Network asset identification method, device and computer program product

Abstract

The present application discloses a network asset identification method, device and computer program product, which relates to the field of network asset management technology. The method includes: sending an identification detection package to a target network asset and performing multiple jump operations in combination with dynamically extracted attributes to gradually build a complete target network asset attribute data set; extracting page information from the target network asset attribute data set; inputting the page information into a pre-built fingerprint information library for preliminary comparison to obtain a preliminary comparison result of the target network asset; based on the preliminary comparison result of the target network asset, using a pre-built background image detection processing model and a REST interface query detection processing model to identify and process the page information to obtain a network asset identification result. Based on the preliminary comparison result, two different processing models are combined to improve the accuracy of network asset identification.

Description

Technical Field

[0001] The present application relates to the technical field of network asset management, and in particular to a network asset identification method, device and computer program product. Background Art

[0002] When OEM products are used as network devices, the lack of obvious brand identification makes it difficult to identify OEM products in the network, which brings many problems such as network management and security monitoring. Therefore, it is necessary to accurately identify OEM products to avoid network management and network security problems. Fingerprint recognition technology can use the unique characteristics and behaviors of OEM to identify OEM products, but fingerprint recognition technology mainly relies on the static characteristics of OEM products and the integrity of the fingerprint information library. When OEM products dynamically change page elements or the fingerprint information library is incomplete, traditional fingerprint recognition technology cannot capture these changes in time, resulting in recognition errors or missed recognition; in addition, network traffic analysis is another way to identify OEM devices, and its recognition results are affected by multiple factors such as network environment, device configuration, and traffic load, which may lead to a decrease in the accuracy of the recognition results.

[0003] Therefore, how to accurately identify the network assets when the OEM products are used as network assets becomes an urgent problem to be solved in this application.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a network asset identification method, device and computer program product, aiming to solve the technical problem of how to accurately identify the network asset when the original equipment manufacturer's product is used as a network asset.

[0006] To achieve the above objectives, the present application proposes a network asset identification method, the method comprising:

[0007] Send identification detection packets to the target network assets and perform multiple jump operations in combination with dynamically extracted attributes to gradually build a complete target network asset attribute data set;

[0008] Extracting page information from the target network asset attribute data set;

[0009] Input the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset;

[0010] Based on the preliminary comparison result of the target network asset, the page information is identified and processed using a pre-built background image detection processing model and a REST interface query detection processing model to obtain a network asset identification result.

[0011] In one embodiment, before the step of inputting the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset, the step further includes:

[0012] Use deep learning technology to extract known fingerprint feature information from sample network assets in multiple dimensions, and classify and integrate the known fingerprint feature information to obtain an initial fingerprint information library;

[0013] Periodically running an automatic update mechanism in the initial fingerprint information database to capture unknown fingerprint feature information;

[0014] The unknown fingerprint feature information is added to the initial fingerprint information library to obtain a fingerprint information library.

[0015] In one embodiment, the step of using a pre-built background image detection processing model and a REST interface query detection processing model to identify the page information based on the preliminary comparison result of the target network asset, and obtaining the network asset identification result also includes:

[0016] Collecting element data of the sample network asset, and analyzing the element data to determine a page element change method, wherein the page element change method includes a page background image replacement method and a REST interface data query method;

[0017] Constructing a background image detection processing model based on the page background image replacement method;

[0018] A REST interface query detection processing model is constructed based on the REST interface data query method.

[0019] In one embodiment, the step of inputting the page information into a pre-built fingerprint information library for preliminary comparison to obtain a preliminary comparison result of the target network asset includes:

[0020] Preprocessing the page information to extract comparison features, and generating comparison fingerprints based on the comparison features;

[0021] A device fingerprint matching index is created in the fingerprint information library, and a multimodal fusion comparison is performed on the comparison fingerprint through the device fingerprint matching index to obtain a preliminary comparison result of the target network asset.

[0022] In one embodiment, the step of performing identification processing on the page information based on the preliminary comparison result of the target network asset using a pre-built background image detection processing model and a REST interface query detection processing model to obtain the network asset identification result includes:

[0023] When the target network asset preliminary comparison result is a complete match, the target network asset preliminary comparison result is used as the final network asset identification result;

[0024] When the preliminary comparison result of the target network asset is not a complete match, the pre-built background image detection processing model and the REST interface query detection processing model are used to perform identification processing on the page information to obtain a network asset identification result.

[0025] In one embodiment, the page information includes background image information and page element information, and the step of using a pre-built background image detection processing model and a REST interface query detection processing model to identify the page information to obtain a network asset identification result includes:

[0026] Determining a page element change mode of the target web asset based on the page information;

[0027] When the page element change mode of the target network asset is to change the page background image, a background image detection processing model is selected to process the background image information to obtain a network asset identification result;

[0028] When the page element modification mode of the target network asset is REST interface data query, a REST interface query detection processing model is selected to process the page element information to obtain a network asset identification result.

[0029] In one embodiment, the step of selecting a background image detection processing model to process the background image information to obtain a network asset identification result includes:

[0030] Performing a hash operation on the background image information through a background image detection processing model to obtain a background image hash value;

[0031] The hash value of the background image is compared with a pre-built hash value fingerprint library to obtain a network asset identification result.

[0032] In one embodiment, the step of selecting a REST interface query detection processing model to process the page element information to obtain a network asset identification result includes:

[0033] Using the REST interface to query the detection processing model to verify the page element information, and obtain the page element verification result;

[0034] When the page element verification result is inconsistent with the preset verification result, the page element verification result is transformed to extract the page element change content;

[0035] The manufacturer information in the changed content of the page element is queried to obtain a network asset identification result.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a network asset identification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network asset identification method described above.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the network asset identification device method described above are implemented.

[0038] One or more technical solutions proposed in this application have at least the following technical effects:

[0039] Send identification detection packets to the target network assets and perform multiple jump operations in combination with dynamic attribute extraction, gradually build a complete target network asset attribute data set to ensure that the target network asset attribute data can be obtained as comprehensively and detailed as possible, providing a rich data foundation for subsequent extraction and accurate comparison; input the page information into the pre-built fingerprint information library for preliminary comparison to obtain the preliminary comparison results of the target network assets. The preliminary comparison can quickly screen out the target network assets that match the known devices, or identify assets that obviously do not belong to the known devices, providing a reference for subsequent processing; based on the preliminary comparison results, further use the pre-built background image detection processing model and REST interface query detection processing model to further identify the page information. The background image detection processing model and the REST interface query detection processing model are aimed at the dynamic changes of page elements by different types of OEM manufacturers. On the basis of the preliminary comparison results, combined with the synergy of the background image detection processing model and the REST interface query detection processing model, the precise identification of the dynamic changes of page elements by different types of OEM manufacturers can be achieved, thereby improving the accuracy of target network asset identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0042] Figure 1 This is a flow chart of the first embodiment of the network asset identification method of the present application;

[0043] Figure 2 This is a flow chart of the second embodiment of the network asset identification method of the present application;

[0044] Figure 3 This is a flowchart of the third embodiment of the network asset identification method of the present application;

[0045] Figure 4 A schematic diagram of a process for identifying target network assets using a background image detection processing model;

[0046] Figure 5 A flowchart of using the REST interface to query the detection processing model to identify target network assets;

[0047] Figure 6 This is a schematic diagram of the module structure of the network asset identification device according to an embodiment of the present application;

[0048] Figure 7 Schematic diagram of the device structure of the hardware operating environment involved in the network asset identification method in the embodiment of the present application.

[0049] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] The main solution of the embodiment of the present application is: sending an identification detection package to the target network asset and performing multiple jump operations in combination with dynamically extracted attributes, gradually building a complete target network asset attribute data set; extracting page information from the target network asset attribute data set; inputting the page information into a pre-built fingerprint information library for preliminary comparison to obtain a preliminary comparison result of the target network asset; combining the preliminary comparison result of the target network asset, using the pre-built background image detection processing model and the REST interface query detection processing model to identify and process the page information to obtain a network asset identification result.

[0053] In this embodiment, for ease of description, the following description is made by taking the identification of a network asset identification device as the execution subject.

[0054] The embodiment of the present application takes into account that OEM is widely used due to its low cost and high flexibility. When the original equipment manufacturer (OEM: Original Equipment Manufacturer) product is used as a network device, the lack of obvious brand identification of the OEM product makes the identification of the OEM product in the network complicated, which brings many problems such as network management and security monitoring. Therefore, it is necessary to accurately identify the OEM product to avoid the network security problems caused by the use of OEM products. Fingerprint recognition technology can use the unique characteristics and behaviors of OEM to identify OEM products, but fingerprint recognition technology mainly relies on the static characteristics of OEM products and the integrity of the fingerprint information library. However, when the OEM product dynamically changes the page elements or the fingerprint information library is incomplete, the traditional fingerprint recognition technology cannot capture these changes in time, resulting in recognition errors or missed recognition; in addition, network traffic analysis is another way to identify OEM devices, and its recognition results are affected by multiple factors such as network environment, device configuration, and traffic load, which may lead to a decrease in the accuracy of the recognition results. In addition, OEM products can also be identified by means of device configuration scanning, network management tools, supplier support, and information query, but the above-mentioned identification methods all have certain limitations, and it is difficult to identify in the case of dynamic page element changes, resulting in large errors in the recognition results.

[0055] Therefore, the present application provides a solution, which sends an identification detection package to the target network asset and performs multiple jump operations in combination with dynamic extraction of attributes, gradually constructs a complete target network asset attribute data set to ensure that the target network asset attribute data that is as comprehensive and detailed as possible can be obtained, and provides a rich data foundation for subsequent extraction and accurate comparison; the page information is input into a pre-built fingerprint information library for preliminary comparison to obtain a preliminary comparison result of the target network asset. The preliminary comparison can quickly screen out target network assets that match known devices, or identify assets that obviously do not belong to known devices, providing a reference for subsequent processing; based on the preliminary comparison results, the pre-built background image detection processing model and REST interface query detection processing model are further used to further identify and process the page information. The background image detection processing model and the REST interface query detection processing model are aimed at the ways in which different types of OEM manufacturers dynamically change page elements. On the basis of the preliminary comparison results, the synergy of the background image detection processing model and the REST interface query detection processing model is combined to achieve accurate identification of the ways in which different types of OEM manufacturers dynamically change page elements, thereby improving the accuracy of target network asset identification.

[0056] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a network asset identification device, etc. The following takes the network asset identification device as an example to illustrate this embodiment and the following embodiments.

[0057] Based on this, the present application embodiment provides a network asset identification method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the network asset identification method of the present application.

[0058] In this embodiment, the network asset identification method includes steps S10 to S40:

[0059] Step S10, sending an identification detection packet to the target network asset and performing multiple jump operations in combination with dynamically extracted attributes, gradually building a complete target network asset attribute data set;

[0060] An identification probe packet is a specially designed data packet used to trigger a response from a target network asset. An identification probe packet usually contains a specific request header, request parameters, and request body to simulate the behavior of a user or client to trigger the target network asset to return specific page information. Page information includes but is not limited to page elements, background images, and data queried through the REST API.

[0061] Sending an identification probe packet is the first step in the asset identification process, which aims to collect preliminary information about the target network asset. Since the attribute data of the target network asset is often not directly accessible, multiple jump operations are required in combination with dynamically extracted attributes. Dynamically extracted attributes refer to extracting key information that can be used for further identification by analyzing the response of the target network asset during the identification process.

[0062] The multiple jump operations are based on the dynamically extracted attributes, gradually deepening into different levels of the target network assets to collect more comprehensive attribute data. During the multiple jump operations, a portion of the attribute data of the target network assets will be collected each time. By gradually integrating these attribute data, a complete target network asset attribute data set is finally constructed. This data set contains various attribute information of the target network assets, such as model, firmware version, etc.

[0063] Alternatively, a dynamic analysis engine can be built to monitor and analyze the response of the target network asset in real time to dynamically extract attributes and trigger jump operations. Alternatively, an attribute data set management system can be developed to store and manage the collected target network asset attribute data for subsequent analysis and comparison.

[0064] Step S20, extracting page information from the target network asset attribute data set;

[0065] By sending identification detection packets and performing multiple jump operations, preliminary attribute data of the target network assets has been gradually constructed. This data may include network traffic information, device configuration information, page element information, etc. In the integrated data set, information related to the target network asset page is filtered out. This may include the HTML code, CSS style, JavaScript scripts, image resources, etc. of the page.

[0066] Extraction refers to the use of various algorithms and techniques to extract page information including background image information and page element information from the integrated target network asset attribute data set based on the application of feature selection algorithms. Feature selection algorithms are used to screen out the features most relevant to the target network asset page information in order to conduct subsequent analysis and identification more accurately.

[0067] Specifically, the algorithms that can be used in the extraction process include using convolutional neural networks to extract background image information from the target network asset attribute dataset; combining natural language processing algorithms and association rule learning algorithms to extract page elements from the target network asset attribute dataset; using regular expressions (Regex) to extract specific patterns in the code, such as links, image URLs, etc.; XPATH and CSS selectors: locate and extract specific page information in the target network asset attribute dataset.

[0068] Step S30, inputting the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset;

[0069] The fingerprint information library is a pre-built database that contains the unique characteristics and behavior information of various network devices, such as the device's MAC address, serial number, firmware version, manufacturer-specific information, etc. The fingerprint information stored in the fingerprint information library is used to compare with the page information obtained by the target from the target network asset to preliminarily identify the OEM information of the network device.

[0070] The page information is input into the pre-built fingerprint information library for preliminary comparison. In the fingerprint information library, the network asset identification device will compare the input page information with the stored fingerprint information one by one. The comparison process involves multi-dimensional analysis and matching of information, including but not limited to communication protocols, behavioral characteristics, firmware versions and other aspects. This process aims to find fingerprint information that is highly consistent or completely consistent with the input page information.

[0071] There are two possible results for the preliminary comparison of network assets: one is a complete match, that is, the page information completely matches a record in the fingerprint information database, which means that the identity information of the target network asset has been successfully identified; the other is an incomplete match, that is, the input page information does not completely match any record in the fingerprint information database, which means that the identity information of the target network asset cannot be directly confirmed through the fingerprint information database. In this case, more complex identification methods are required, that is, using the pre-built background image detection processing model and REST interface query detection processing model to further analyze and identify the page information.

[0072] Step S40: Based on the preliminary comparison result of the target network asset, the page information is identified and processed using the pre-built background image detection processing model and the REST interface query detection processing model to obtain a network asset identification result.

[0073] Based on the preliminary comparison results of the target network assets, the pre-built background image detection processing model and REST interface query detection processing model are used to identify and process the page information to obtain more accurate network asset identification results. Among them, for OEM manufacturers who may dynamically change the identification information by changing the page background image, the background image detection processing model is used for processing; for OEM manufacturers who may dynamically change page elements through REST API queries, the REST interface query detection processing model is used for processing.

[0074] Since the pre-built background image detection processing model and REST interface query detection processing model are used to process different types of network assets, to identify the target network assets, it is first necessary to determine the way in which the OEM manufacturer changes the page elements through the page information of the target network assets, and then choose whether to use the background image detection processing model or the REST interface query detection processing model according to the way the page elements are changed. The results obtained by the background image detection processing model or the REST interface query detection processing model are used as the final network asset identification results.

[0075] This embodiment provides a network asset identification method, which sends an identification detection packet to the target network asset and performs multiple jump operations in combination with dynamic attribute extraction, gradually constructs a complete target network asset attribute data set to ensure that the target network asset attribute data can be obtained as comprehensively and detailed as possible, and provides a rich data basis for subsequent extraction and accurate comparison; inputs the page information into a pre-constructed fingerprint information library for preliminary comparison, and obtains a preliminary comparison result of the target network asset. The preliminary comparison can quickly screen out the target network assets that match the known devices, or identify assets that obviously do not belong to the known devices, and provide a reference for subsequent processing; based on the preliminary comparison results, the pre-constructed background image detection processing model and REST interface query detection processing model are further used to further identify the page information. The background image detection processing model and the REST interface query detection processing model are aimed at the dynamic change of page elements by different types of OEM manufacturers. On the basis of the preliminary comparison results, the synergy of the background image detection processing model and the REST interface query detection processing model is combined to achieve accurate identification of the dynamic change of page elements by different types of OEM manufacturers, thereby improving the accuracy of target network asset identification.

[0076] Based on the first embodiment of the present application, the second embodiment of the present application is proposed. In the second embodiment of the present application, the same or similar contents as those of the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following.

[0077] On this basis, please refer to Figure 2 Before step S30, the network asset identification method further includes steps S121 to S123:

[0078] Step S121, using deep learning technology to extract known fingerprint feature information from sample network assets in multiple dimensions, and classifying and integrating the known fingerprint feature information to obtain an initial fingerprint information library;

[0079] The core idea of ​​deep learning technology is to learn and extract features from a large amount of data by building and training deep neural network models to achieve automated processing and decision-making of complex tasks. When building the initial fingerprint information library, deep learning technology extracts multi-dimensional features of sample network assets and classifies and integrates the extracted features to form an initial fingerprint library containing known fingerprint feature information. Make full use of the automatic feature extraction and classification capabilities of deep learning technology to improve the accuracy and completeness of the initial fingerprint information library.

[0080] Collect a certain number of network assets as samples, and use deep learning technology to extract multi-dimensional fingerprint feature information from the collected sample network assets. The fingerprint feature information is extracted from multiple dimensions such as network traffic, protocol behavior, system configuration, and software version of the sample network assets. The application of deep learning technology can automatically learn and extract these features without manual definition, improving the accuracy and efficiency of feature extraction.

[0081] The extracted fingerprint feature information is very large and disorganized, so it is necessary to classify and integrate the extracted fingerprint feature information to form a structured initial fingerprint information library. The initial fingerprint information library has an index structure of different OEM products and corresponding manufacturer information.

[0082] Step S122, periodically running an automatic update mechanism in the initial fingerprint information database to capture unknown fingerprint feature information;

[0083] In order to ensure the accuracy and timeliness of the fingerprint information library, an automatic update mechanism is designed in the initial fingerprint library. This automatic update mechanism can regularly scan new assets or new changes in existing assets in the network and try to extract their fingerprint feature information.

[0084] During the scanning process, if the fingerprint feature information of some assets does not match the known information in the initial fingerprint information library, these features are considered unknown fingerprint feature information. These unknown information represent new network asset types, new software versions or configuration changes, etc.

[0085] Step S123, adding the unknown fingerprint feature information to the initial fingerprint information database to obtain a fingerprint information database.

[0086] On the basis of ensuring that the newly added information does not conflict with the existing information and can correctly represent new network assets or changes in the library, the captured unknown fingerprint feature information will be verified and sorted, and then added to the initial fingerprint information library to form a fingerprint information library. By continuously adding new unknown fingerprint feature information, the fingerprint information library will gradually become more complete and comprehensive, and can more accurately identify and analyze different assets in the network.

[0087] In this embodiment, multi-dimensional known fingerprint feature information is extracted from sample network assets through deep learning technology, and the extracted known fingerprint feature information is classified and integrated to form a structured initial fingerprint information library. The captured unknown fingerprint feature information is added to the initial fingerprint library to form a complete fingerprint information library containing known and unknown fingerprint features. The complete fingerprint information library can improve the precision and accuracy of network asset identification in the subsequent preliminary comparison process.

[0088] Based on the first embodiment and / or the second embodiment of the present application, the third embodiment of the present application is proposed. In the third embodiment of the present application, the same or similar contents as those of the above-mentioned embodiment 1 and / or embodiment 2 can be referred to the above introduction, and will not be repeated in the following.

[0089] On this basis, please refer to Figure 3 Before step S40, the network asset identification method further includes steps S231 to S233:

[0090] Step S231, collecting element data of the sample network asset, and analyzing the element data to determine a page element change method, wherein the page element change method includes a page background image replacement method and a REST interface data query method;

[0091] Element data refers to the sample network asset response data recorded by actively accessing the Web management interface of the sample network asset using a web crawler or automated testing tool, capturing the HTML, CSS, JavaScript and other files of the page, as well as images, scripts and other resources embedded in the page, including dynamic changes in page elements.

[0092] Analysis of element data includes static analysis and dynamic analysis. Static analysis refers to checking the code structure of files such as HTML and CSS to find potential page element replacement points (such as changes in image URLs); dynamic analysis refers to using browser debugging tools (such as Chrome DevTools) or automated testing frameworks (such as Selenium) to observe changes in page elements during the interaction process.

[0093] Combining the results of static analysis and dynamic analysis, we compare the MD5 value or file name of the image resource to determine whether the page background image has been replaced with a new image; we analyze the network request in the JavaScript code to check whether the page obtains data from the REST API through AJAX requests. After the above analysis process, we determined that there are basically two ways for network assets to change page elements: one is the page background image replacement method, and the other is the REST interface data query method.

[0094] Step S232, constructing a background image detection processing model based on the page background image replacement method;

[0095] In view of the page background image replacement method, a model that can detect and identify the new background image is constructed, namely the background image detection and processing model. The background image detection and processing model mainly includes the MD5 fingerprint library for WD5 value comparison.

[0096] Specifically, in a feasible implementation manner, the process of constructing the background image detection processing model may include:

[0097] First, we collect various possible page background images from sample web assets as training samples to ensure the generalization ability of the model. We analyze the collected samples to determine the main features of the page background images, such as color distribution, texture, shape, etc. This process helps us understand how the background images are used to identify devices and find out which features are key to recognition.

[0098] Furthermore, image processing techniques (such as edge detection, corner detection, texture analysis, etc.) are used to extract local (such as corners, edges) or global (such as color histogram, texture features) features from the background image. After extracting a large number of features, the features are selected to remove redundant and irrelevant features to improve the efficiency and accuracy of the model.

[0099] Furthermore, based on the type of features extracted and the size of the dataset, select an appropriate machine learning algorithm (such as support vector machine, decision tree, neural network, etc.) to build a classifier. Use the extracted features and the corresponding OEM manufacturer labels to train the classifier. During the training process, the algorithm learns how to map the input features to the correct OEM manufacturer category.

[0100] Finally, use cross-validation techniques (such as K-fold cross-validation) to evaluate the performance of the model and adjust the parameters to improve accuracy. Tune the model's hyperparameters (such as learning rate, number of iterations, regularization parameters, etc.) to further improve performance. Consider using model ensemble techniques (such as voting, bagging, boosting, etc.) to improve the stability and accuracy of the model.

[0101] It should be noted that the above steps are only a general framework, and the specific implementation details may vary depending on the application scenario and technical requirements. In actual operation, factors such as data privacy, security, and computing resources need to be considered.

[0102] Step S233: construct a REST interface query detection processing model based on the REST interface data query method.

[0103] The REST interface query detection processing model is mainly used to process OEM products whose page elements are changed based on the REST interface data query method. Specifically, in a feasible implementation, the steps of constructing the REST interface query detection processing model based on the REST interface data query method may include:

[0104] First, collect the REST API documents provided by the target OEM to understand the functions, parameters, and return values ​​of the interface. Obtain some sample data through the API to understand the structure of the data and possible dynamic changes.

[0105] Furthermore, based on the inspection of specific fields or data structures, a verification mechanism and information extraction mechanism are designed to verify the returned page element information and determine whether it is inconsistent with expectations, so as to determine whether the OEM manufacturer's information has been changed and extract the latest information.

[0106] Furthermore, error handling logic is added to deal with situations where the API call fails or the returned data format is incorrect. According to the actual application scenario, the performance of the REST interface query detection processing model is optimized, such as reducing the number of API calls and optimizing the data processing algorithm.

[0107] In this embodiment, different processing models are proposed for different ways of changing page elements of OEM products, wherein a background image detection processing model is constructed for the way of changing the page elements of network assets by replacing the page background image, and a REST interface query detection processing model is constructed for the way of changing the page elements of network assets by querying the REST interface data. By constructing processing models for different ways of changing page elements, it is possible to more flexibly adapt to changes in network device identification information of different OEM manufacturers. These two models can significantly improve the accuracy of network asset identification through precise matching and real-time monitoring, thereby providing a solid foundation for network operation and security management.

[0108] Based on the above-mentioned embodiments of the present application, a fourth embodiment of the present application is proposed. In the fourth embodiment of the present application, the same or similar contents as those of the above-mentioned embodiments can be referred to the above introduction and will not be repeated later.

[0109] In this embodiment, based on the preliminary comparison result of the target network asset, the page information is identified and processed using the pre-built background image detection processing model and the REST interface query detection processing model, and the step S40 of obtaining the network asset identification result may include steps S401-S402:

[0110] Step S401, when the preliminary comparison result of the target network asset is a complete match, the preliminary comparison result of the target network asset is used as the final network asset identification result;

[0111] When the preliminary comparison result of the target network asset is a complete match, it means that the OEM (original equipment manufacturer) information or type of the network asset has been determined through preliminary comparison with the fingerprint information database, and this information is completely consistent with the records in the known information database.

[0112] Specifically, the step of inputting the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset includes:

[0113] First, the page information is preprocessed to extract comparison features, and a comparison fingerprint is generated based on the comparison features;

[0114] Page information preprocessing mainly extracts key information from the page information of network devices, such as the device's MAC address, serial number, firmware version, and specific information provided by the manufacturer. This information usually reflects the unique characteristics and identity of the device. Preprocessing includes removing noise, standardizing formats, parsing structured data, etc. to ensure the accuracy and efficiency of subsequent steps.

[0115] Extract the comparison features for comparison from the preprocessed page information. The comparison features are usually determined based on the hardware and software characteristics of the target network asset that can reflect the essential attributes of the device and the manufacturer information. The comparison fingerprint is a unique identifier generated based on the extracted features and is used for comparison between network devices. In this application, the comparison fingerprint can be generated by a hash function or an encryption algorithm.

[0116] Secondly, a device fingerprint matching index is created in the fingerprint information library, and a multi-modal fusion comparison is performed on the comparison fingerprint through the device fingerprint matching index to obtain a preliminary comparison result of the target network asset.

[0117] Multimodal fusion comparison refers to comparing the comparison fingerprint of the target device with multiple fingerprints in the fingerprint information library to determine whether there is a complete match. The preliminary comparison result of the target network asset is a Boolean value used to indicate the matching status between the target device and the known device.

[0118] When the preliminary comparison result of the target network asset is a complete match, there is no need to perform more complex identification processing. The preliminary comparison result of the target network asset is used as the final network asset identification result, which improves the identification efficiency.

[0119] Step S402, when the preliminary comparison result of the target network asset is not a complete match, the pre-built background image detection processing model and REST interface query detection processing model are used to perform identification processing on the page information to obtain a network asset identification result.

[0120] When the preliminary comparison result of the target network asset is an incomplete match, it means that the OEM information or type of the network asset cannot be accurately determined through preliminary identification means, and more complex identification means are needed for further confirmation.

[0121] Specifically, in a feasible implementation manner, step S402 may include steps S1 to S3:

[0122] Step S1, determining a page element modification mode of the target network asset based on the page information;

[0123] Perform detailed analysis of page information, with special attention paid to elements used to identify device OEMs, such as page background images, specific text in the page, data dynamically loaded through the REST API, etc. Compare the MD5 values ​​or file names of image resources to determine whether the page background image has been replaced with a new image; and analyze network requests in JavaScript code to check whether the page obtains data from the REST API through AJAX requests, thereby determining how the page elements of the target network assets have been changed.

[0124] It should be noted that page information specifically includes background image information and page element information. Background image is an important element in the design of web pages or network interfaces. It not only beautifies the interface, but also contains specific information or logos. Page elements refer to the interactive or displayable parts such as text, images, links, buttons, etc. in a web page or network interface.

[0125] Step S2, when the page element change mode of the target network asset is the page background image change, selecting a background image detection processing model to process the background image information to obtain a network asset recognition result;

[0126] When the page element change mode of the target network asset is to change the page background image, the background image detection processing model is selected to process the background image information. The specific processing process includes steps A21 and A22:

[0127] Step A21, performing a hash operation on the background image information through a background image detection processing model to obtain a background image hash value;

[0128] Hash operation refers to the MD5 operation of the background image information. MD5 operation, namely Message Digest Algorithm 5 (Message Digest Algorithm Version 5), is a widely used hash function. An input of any length (such as a string or file content) is converted into a 128-bit (16-byte) hash value through a series of complex operations, usually expressed as a 32-bit hexadecimal string. This hash value is irreversible, that is, the original data cannot be deduced from the hash value. MD5 operation is widely used in data integrity verification, password storage and other fields.

[0129] The background image information is passed as input to the MD5 hash function. The MD5 function performs a series of complex mathematical operations, including padding, initializing the MD buffer, processing message groups (each 512 bits), compression function iteration, and final output, and finally generates a 128-bit hash value. For ease of storage and comparison, this 128-bit hash value is usually converted to a 32-bit hexadecimal string representation.

[0130] After the MD5 hash operation, a unique background image hash value is obtained, which represents the specific "fingerprint" of the background image content of the target network asset.

[0131] Step A22, comparing the hash value of the background image in a pre-built hash value fingerprint library to obtain a network asset identification result.

[0132] The pre-built hash value fingerprint library refers to a database configured in the background image detection processing model that contains a large number of known network asset background image hash values. These hash values ​​are generated by the same MD5 hash function in the previous process and are associated with the corresponding network assets (such as OEM manufacturers' devices). The MD5 hash value fingerprint library supports two generation methods, one is to add through known fingerprints, and the other is to add fingerprints identified by other identification methods.

[0133] Since hash values ​​are usually fixed-length strings that can be easily and quickly matched, the comparison process of comparing the target network asset's background image hash value with the hash values ​​in the hash value fingerprint library is very efficient. If an entry matching the target background image hash value is found in the hash value fingerprint library, then it can be determined that the OEM manufacturer of the target network asset is the manufacturer associated with the entry.

[0134] Step S3: When the page element modification mode of the target network asset is REST interface data query, a REST interface query detection processing model is selected to process the page element information to obtain a network asset identification result.

[0135] When the page element change mode of the target network asset is REST interface data query, the REST interface query detection processing model is selected to process the page element information. The specific processing process includes steps A31 to A33:

[0136] Step A31, using the REST interface to query the detection processing model to verify the page element information and obtain the page element verification result;

[0137] REST (Representational State Transfer) is a design style and development method for network applications. It is based on the HTTP protocol and can transmit data in XML or JSON format. The REST interface allows clients (such as browsers or applications) to interact with servers to obtain or submit data. Page element information refers to the data of all visible and invisible elements on a web page, including text, images, links, forms, etc.

[0138] The page element information is input into the REST interface query detection processing model, and the REST interface query detection processing model evaluates the information according to preset rules and outputs the verification result.

[0139] Step A32, when the page element verification result is inconsistent with the preset verification result, transforming the page element verification result to extract the page element change content;

[0140] The preset verification result is the expected result set in advance according to business requirements or security standards, which is used to compare with the actual page element verification result. If the actual verification result is different from the preset result, it means that the page element may have changed, or there is a situation that does not meet expectations.

[0141] In order to find out the specific changes, the verification results need to be further processed or converted. By performing operations including comparing differences, parsing logs, and code analysis on the page element verification results, the changes in the page elements can be extracted.

[0142] Step A33, querying the manufacturer information in the page element change content to obtain the network asset identification result.

[0143] Manufacturer information refers to information that may be contained in a page element and can indicate its source or manufacturer, such as trademarks, copyright notices, specific code snippets, etc. Based on the manufacturer information queried in the changed content of the page element, the provider, developer or maintainer of the web page or web page element is inferred, thereby obtaining the network asset identification result.

[0144] In this embodiment, the background image detection processing model is mainly aimed at OEM products that change their logos by changing the background image, while the REST interface query detection processing model focuses on OEM products that dynamically update page elements through API queries. The two models complement each other, covering a wider range of OEM product dynamic change methods, significantly improving the accuracy of network asset identification, and the high-precision identification rate significantly enhances the system adaptability and robustness of application network assets, thereby providing a basis for network operation and maintenance and security management.

[0145] The following combination Figure 4 , Figure 5 The process of identifying target network assets by using a background image detection processing model and a REST interface query detection processing model provided by the network asset identification method of the present application is described in detail.

[0146] like Figure 4 As shown, Figure 4 A flowchart for identifying target network assets using a background image detection processing model.

[0147] First, the background image detection processing model actively sends a detection packet to request information.

[0148] The background image detection processing model actively sends a detection packet to the target device. This detection packet contains a series of requests to obtain the page information returned by the target device, especially the image information.

[0149] Furthermore, obtain the information of all images on the page and calculate the MD5 value;

[0150] After receiving the page information returned by the target device, the background image detection processing model parses the information, extracts all the images on the page, performs MD5 hash calculation on the images on the page, and generates the MD5 value of each image. The MD5 value is a unique identifier used to ensure the uniqueness and accuracy of the image.

[0151] Finally, fingerprint comparison is performed in the pre-generated MD5 fingerprint library to output the manufacturer information.

[0152] After obtaining the MD5 value of each image, the background image detection processing model compares it with the pre-generated MD5 fingerprint library, which is a database containing the MD5 values ​​of page images of known OEM manufacturers. Through the comparison, the background image detection processing model can find the manufacturer information that matches the MD5 value of the page image. Once a match is found, the background image detection processing model will output the corresponding manufacturer information, thereby achieving accurate identification of the device.

[0153] like Figure 5 As shown, Figure 5A flowchart for identifying target network assets using the REST interface to query the detection processing model.

[0154] First, the detection processing model is queried through the REST interface to actively send detection packets, obtain page element information, and check whether the page element information is inconsistent with expectations.

[0155] The REST API query detection processing model first requests the page element information of the network device by actively sending a detection packet. The page element information usually includes the device configuration, status, and dynamic content that may contain the manufacturer's logo.

[0156] After obtaining the page element information, the REST API query detection processing model will compare this information with the expected page element information. Since OEMs may dynamically change page elements to hide their identities, the REST API query detection processing model needs to be able to detect these changes. If the page element information is inconsistent with the expected, it means that the network asset may have been updated or changed, and further analysis is required.

[0157] Furthermore, when the page element information is inconsistent with expectations, corresponding changed data is extracted from the verification result.

[0158] When the page element information is inconsistent with expectations, the REST API query detection processing model extracts the corresponding changed data. This data may include new page elements, updated configuration information, or any changes that may include manufacturer identification.

[0159] Finally, check whether there is manufacturer information in the corresponding changed data. If there is manufacturer information, output the manufacturer information.

[0160] After extracting the changed data, the REST API query detection processing model will try to query whether there is manufacturer information from the data. If the data contains manufacturer information, the REST API query detection processing model can successfully identify the OEM manufacturer of the device. If the REST API query detection processing model successfully identifies the OEM manufacturer of the device, it outputs the manufacturer information.

[0161] This application also provides a network asset identification device, please refer to Figure 6 , the network asset identification device comprises:

[0162] The page information acquisition module 10 is used to send an identification detection packet to the target network asset and perform multiple jump operations in combination with the dynamically extracted attributes, gradually build a complete target network asset attribute data set, and extract page information from the target network asset attribute data set;

[0163] A preliminary comparison module 20 is used to input the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset;

[0164] The network asset identification module 30 is used to identify the page information based on the preliminary comparison result of the target network asset using a pre-built background image detection processing model and a REST interface query detection processing model to obtain a network asset identification result.

[0165] The network asset identification device provided by the present application adopts the network asset identification method in the above embodiment, which can solve the technical problem of network asset identification. Compared with the prior art, the beneficial effects of the network asset identification device provided by the present application are the same as the beneficial effects of the network asset identification method provided by the above embodiment, and other technical features in the network asset identification device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0166] The present application provides a network asset identification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network asset identification method in the above-mentioned embodiment 1.

[0167] Reference below Figure 7 , which shows a schematic diagram of the structure of a network asset identification device suitable for implementing the embodiment of the present application. The network asset identification device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The network asset identification device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0168] like Figure 7As shown, the network asset identification device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM) 1004. In RAM 1004, various programs and data required for the operation of the network asset identification device are also stored. The processing device 1001, ROM 1002, and RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the network asset identification device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a network asset identification device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0169] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0170] The network asset identification device provided by the present application adopts the network asset identification method in the above embodiment, which can solve the technical problem of network asset identification. Compared with the prior art, the beneficial effects of the network asset identification device provided by the present application are the same as the beneficial effects of the network asset identification method provided by the above embodiment, and other technical features in the network asset identification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0171] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0172] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0173] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the network asset identification method in the above-mentioned embodiment.

[0174] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0175] The computer-readable storage medium may be included in the network asset identification device; or may exist independently without being assembled into the network asset identification device.

[0176] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the network asset identification device, the network asset identification device: sends an identification detection packet to the target network asset and performs multiple jump operations in combination with dynamically extracted attributes to gradually build a complete target network asset attribute data set; extracts page information from the target network asset attribute data set; inputs the page information into a pre-built fingerprint information library for preliminary comparison to obtain a preliminary comparison result of the target network asset; based on the preliminary comparison result of the target network asset, uses a pre-built background image detection processing model and a REST interface query detection processing model to identify and process the page information to obtain a network asset identification result.

[0177] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0178] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0179] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0180] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned network asset identification method, and can solve the technical problem of network asset identification. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the network asset identification method provided in the above-mentioned embodiment, and will not be repeated here.

[0181] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned network asset identification method when executed by a processor.

[0182] The computer program product provided by this application can solve the technical problem of network asset identification. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the network asset identification method provided by the above embodiment, which will not be repeated here.

[0183] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A network asset identification method, characterized in that: The method comprises: Send identification detection packets to the target network assets and perform multiple jump operations in combination with dynamically extracted attributes to gradually build a complete target network asset attribute data set; Extracting page information from the target network asset attribute data set; Input the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset; When the target network asset preliminary comparison result is a complete match, the target network asset preliminary comparison result is used as the final network asset identification result; When the preliminary comparison result of the target network asset is not a complete match, determining a page element change mode of the target network asset based on the page information, wherein the page information includes background image information and page element information; When the page element change mode of the target network asset is to change the page background image, a background image detection processing model is selected to process the background image information to obtain a network asset identification result; When the page element modification mode of the target network asset is REST interface data query, a REST interface query detection processing model is selected to process the page element information to obtain a network asset identification result.

2. The method according to claim 1, characterized in that Before the step of inputting the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset, the step further includes: Use deep learning technology to extract known fingerprint feature information from sample network assets in multiple dimensions, and classify and integrate the known fingerprint feature information to obtain an initial fingerprint information library; Periodically running an automatic update mechanism in the initial fingerprint information database to capture unknown fingerprint feature information; The unknown fingerprint feature information is added to the initial fingerprint information library to obtain a fingerprint information library.

3. The method according to claim 2, characterized in that The step of using a pre-built background image detection processing model and a REST interface query detection processing model to identify the page information based on the preliminary comparison result of the target network asset to obtain the network asset identification result also includes: Collecting element data of the sample network asset, and analyzing the element data to determine a page element change method, wherein the page element change method includes a page background image replacement method and a REST interface data query method; Constructing a background image detection processing model based on the page background image replacement method; A REST interface query detection processing model is constructed based on the REST interface data query method.

4. The method according to claim 1, characterized in that The step of inputting the page information into a pre-built fingerprint information database for preliminary comparison to obtain a preliminary comparison result of the target network asset includes: Preprocessing the page information to extract comparison features, and generating comparison fingerprints based on the comparison features; A device fingerprint matching index is created in the fingerprint information library, and a multimodal fusion comparison is performed on the comparison fingerprint through the device fingerprint matching index to obtain a preliminary comparison result of the target network asset.

5. The method according to claim 1, characterized in that The step of selecting a background image detection processing model to process the background image information to obtain a network asset identification result includes: Performing a hash operation on the background image information through a background image detection processing model to obtain a background image hash value; The hash value of the background image is compared with a pre-built hash value fingerprint library to obtain a network asset identification result.

6. The method according to claim 1, characterized in that The step of selecting a REST interface query detection processing model to process the page element information to obtain a network asset identification result includes: Using the REST interface to query the detection processing model to verify the page element information, and obtain the page element verification result; When the page element verification result is inconsistent with the preset verification result, the page element verification result is transformed to extract the page element change content; The manufacturer information in the changed content of the page element is queried to obtain a network asset identification result.

7. A network asset identification device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network asset identification method according to any one of claims 1 to 6.

8. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the network asset identification method according to any one of claims 1 to 6 are implemented.

Images