdomain name of each main domain name and the IP corresponding to each main domain name and each historical subdomain name, where each main domain name has at least one historical subdomain name. 4) Website crawler: Based on the network database, crawl the constructed URL to obtain the website data of each enterprise.

[0198] (2) Graph training process, namely, the above-mentioned steps 202, 203, and Example 5.

[0199] Specifically: 1) Split the website data and DNS data into multiple features, each feature corresponds to a node. That is step 202 in the above embodiment, which will not be repeated here. 2) Use the nodes to construct a graph. That is step 203 in the above embodiment, which will not be repeated here. 3) Select the path based on the regularized random walk strategy: According to the search relationship between the nodes in the pre-saved graph structure, determine the search path from each source node to the terminal node in the graph structure. 4) Construct a classification model based on the co-occurrence of nodes. 5) Complete the training of nodes in the graph database. That is embodiment 5 above, which will not be repeated here.

[0200] (3) IP asset expansion process, namely, the above-mentioned steps 701, 704, and Example 8.

[0201] Specifically: 1) Based on ICP data and enterprise name, obtain the main domain name of the enterprise. That is step 701 in the above embodiment, which will not be repeated here. 2) Multiple paths (positive samples) can be selected with the enterprise domain name as the source node and the IP as the end node. That is step 701 in the above embodiment, which will not be repeated here. 3) Multiple paths (negative samples) can be selected with any node as the source node and the IP as the end node. That is step 701 in the above embodiment, which will not be repeated here. 4) Use the node feature vector in the graph to model the relationship between the source node and the end node in the sequence. That is step 704 in the above embodiment, which will not be repeated here. 5) At the same time, the type of each node in the sequence is also modeled. That is embodiment 8 above, which will not be repeated here.

[0202] In practice, the present application can be implemented and used in multiple scenarios, and specific embodiments are listed below:

[0203] 1. Enterprise network asset management and visualization

[0204] Implementation step 1: Collect domain names, ICP data, PDNS data, and website crawler data.

[0205] Implementation step 2: Use PDNS data and website data to build a graph and train the feature vector of each node in the graph; use the graph feature vector to train AssetSeqNet.

[0206] Implementation step three: Enter any company name and get the company's domain name based on ICP data. Find the node of the domain name in the graph, use the domain name node as the source node, and the connected IP node as the end node. Enter the path of the source node and the end node into AssetSeqNet, and AssetSeqNet outputs whether the end node and the source node belong to the same company asset.

[0207] Implementation step four: Provide the identified IP assets to the company's security experts, who will manage the IP assets and visualize the asset connections. The company can understand the status and distribution of network assets in real time and improve the efficiency of security monitoring.

[0208] An important application of enterprise IP asset identification technology in network security is enterprise network asset management and visualization. By using this technology, enterprises can comprehensively discover and identify all types of IP assets in their network. This technology supports the classification and labeling of assets, thereby helping enterprises distinguish between important and secondary assets and evaluate them according to the risks they expose. This process can reveal potential vulnerabilities and threats, and support enterprises to formulate more accurate and effective security strategies. At the same time, through visualization, enterprises can understand the status and distribution of network assets in real time, improving the efficiency of security monitoring.

[0209] 2. Compliance Audit

[0210] Implementation step 1: Collect domain names, ICP data, PDNS data, and website crawler data.

[0211] Implementation step 2: Use PDNS data and website data to build a graph and train the feature vector of each node in the graph; use the graph feature vector to train AssetSeqNet.

[0212] Implementation step three: Enter any company name and get the company's domain name based on ICP data. Find the node of the domain name in the graph, use the domain name node as the source node, and the connected IP node as the end node. Enter the path of the source node and the end node into AssetSeqNet, and AssetSeqNet outputs whether the end node and the source node belong to the same company asset.

[0213] Implementation Step 4: Use the identified IP assets to promptly detect unauthorized or high-risk devices, ensure that all network assets operate within the scope of compliance, and reduce the legal and financial risks that may be faced due to violations.

[0214] In the process of compliance audit, enterprise IP asset identification technology can be used to improve the effectiveness of risk control and compliance audit. This technology can automatically scan the enterprise network, promptly discover unauthorized or high-risk devices, and ensure that all network assets operate within the scope of compliance. This timely detection and identification helps enterprises proactively discover problems during the audit process, reduce human errors, and reduce compliance risks caused by failure to promptly discover illegal devices. In addition, continuous asset discovery and monitoring can ensure that enterprises are always in compliance and reduce the legal and financial risks that may be faced due to violations.

[0215] Embodiment 11:

[0216] Based on the same application concept, the present application embodiment provides a device for enterprise IP asset identification. Fig.11 For a schematic diagram of the structure of an enterprise IP asset identification device provided in the embodiment of the present application, please refer to Fig.11, the device comprises:

[0217] Processing module 1101, used to obtain target identification information of a target enterprise to be identified;

[0218] The determination module 1102 is used to determine the target domain name corresponding to the target identification information according to the corresponding relationship between each enterprise identification information and the first domain name in the Internet content ICP database record; determine the target search path with the target domain name as the source node and the IP as the terminal node according to each search path in the pre-constructed graph; wherein the graph is constructed based on the website data and the PDNS data; determine the target feature vector of each target node in the target search path according to the first feature vector of each node saved in advance; input the target feature vector of each target node into the pre-trained asset sequence classification model, and determine whether the IP and the target domain name belong to the same enterprise asset based on the asset sequence classification model.

[0219] Furthermore, the determination module 1102 is specifically used to determine the website data and PDNS data of each enterprise according to the identification information of each enterprise and the first domain name corresponding to each enterprise recorded in the ICP database, as well as the network database and the domain name system DNS database;

[0220] The processing module 1101 is specifically used to construct a graph structure using the website data and PDNS data of each enterprise as nodes; determine each search path from the source node to the terminal node in the graph structure based on the pre-saved search relationship between the nodes in the graph structure, and construct a graph based on each search path.

[0221] Furthermore, the processing module 1101 is specifically used to construct a subgraph structure of each enterprise with the website data and PDNS data of the enterprise as nodes according to preset connection rules; for the subgraph structure of each enterprise, the node of the domain name or IP type in the subgraph structure is used as the first node to be connected; different subgraph structures are connected according to the same first node to be connected to construct the graph structure.

[0222] Furthermore, the processing module 1101 is specifically used to connect the second domain name with the at least one third domain name; the second domain name and the at least one third domain name are respectively connected with the corresponding first IP; the uniform resource locator URL is respectively connected with the fourth domain name, the certificate cert, and the second IP; the data of the domain name or IP type in the PDNS data and the website data is used as the second node to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

[0223] Furthermore, the determination module 1102 is specifically used to determine the initial feature vector of each node in the graph; for each search path in the graph, determine each sub-search path of the search path according to a preset sliding window;

[0224] The processing module 1101 is specifically used to add the initial feature vectors of the nodes in the sub-search path except the central node for each sub-search path to obtain a second feature vector; input the second feature vector into a vector prediction model, and determine a predicted feature vector based on the vector prediction model; determine a first loss value according to the predicted feature vector and the initial feature vector of the central node; and update the model parameters of the vector prediction model and the initial feature vectors of the nodes except the central node according to the first loss value and a model parameter update algorithm to obtain the first feature vectors of the nodes except the central node.

[0225] Further, the determination module 1102 is specifically used to determine a sample search path according to each search path in the pre-constructed graph; determine the first feature vector of each sample node in the sample search path according to the first feature vector of each node saved in advance;

[0226] The processing module 1101 is specifically used to input the first feature vector of each sample node and the enterprise affiliation label of the sample search path into the asset sequence classification model to be trained, predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model; determine the second loss value according to the enterprise affiliation label and the enterprise affiliation confidence; and train the asset sequence classification model according to the second loss value.

[0227] Furthermore, the processing module 1101 is specifically configured to perform mean pooling on the first feature vectors of each sample node based on the asset sequence classification model to obtain a third feature vector; and predict the enterprise affiliation confidence of the sample search path based on the third feature vector.

[0228] Furthermore, the processing module 1101 is also used to input the type label of each sample node into the asset sequence classification model to be trained, perform feature extraction on the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model, and obtain the first type feature vector of each sample node; predict the type confidence of each sample node according to the first type feature vector of each sample node; determine a third loss value according to the type label of each sample node and the type confidence of each sample node; and train the asset sequence classification model according to the second loss value, including: determining the sum of the second loss value and the third loss value, updating the sum to the second loss value, and training the asset sequence classification model according to the updated second loss value.

[0229] Furthermore, the processing module 1101 is specifically used to, for each sample node, concatenate the first type feature vector of the sample node with the first type feature vector of the previous sample node to obtain a second type feature vector; update the second type feature vector to the first type feature vector of the sample node, and predict the type confidence of the sample node based on the updated first type feature vector of the sample node.

[0230] Embodiment 12:

[0231] Based on the same application concept, the embodiment of the present application provides an electronic device, which can implement the steps of the enterprise IP asset identification method discussed above. Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Fig.12 As shown, it includes: a processor 1201, a communication interface 1202, a memory 1203 and a communication bus 1204, wherein the processor 1201, the communication interface 1202, and the memory 1203 communicate with each other through the communication bus 1204;

[0232] The memory 1203 stores a computer program. When the program is executed by the processor 1201, the processor 1201 performs the following steps:

[0233] Obtain target identification information of the target enterprise to be identified; determine the target domain name corresponding to the target identification information according to the corresponding relationship between each enterprise identification information and the first domain name in the Internet content ICP database record;

[0234] According to each search path in the pre-constructed graph, determine a target search path with the target domain name as the source node and the IP as the terminal node; wherein the graph is constructed based on the website data and the PDNS data;

[0235] According to the first feature vectors of each node saved in advance, the target feature vector of each target node in the target search path is determined; the target feature vector of each target node is input into a pre-trained asset sequence classification model, and based on the asset sequence classification model, it is determined whether the IP and the target domain name belong to the same enterprise asset.

[0236] Furthermore, the processor 1201 is also used to pre-build the map, and the process includes:

[0237] Determine the website data and PDNS data of each enterprise according to the enterprise identification information and the first domain name corresponding to each enterprise recorded in the ICP database, as well as the network database and the domain name system DNS database;

[0238] Using the website data and PDNS data of each enterprise as nodes, a graph structure is constructed;

[0239] According to the pre-saved search relationship between the nodes in the graph structure, each search path from the source node to the terminal node in the graph structure is determined, and a graph is constructed according to each search path.

[0240] Furthermore, the processor 1201 is further configured to construct a graph structure using the website data and PDNS data of each enterprise as nodes, including:

[0241] For each enterprise, using the website data and PDNS data of the enterprise as nodes, and according to preset connection rules, construct a subgraph structure of the enterprise;

[0242] For the subgraph structure of each enterprise, a node of a domain name or an IP address in the subgraph structure is used as a first node to be connected;

[0243] The different subgraph structures are connected according to the same first node to be connected to construct the graph structure.

[0244] Further, the processor 1201 is further configured to: the PDNS data includes: a second domain name, at least one third domain name corresponding to the second domain name, and a first IP corresponding to each of the second domain name and the at least one third domain name; the website data includes: a uniform resource locator URL, a fourth domain name, a certificate cert, and a second IP;

[0245] According to the preset connection rules, constructing the subgraph structure of the enterprise includes:

[0246] The second domain name is connected to the at least one third domain name; the second domain name and the at least one third domain name are respectively connected to the corresponding first IP; the uniform resource locator URL is respectively connected to the fourth domain name, the certificate cert, and the second IP;

[0247] The data of the domain name or IP type in the PDNS data and the website data are used as the second nodes to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

[0248] Furthermore, the processor 1201 is further configured to pre-save the first feature vector of each node, including:

[0249] Determining an initial feature vector of each node in the graph;

[0250] For each search path in the graph, determine each sub-search path of the search path according to a preset sliding window;

[0251] For each of the sub-search paths, the initial feature vectors of the nodes in the sub-search path except the central node are added to obtain a second feature vector; the second feature vector is input into a vector prediction model, and a predicted feature vector is determined based on the vector prediction model; a first loss value is determined according to the predicted feature vector and the initial feature vector of the central node; according to the first loss value and a model parameter update algorithm, the model parameters of the vector prediction model and the initial feature vectors of the nodes except the central node are updated to obtain the first feature vectors of the nodes except the central node.

[0252] Furthermore, the processor 1201 is also used for pre-training the asset sequence classification model, and the process includes:

[0253] Determine a sample search path according to each search path in the pre-constructed graph; determine a first feature vector of each sample node in the sample search path according to the first feature vector of each node saved in advance;

[0254] The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained, and the enterprise affiliation confidence of the sample search path is predicted based on the asset sequence classification model; a second loss value is determined according to the enterprise affiliation label and the enterprise affiliation confidence; and the asset sequence classification model is trained according to the second loss value.

[0255] Furthermore, the processor 1201 is further configured to predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model, including:

[0256] Based on the asset sequence classification model, the first feature vectors of each sample node are average-pooled to obtain a third feature vector; and the enterprise affiliation confidence of the sample search path is predicted based on the third feature vector.

[0257] Furthermore, the processor 1201 is further configured to, before training the asset sequence classification model according to the second loss value, the method further includes:

[0258] Input the type label of each sample node into the asset sequence classification model to be trained, perform feature extraction on the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model, and obtain the first type feature vector of each sample node; predict the type confidence of each sample node according to the first type feature vector of each sample node; determine the third loss value according to the type label of each sample node and the type confidence of each sample node;

[0259] Training the asset sequence classification model according to the second loss value includes:

[0260] Determine the sum of the second loss value and the third loss value, update the sum to the second loss value, and train the asset sequence classification model according to the updated second loss value.

[0261] Further, the processor 1201 is further configured to predict the type confidence of each sample node according to the first type feature vector of each sample node, including:

[0262] For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain a second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted according to the updated first type feature vector of the sample node.

[0263] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 702 is used for communication between the above electronic device and other devices. The memory may include a random access memory (RAM) and may also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0264] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0265] Embodiment 13:

[0266] Based on the same application concept, the embodiment of the present application provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program is executed on the processor, the processor executes any of the enterprise IP asset identification methods discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to the enterprise IP asset identification method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0267] Based on the same application concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the enterprise IP asset identification methods discussed above. Since the principle of solving the problem by the above computer program product is similar to the enterprise IP asset identification method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0268] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, MO (magneto-optical disks), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, NAND FLASH (non-volatile memory), SSD (solid state drive), etc.

[0269] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0270] The computer program for performing the operation of the present disclosure may be an assembly instruction, an instruction set architecture (ISA) instruction, a machine instruction, a machine-related instruction, a microcode, a firmware instruction, a state setting data, or a source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0271] The computer program product described herein may be implemented in hardware, software, or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK), etc.

[0272] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0273] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0274] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0275] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0276] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying enterprise IP assets, characterized in that: The method comprises: Obtain target identification information of the target enterprise to be identified; determine the target domain name corresponding to the target identification information according to the corresponding relationship between each enterprise identification information and the first domain name in the Internet content ICP database record; According to each search path in the pre-constructed graph, determine a target search path with the target domain name as the source node and the IP as the terminal node; wherein the graph is constructed based on the website data and the PDNS data; Determine the target feature vector of each target node in the target search path according to the first feature vector of each node saved in advance; input the target feature vector of each target node into the pre-trained asset sequence classification model, and determine whether the IP and the target domain name belong to the same enterprise asset based on the asset sequence classification model; The process of pre-saving the first eigenvector of each node includes: Determining an initial feature vector of each node in the graph; For each search path in the graph, determine each sub-search path of the search path according to a preset sliding window; For each of the sub-search paths, the initial feature vectors of the nodes in the sub-search path except the central node are added to obtain a second feature vector; the second feature vector is input into a vector prediction model, and a predicted feature vector is determined based on the vector prediction model; a first loss value is determined according to the predicted feature vector and the initial feature vector of the central node; according to the first loss value and a model parameter update algorithm, the model parameters of the vector prediction model and the initial feature vectors of the nodes except the central node are updated to obtain the first feature vectors of the nodes except the central node.

2. The method according to claim 1, characterized in that The process of pre-building the graph includes: Determine the website data and PDNS data of each enterprise according to the enterprise identification information and the first domain name corresponding to each enterprise recorded in the ICP database, as well as the network database and the domain name system DNS database; Using the website data and PDNS data of each enterprise as nodes, a graph structure is constructed; According to the pre-saved search relationship between the nodes in the graph structure, each search path from the source node to the terminal node in the graph structure is determined, and a graph is constructed according to each search path.

3. The method according to claim 2, characterized in that Using the website data and PDNS data of each enterprise as nodes, the graph structure includes: For each enterprise, the website data and PDNS data of the enterprise are used as nodes, and a subgraph structure of the enterprise is constructed according to a preset connection rule; For the subgraph structure of each enterprise, a node of a domain name or an IP address in the subgraph structure is used as a first node to be connected; The different subgraph structures are connected according to the same first node to be connected to construct the graph structure.

4. The method according to claim 3, characterized in that The PDNS data includes: a second domain name, at least one third domain name corresponding to the second domain name, and a first IP corresponding to each of the second domain name and the at least one third domain name; the website data includes: a uniform resource locator URL, a fourth domain name, a certificate cert, and a second IP; According to the preset connection rules, constructing the subgraph structure of the enterprise includes: The second domain name is connected to the at least one third domain name; the second domain name and the at least one third domain name are respectively connected to the corresponding first IP; the uniform resource locator URL is respectively connected to the fourth domain name, the certificate cert, and the second IP; The data of the domain name or IP type in the PDNS data and the website data are used as the second nodes to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

5. The method according to claim 1, characterized in that The process of pre-training the asset sequence classification model includes: Determine a sample search path according to each search path in the pre-constructed graph; determine a first feature vector of each sample node in the sample search path according to the first feature vector of each node saved in advance; The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained, and the enterprise affiliation confidence of the sample search path is predicted based on the asset sequence classification model; a second loss value is determined according to the enterprise affiliation label and the enterprise affiliation confidence; and the asset sequence classification model is trained according to the second loss value.

6. The method according to claim 5, characterized in that Predicting the enterprise affiliation confidence of the sample search path based on the asset sequence classification model includes: Based on the asset sequence classification model, the first feature vectors of each sample node are average-pooled to obtain a third feature vector; and the enterprise affiliation confidence of the sample search path is predicted based on the third feature vector.

7. The method according to claim 5, characterized in that Before training the asset sequence classification model according to the second loss value, the method further includes: Input the type label of each sample node into the asset sequence classification model to be trained, perform feature extraction on the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model, and obtain the first type feature vector of each sample node; predict the type confidence of each sample node according to the first type feature vector of each sample node; determine the third loss value according to the type label of each sample node and the type confidence of each sample node; Training the asset sequence classification model according to the second loss value includes: Determine the sum of the second loss value and the third loss value, update the sum to the second loss value, and train the asset sequence classification model according to the updated second loss value.

8. The method according to claim 7, characterized in that Predicting the type confidence of each sample node according to the first type feature vector of each sample node includes: For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain a second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted according to the updated first type feature vector of the sample node.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 8 when executing a program stored in a memory.

Images