A network resource identification method, device, electronic device and storage medium

Abstract

The present application relates to the field of network security technology, and in particular to a network resource identification method, device, electronic device and storage medium, which are used to improve the accuracy and efficiency of network resource identification. The method includes: finding a target organization node for characterizing a target organization, an IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-constructed organizational resource graph, and determining the correlation parameter between the target organization node and the IP address node based on the node characteristics of the target organization node, the IP address node and the intermediate node; based on the correlation parameter, determining the association relationship between the IP address corresponding to the IP address node and the target organization. The present application performs multi-path modeling on the organization node and the IP address node, making full use of the multi-path information, and can more accurately judge the relationship between the IP address and the target organization.

Description

Background Art

[0002] With the frequent occurrence of network security issues, security practitioners have gradually realized that the most effective way to protect network security is to minimize the number of Internet Protocol (IP) addresses exposed to the network. Therefore, the identification of an organization's IP resources has become increasingly important. Only by accurately identifying an organization's IP resources can we be targeted in network security protection.

[0003] In related technologies, in order to identify the IP resources of an organization, a part of keywords related to the organization are mainly constructed manually, such as the organization name, domain name, Internet Content Provider (ICP) registration number and other keywords, and then the relevant data of the organization in the network is obtained based on the constructed keywords, and then the obtained data is identified and judged to screen out the IP resources of the organization. Based on the above method, a large amount of repetitive manual work is required, the cost is high and the accuracy cannot be guaranteed.

[0004] In summary, how to improve the accuracy and efficiency of IP resource identification has become a problem that needs to be solved urgently. Summary of the invention

[0005] Embodiments of the present application provide a network resource identification method, device, electronic device and storage medium to improve the accuracy and efficiency of IP resource identification.

[0006] A network resource identification method provided in an embodiment of the present application includes:

[0007] Searching for a target organization node for representing a target organization, an Internet Protocol IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-constructed organization resource graph, wherein the organization resource graph includes a node set corresponding to each candidate organization, and the node set includes: a candidate organization node for representing a corresponding candidate organization, an IP address node associated with the candidate organization, and each intermediate node between the candidate organization node and the IP address node of the candidate organization, wherein the intermediate node is extracted based on the organization data, website data, and domain name data of the candidate organization;

[0008] Determining a correlation parameter between the target organization node and the IP address node based on the node characteristics of each of the target organization node, the IP address node, and the intermediate node, wherein the node characteristics are used to represent the semantics and connection relationship of the corresponding nodes;

[0009] Based on the correlation parameter, an association relationship between the IP address corresponding to the IP address node and the target organization is determined.

[0010] Optionally, the organizational resource map is constructed in the following manner:

[0011] For each candidate organization, extract multiple text data from the organization data and website data of the candidate organization, and perform keyword extraction on the multiple text data to obtain keyword sets for each of the multiple text data;

[0012] Extracting reference data of various preset types from the organization data, website data, and domain name data of the candidate organization;

[0013] Each keyword set and each extracted reference data is respectively used as a node, connected according to a preset hierarchical structure, and the organizational resource map is generated.

[0014] Optionally, extracting keywords from the plurality of text data respectively to obtain keyword sets for the plurality of text data respectively includes:

[0015] For each piece of text data, segment the text data to obtain a segmentation set of the text data;

[0016] For each word segment in the word segment set, determining an importance parameter of the word segment based on the frequency of occurrence of the word segment in the text data and the amount of text data containing the word segment;

[0017] Based on the importance parameters of each segmentation, at least one round of screening is performed on the segmentations in the segmentation set to obtain a keyword set for the text data.

[0018] Optionally, the performing at least one round of screening on the segmented words in the segmented word set based on the importance parameters of each segmented word to obtain the keyword set of the text data includes:

[0019] The following steps were performed in each round of screening:

[0020] Merge the two participles with the smallest corresponding importance parameters in the participle set into a new participle, and use the sum of the importance parameters of the two participles as the importance parameter of the new participle;

[0021] For each segmentation included in the current segmentation set, the segmentation whose corresponding importance parameter is greater than a preset value is taken as a keyword, extracted into the keyword set of the text data, and the extracted segmentation is deleted from the segmentation set.

[0022] Optionally, the method further includes:

[0023] If the sum of the importance parameters of the remaining word segments in the word segmentation set is not greater than the preset value, the screening is stopped and the current keyword set is used as the keyword set of the text data.

[0024] Optionally, determining the correlation parameter between the target organization node and the IP address node based on the node characteristics of each of the target organization node, the IP address node, and the intermediate node includes:

[0025] Fusing the node features of the target organization node with the preset initial features to obtain the output features of the target organization node;

[0026] For each node except the target organization node, the node feature and the input feature of the node are fused to obtain the output feature of the node, the node is the IP address node or the intermediate node, and the input feature is obtained based on the output features of each upper node pointing to the node;

[0027] The output features of the IP address nodes are mapped to obtain the correlation parameters.

[0028] Optionally, determining, based on the correlation parameter, an association relationship between the IP address corresponding to the IP address node and the target organization includes:

[0029] If the correlation parameter is greater than a preset score threshold, it is determined that the IP address corresponding to the IP address node belongs to the target organization.

[0030] An embodiment of the present application provides a network resource identification device, including:

[0031] A search unit, used to search for a target organization node for representing a target organization, an Internet Protocol IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-constructed organization resource map, wherein the organization resource map includes a node set corresponding to each candidate organization, and the node set includes: a candidate organization node for representing a corresponding candidate organization, an IP address node associated with the candidate organization, and each intermediate node between the candidate organization node and the IP address node of the candidate organization, wherein the intermediate node is extracted based on the organization data, website data, and domain name data of the candidate organization;

[0032] A determination unit, configured to determine a correlation parameter between the target organization node and the IP address node based on node features of the target organization node, the IP address node, and the intermediate node, wherein the node features are used to represent the semantics and connection relationship of the corresponding nodes;

[0033] An association unit is used to determine the association relationship between the IP address corresponding to the IP address node and the target organization based on the correlation parameter.

[0034] Optionally, the device further comprises a construction unit, configured to construct the organizational resource map in the following manner:

[0035] For each candidate organization, extract multiple text data from the organization data and website data of the candidate organization, and perform keyword extraction on the multiple text data to obtain keyword sets for each of the multiple text data;

[0036] Extracting reference data of various preset types from the organization data, website data, and domain name data of the candidate organization;

[0037] Each keyword set and each extracted reference data is respectively used as a node, connected according to a preset hierarchical structure, and the organizational resource map is generated.

[0038] Optionally, the construction unit is specifically used for:

[0039] For each piece of text data, segment the text data to obtain a segmentation set of the text data;

[0040] For each word segment in the word segment set, determining an importance parameter of the word segment based on the frequency of occurrence of the word segment in the text data and the amount of text data containing the word segment;

[0041] Based on the importance parameters of each segmentation, at least one round of screening is performed on the segmentations in the segmentation set to obtain a keyword set for the text data.

[0042] Optionally, the construction unit is specifically used for:

[0043] The following steps were performed in each round of screening:

[0044] Merge the two participles with the smallest corresponding importance parameters in the participle set into a new participle, and use the sum of the importance parameters of the two participles as the importance parameter of the new participle;

[0045] For each segmentation included in the current segmentation set, the segmentation whose corresponding importance parameter is greater than a preset value is taken as a keyword, extracted into the keyword set of the text data, and the extracted segmentation is deleted from the segmentation set.

[0046] Optionally, the construction unit is further used for:

[0047] If the sum of the importance parameters of the remaining word segments in the word segmentation set is not greater than the preset value, the screening is stopped and the current keyword set is used as the keyword set of the text data.

[0048] Optionally, the determining unit is specifically configured to:

[0049] Fusing the node features of the target organization node with the preset initial features to obtain the output features of the target organization node;

[0050] For each node except the target organization node, the node feature and the input feature of the node are fused to obtain the output feature of the node, the node is the IP address node or the intermediate node, and the input feature is obtained based on the output features of each upper node pointing to the node;

[0051] The output features of the IP address nodes are mapped to obtain the correlation parameters.

[0052] Optionally, the association unit is specifically used for:

[0053] If the correlation parameter is greater than a preset score threshold, it is determined that the IP address corresponding to the IP address node belongs to the target organization.

[0054] An electronic device provided by an embodiment of the present application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the above-mentioned network resource identification methods.

[0055] An embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program is executed on an electronic device, the computer program is used to enable the electronic device to execute the steps of any one of the above-mentioned network resource identification methods.

[0056] An embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any one of the above-mentioned network resource identification methods.

[0057] The beneficial effects of this application are as follows:

[0058] The embodiment of the present application provides a network resource identification method, device, electronic device and storage medium. Since an organizational resource map is constructed in advance based on the organizational data, website data and domain name data of each candidate organization, the target organization node used to characterize the target organization, the IP address node connected to the target organization node, and the intermediate node on the connection path between the target organization node and the IP address node can be found from the enterprise resource map. Then, based on the node characteristics of the target organization node, the IP address node and the intermediate node, the correlation parameter between the target organization node and the IP address node is determined. Based on the correlation parameter, the association relationship between the IP address corresponding to the IP address node and the target organization is determined. Based on the above method, by performing multi-path modeling between the target organization node and the IP address node, the multi-path information can be fully utilized to determine the relationship between the IP address and the target organization, thereby improving the accuracy and efficiency of IP asset identification.

[0059] Other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0061] Figure 1 An optional schematic diagram of an application scenario in an embodiment of the present application;

[0062] Figure 2 This is a flowchart of an implementation method of a network resource identification method in an embodiment of the present application;

[0063] Figure 3 A schematic diagram of a portion of an organizational resource map in an embodiment of the present application;

[0064] Figure 4 Schematic diagram of the process of obtaining correlation parameters in an embodiment of the present application;

[0065] Figure 5 A schematic diagram of the overall process of a network resource identification method in an embodiment of the present application;

[0066] Figure 6 A schematic diagram of the structure of a network resource identification device in an embodiment of the present application;

[0067] Figure 7A schematic diagram of a hardware structure of an electronic device to which an embodiment of the present application is applied;

[0068] Figure 8 The present invention is a schematic diagram of the hardware structure of another electronic device to which the embodiments of the present application are applied. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0070] The following is a brief introduction to the design concept of this application:

[0071] In the information age, the importance of enterprise IP asset identification is becoming more and more prominent. IP assets in enterprise networks not only involve the network infrastructure, but are also closely related to the enterprise's information security, data protection and business continuity. Effective IP asset identification can help enterprises accurately grasp the distribution and status of their network resources, thereby optimizing network management, improving security protection capabilities and reducing potential risks. Only by accurately identifying the organization's IP resources can we be targeted in network security protection.

[0072] In the related technologies, in order to identify the IP resources of an enterprise, a part of keywords related to the enterprise, such as enterprise name, domain name, ICP registration number, etc., are mainly constructed manually, and then the relevant data of the enterprise in the network is obtained based on the constructed keywords, and then the obtained data is identified and judged to screen out the IP resources of the enterprise. Based on the above method, a large amount of repetitive manual work is required, the cost is high and the accuracy cannot be guaranteed.

[0073] In summary, how to improve the accuracy and efficiency of IP resource identification has become a problem that needs to be solved urgently.

[0074] In view of this, the embodiments of the present application provide a network resource identification method, device, electronic device and storage medium. Since an organizational resource map is constructed in advance based on the organizational data, website data and domain name data of each candidate organization, the target organization node used to characterize the target organization, the IP address node connected to the target organization node, and the intermediate node on the connection path between the target organization node and the IP address node can be found from the enterprise resource map. Then, based on the node characteristics of the target organization node, the IP address node and the intermediate node, the correlation parameter between the target organization node and the IP address node is determined. Based on the correlation parameter, the association relationship between the IP address corresponding to the IP address node and the target organization is determined. Based on the above method, by performing multi-path modeling between the target organization node and the IP address node, the multi-path information can be fully utilized to determine the relationship between the IP address and the target organization, thereby improving the accuracy and efficiency of IP asset identification.

[0075] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0076] like Figure 1 As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes two terminal devices 110 and a server 120.

[0077] In the embodiments of the present application, the terminal device includes but is not limited to mobile phones, tablet computers, laptop computers, desktop computers, e-book readers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals and other devices; the terminal device may be installed with a client related to network resource identification, which may be software (such as a browser, network resource identification software, etc.), or a web page, a small program, etc. The server is a background server corresponding to the software or web page, small program, etc., or a server specifically used for network resource identification, which is not specifically limited in the present application. The server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0078] It should be noted that the network resource identification method in the embodiment of the present application can be executed by an electronic device, which can be a server or a terminal device, that is, the method can be executed by the server or the terminal device alone, or can be executed by the server and the terminal device together.

[0079] In an optional implementation, the terminal device and the server may communicate via a communication network.

[0080] In an optional implementation, the communication network is a wired network or a wireless network.

[0081] It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0082] The following describes the network resource identification method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0083] See also Figure 2 As shown, it is an implementation flow chart of a network resource identification method provided in an embodiment of the present application. Taking the execution subject as a server as an example, the specific implementation process of the method includes the following steps S21-S23:

[0084] S21: The server searches for a target organization node representing the target organization, an Internet Protocol IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-built organization resource graph;

[0085] The organization may be an enterprise, a government agency, a volunteer group, a social group, etc., which is not specifically limited here. In the embodiment of the present application, the organization is mainly described as an enterprise. The target organization node can be found in the organization resource map according to the organization name, logo, etc. of the target organization.

[0086] The organization resource map includes a node set corresponding to each candidate organization, and the node set includes a candidate organization node for representing the corresponding candidate organization, an IP address node associated with the candidate organization, and each intermediate node between the candidate organization node and the IP address node of the candidate organization, that is, each candidate organization corresponds to multiple nodes in the organization resource map, including a unique candidate organization node and at least one associated IP address node, and there is at least one intermediate node between the candidate organization node and the IP address node, and the intermediate node is extracted based on the organization data, website data and domain name data of the candidate organization, wherein the organization data may include the enterprise name, the website data may include the website name and website content data, the domain name data may include ICP data and Domain Name System (DNS) data, the ICP data includes the enterprise name, ICP number, and domain name, and the DNS data includes the domain name, IP address, an address record (A record for short) that physically identifies the domain name, an Internet Protocol version 6 (IPv6) address record (AAAA record for short) or a Canonical Name (CNAME) record.

[0087] In order to construct an organizational resource map, we first collect a large number of company names, and then enter the company names into the ICP database to obtain the main domain name registered by the company. Enter the main domain name into the DNS database to obtain the historical subdomain names of the main domain name. In this way, we obtain the company's domain name data, add http: / / and https: / / to the domain name prefix, construct a Uniform Resource Locator (URL), and crawl the URL to obtain website data.

[0088] Optionally, for each candidate organization, construct an organizational resource map by:

[0089] S31: extracting multiple text data from the organization data and website data of the candidate organization, and performing keyword extraction on the multiple text data to obtain keyword sets for each of the multiple text data;

[0090] S32: extracting reference data of each preset type from the organization data, website data, and domain name data of the candidate organization;

[0091] S33: taking each keyword set and each extracted reference data as a node, connecting them according to a preset hierarchical structure to generate an organizational resource map.

[0092] Specifically, text data may include company names, website titles, website content, etc. For example, keyword extraction is performed on the text data "The first artificial intelligence conference was held in place A", and the obtained keyword set is {first, artificial intelligence, place A}.

[0093] The preset types may include URL links, domain names, certificates, IP addresses, icons, company names, A / AAAA records, CNAME records, etc., which are not specifically limited here.

[0094] The preset hierarchical structure can be URL connected to domain name, URL connected to domain name, domain name connected to IP address, company name connected to ICP number. The specific setting can be made according to needs and is not specifically limited here.

[0095] For example, Figure 3 As shown, it is a schematic diagram of part of the organizational resource map in the embodiment of the present application. The website data includes six types of information: URL link, domain name, certificate, IP address, icon, and word cloud. Each type is a node. The word cloud refers to a set of keywords. In the website data, the URL link (website logo) is used as the center to connect the other five nodes, that is, there are five edges: URL-domain name, URL-certificate, URL-ip, URL-icon, and URL-word cloud.

[0096] ICP data includes three types of information: company name, ICP number, and domain name. The possible edges are: company name-ICP number, ICP number-domain name;

[0097] If the DNS data includes a domain name, an IP address, an A / AAAA record or a CNAME record, there may be edges: domain name-IP address, or domain name-domain name, such as primary domain name-subdomain name, second-level domain name-third-level domain name.

[0098] Finally, using nodes and edges, the website data and domain name data are stored in the same graph structure. Since the organizational resource graph may contain many nodes, Figure 3 Only a portion of the organizational resource diagram is taken for illustration.

[0099] Optionally, step S31 may be implemented as follows:

[0100] S311: For each piece of text data, perform word segmentation on the text data to obtain a word segmentation set of the text data;

[0101] S312: for each segmentation in the segmentation set, determining an importance parameter of the segmentation based on the frequency of the segmentation in the text data and the amount of text data containing the segmentation;

[0102] S313: Based on the importance parameters of each segmentation, perform at least one round of screening on the segmentations in the segmentation set to obtain a keyword set of the text data.

[0103] Specifically, the jieba word segmentation tool is used to obtain the word segmentation set of each text data. The word segmentation set of a text data can be marked as , for each word w in the text data a i Calculate the importance parameter Term Frequency-Inverse Document Frequency (TF-IDF):

[0104] ;

[0105]

[0106] in, Indicates w i The number of times it appears in text data a, is the total number of words in text data a, Indicates the total number of text data. To include w i The importance parameter is the product of the calculated TF and IDF.

[0107] Keywords can be screened out from the word set according to the importance parameter. For example, two words with the highest importance parameters are selected as keywords and added to the keyword set.

[0108] Optionally, step S31 may be implemented as follows:

[0109] The following steps were performed in each round of screening:

[0110] The two segmentations with the smallest corresponding importance parameters in the segmentation set are merged into a new segmentation, and the sum of the importance parameters of the two segmentations is used as the importance parameter of the new segmentation; for each segmentation contained in the current segmentation set, the segmentation whose corresponding importance parameter is greater than the preset value is used as a keyword, extracted into the keyword set of the text data, and the extracted segmentation is deleted from the segmentation set.

[0111] Specifically, the importance parameter corresponding to each word segment is . Set a preset value θ, traverse the word segmentation results, and only take two physically adjacent words with the smallest importance parameters each time, merge the two words into a new word, and its corresponding importance parameter is the sum of the importance parameters of the original two words. When the importance parameter of a word exceeds the threshold θ, the word is extracted into the keyword set and deleted from the word set, and the following merge is no longer performed. In the end, each text data can get a word cloud table, which stores multiple keywords with high importance parameters.

[0112] Optionally, if the sum of the importance parameters of the remaining word segments in the word segmentation set is not greater than a preset value, the screening is stopped and the current keyword set is used as the keyword set of the text data.

[0113] For example, the importance parameter of word 1 is 0.5, the importance parameter of word 2 is 1, the importance parameter of word 3 is 2, the importance parameter of word 4 is 1, the importance parameter of word 5 is 7, the importance parameter of word 6 is 2, and the importance parameter of word 7 is 4. The preset value is 5:

[0114] In the first round of screening, segmentation 1 and segmentation 2 are merged into segmentation 12, and the importance parameter after the merger is 1.5. Segmentation 5 is extracted into the keyword set. At this time, the segmentation set includes {segmentation 12, segmentation 3, segmentation 4, segmentation 6, segmentation 7}, and the importance parameter of each segmentation is greater than 5, so continue screening;

[0115] In the second round of screening, word 12 and word 3 are merged into word 123, and the importance parameter after the merger is 3.5. At this time, the word set includes {word 123, word 4, word 6, word 7}, and there is no word greater than the preset value. The sum of the importance parameters of each word is greater than 5, and the screening continues;

[0116] In the third round of screening, participle 6 and participle 7 are merged into participle 67. The importance parameter after the merger is 6. Participle 67 is extracted into the keyword set. At this time, the participle set includes {participle 123, participle 4}. The sum of the importance parameters of participle 123 and participle 4 is 4.5, so the screening is stopped. The current keyword set includes {participle 5, participle 67}.

[0117] Existing keyword extraction technology mainly relies on a known vocabulary set, and it is difficult to effectively handle unseen words, which in turn affects the effect of identifying corporate IP assets (ie, resources). To solve this problem, the embodiment of the present application innovatively combines the keyword extraction technology of TF-IDF and Huffman tree. This technology quantifies the importance of vocabulary by using TF-IDF scores, and combines the merging logic of the Huffman tree to generate new keyword candidates, which effectively improves the recognition ability of unseen words. Unlike traditional methods, the text features ultimately generated by this method are not single keywords, but word clouds composed of multiple keywords. This innovative design significantly improves the recognition ability of unseen words, enriches the keyword data of the text, and helps to improve the adaptability and effectiveness of the asset identification system when facing incomplete or emerging data.

[0118] S22: The server determines a correlation parameter between the target organization node and the IP address node based on the node characteristics of the target organization node, the IP address node, and the intermediate node;

[0119] Among them, the node feature is used to represent the semantics and connection relationship of the corresponding node. The node feature in the embodiment of the present application is actually a feature vector. The node feature is mainly used as a feature vector as an example for explanation below. For each node in the organizational resource graph, the feature vector of each node is first randomly initialized, and then the node to vector (Node toVector, node2vec) algorithm is used for pre-training to obtain the semantic information of each node, and then the semantic information and the connection relationship of the node are fused into a node feature vector for determining the correlation parameter. The connection relationship of the node is mainly used to indicate which nodes the node is connected to. For example, the connection relationship of node 1 is: node 1 points to node 2, and node 3 points to node 1.

[0120] Optionally, step S22 may be implemented as follows:

[0121] The node features of the target organization node are fused with the preset initial features to obtain the output features of the target organization node; for each node except the target organization node, the node features and input features are fused to obtain the output features of the node, the node is an IP address node or an intermediate node, and the input features are obtained based on the output features of each upper-level node pointing to the node; the output features of the IP address node are mapped to obtain the correlation parameters.

[0122] Specifically, a multi-sequence classification model (multi-SCM) can be trained to implement step S22. The neural network layer included in the multi-SCM can be a recurrent neural network (RNN), a deep neural network (DNN), or a long short-term memory network (LSTM), which is not specifically limited here.

[0123] like Figure 4 As shown, it is a schematic diagram of the process of obtaining the correlation parameters in the embodiment of the present application. For enterprise 1 and IP address 1, the directed acyclic graph between enterprise node 1 and IP address node 1 is found from the organizational resource graph, and then the node features of each node in the graph are input into the multi-SCM. The multi-SCM includes a neural network layer, a feature vector aggregator (represented by C in the figure), a fully connected layer, and an activation function layer. For nodes other than IP address node 1, the output of each node must be the input of another node. A node can have multiple node inputs, which are aggregated into a vector through the feature vector aggregator and input into the neural network layer. The feature vector aggregator is an average pooling layer, that is, multiple vectors are added and averaged, and the new vector obtained is the feature of multiple input feature vectors. All feature vectors are finally gathered to IP address node 1 through the directed acyclic graph. The output feature vector of IP address node 1 passes through the fully connected layer and the activation function layer to obtain the correlation parameter.

[0124] For example, the input of node 2 is the output feature vector 1 of enterprise node 1, and the output feature vector 1 is combined with the node feature vector of node 2 for feature fusion through the network layer; the input of node 6 includes the outputs of nodes 3 and 4, so the node feature vectors of nodes 3 and 4 are first added and averaged through the feature vector aggregator C1, and then the mean vector is combined with the node feature vector of node 6 for feature fusion through the neural network layer.

[0125] The multi-SCM is trained by:

[0126] Construct model training samples: Detect the connectivity of each IP address node and enterprise node in the organizational resource graph. If an IP address node is only connected to one enterprise name node, then <enterprise node, IP address node> must be a positive sample pair; define parameter α. When an IP address node is connected to more than α enterprise nodes, then the IP address node must not belong to α-1 of them. Then randomly select an enterprise node from them to form a negative sample pair <enterprise node, IP address node>. α is a hyperparameter. The larger α is, the more accurate the negative sample pair is.

[0127] The correlation parameter of the multi-SCM output is defined as , the true label y is defined by the training sample, the positive sample y=1, the negative sample y=0, and the cross entropy loss function is constructed as follows:

[0128]

[0129] The model parameters can be trained through stochastic gradient descent.

[0130] At present, the mainstream methods for enterprise IP asset identification are mostly based on single-path topology models. This method faces many challenges in practical applications, such as the inability to effectively model complex multi-path environments, resulting in insufficient recognition accuracy. The embodiment of the present application proposes a method based on a multi-sequence classification model (multi-SCM) to achieve multi-path classification. The multi-SCM model can model on a single-source multi-path graph structure (directed acyclic graph), making full use of multi-path information to improve the accuracy of IP asset identification. By introducing a feature vector aggregator, multi-SCM can effectively integrate the features of multiple paths, enhance the model's ability to express complex network structures, and significantly improve the accuracy and robustness of IP asset identification.

[0131] S23: The server determines the association relationship between the IP address corresponding to the IP address node and the target organization based on the correlation parameter.

[0132] Specifically, the association relationship is used to indicate whether the IP address belongs to the target organization. For example, when the correlation parameter is greater than a certain value, it is determined that the IP address belongs to the target organization.

[0133] Optionally, if the correlation parameter is greater than a preset score threshold, it is determined that the IP address corresponding to the IP address node belongs to the target organization.

[0134] For example, if the score threshold is 0.6 and the relevance parameter is 0.7, it is determined that the IP address belongs to the target organization.

[0135] In the embodiment of the present application, since an organizational resource map is constructed in advance based on the organizational data, website data and domain name data of each candidate organization, the target organization node used to characterize the target organization, the IP address node connected to the target organization node, and the intermediate node on the connection path between the target organization node and the IP address node can be found from the enterprise resource map, and then the correlation parameter between the target organization node and the IP address node is determined based on the node characteristics of the target organization node, the IP address node and the intermediate node, and the association relationship between the IP address corresponding to the IP address node and the target organization is determined based on the correlation parameter. Based on the above method, by performing multi-path modeling between the target organization node and the IP address node, the multi-path information can be fully utilized to determine the relationship between the IP address and the target organization, thereby improving the accuracy and efficiency of IP asset identification.

[0136] In specific implementation, the network resource identification method in the embodiment of the present application can be implemented and applied in multiple scenarios, and the specific embodiments are listed as follows:

[0137] 1. Enterprise network asset management and visualization

[0138] An important application of enterprise IP asset identification technology in network security is enterprise network asset management and visualization. By using this technology, enterprises can comprehensively discover and identify various types of IP assets in their networks. This technology supports the classification and labeling of assets, thereby helping enterprises distinguish between important and secondary assets and evaluate them according to the risks they expose. This process can reveal potential vulnerabilities and threats, and support enterprises to formulate more accurate and effective security strategies. At the same time, through visualization, enterprises can understand the status and distribution of network assets in real time, improving the efficiency of identification.

[0139] Implementation step 1: Collect domain names, ICP data, passive DNS (PDNS) data, and website crawler data.

[0140] Implementation step 2: Use the keyword extraction model to build a word cloud of the company name and website content, and use the company name, ICP data, PDNS data, and website data to build a graph.

[0141] Implementation step three: Build and train the multi-SCM model.

[0142] Implementation step 4: For any enterprise node in the graph, find all its connected IP address nodes, draw a directed acyclic graph between the enterprise node and the IP address node, input the graph into multi-SCM, and evaluate whether the IP address asset is the enterprise's asset. Using this method, all IP address assets of the enterprise can be found.

[0143] Implementation step five: Provide the identified IP assets to the company's security experts, who will manage the IP assets and visualize the asset connections. The company can understand the status and distribution of network assets in real time and improve the efficiency of security protection.

[0144] 2. Compliance Audit

[0145] In the process of compliance audit, enterprise IP asset identification technology can be used to improve the effectiveness of risk control and compliance audit. This technology can automatically scan the enterprise network, promptly discover unauthorized or high-risk devices, and ensure that all network assets operate within the scope of compliance. This timely detection and identification helps enterprises proactively discover problems during the audit process, reduce human errors, and reduce compliance risks caused by failure to promptly discover illegal devices. In addition, continuous asset discovery and monitoring can ensure that enterprises are always in compliance and reduce the legal and financial risks that may be faced due to violations.

[0146] Implementation steps 1 to 4 are similar to those of the previous embodiment and will not be repeated here.

[0147] Implementation Step 5: Use the identified IP address assets to promptly discover unauthorized or high-risk devices, ensure that all network assets operate within the scope of compliance, and reduce the risks that may be faced due to violations.

[0148] like Figure 5 As shown, it is a schematic diagram of the overall process of the network resource identification method in the embodiment of the present application, including three parts: data acquisition, model training and IP asset extension, wherein data acquisition includes:

[0149] S501: Collect company names;

[0150] S502: Obtain the main domain name of the enterprise according to the ICP data;

[0151] S503: Obtain some historical subdomains of the enterprise according to DNS data;

[0152] S504: construct a URL to obtain the website data of the enterprise;

[0153] Model training includes:

[0154] S505: extract keywords from the multiple text data to obtain a keyword set;

[0155] S506: constructing an organizational resource map based on the keyword set, enterprise data, network data, and domain name data;

[0156] S507: construct training samples based on the organizational resource map;

[0157] S508: training a multi-sequence classification model;

[0158] IP asset expansion includes:

[0159] S509: Searching for the target enterprise node, the connected IP address nodes, and the intermediate nodes on the connected path in the organizational resource graph;

[0160] S510: Input the node features of each node into the multi-sequence classification model to obtain correlation parameters;

[0161] S511: Determine whether the IP address belongs to the target enterprise according to the correlation parameter.

[0162] Based on the same inventive concept, the present application embodiment also provides a network resource identification device. Figure 6 As shown, it is a schematic diagram of the structure of a network resource identification device 600, which may include:

[0163] A search unit 601 is used to search for a target organization node for representing a target organization, an Internet Protocol IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-constructed organization resource map, wherein the organization resource map includes a node set corresponding to each candidate organization, and the node set includes: a candidate organization node for representing a corresponding candidate organization, an IP address node associated with the candidate organization, and each intermediate node between the candidate organization node and the IP address node of the candidate organization, wherein the intermediate node is extracted based on the organization data, website data, and domain name data of the candidate organization;

[0164] A determination unit 602, configured to determine a correlation parameter between the target organization node and the IP address node based on node features of the target organization node, the IP address node, and the intermediate node, wherein the node features are used to represent the semantics and connection relationship of the corresponding nodes;

[0165] The association unit 603 is used to determine the association relationship between the IP address corresponding to the IP address node and the target organization based on the correlation parameter.

[0166] Optionally, the device further includes a construction unit 604, configured to construct an organizational resource map in the following manner:

[0167] For each candidate organization, extract multiple text data from the organization data and website data of the candidate organization, and perform keyword extraction on the multiple text data to obtain keyword sets for each of the multiple text data;

[0168] Extracting reference data of each preset type from the organization data, website data, and domain name data of the candidate organization;

[0169] Each keyword set and each extracted reference data is taken as a node, connected according to a preset hierarchical structure to generate an organizational resource map.

[0170] Optionally, the construction unit 604 is specifically used for:

[0171] For each piece of text data, segment the text data to obtain a segmentation set of the text data;

[0172] For each word in the word set, determine an importance parameter of the word based on the frequency of the word in the text data and the amount of text data containing the word;

[0173] Based on the importance parameters of each segmentation, at least one round of screening is performed on the segmentations in the segmentation set to obtain a keyword set of the text data.

[0174] Optionally, the construction unit 604 is specifically used for:

[0175] The following steps were performed in each round of screening:

[0176] The two segmentations with the smallest corresponding importance parameters in the segmentation set are merged into a new segmentation, and the sum of the importance parameters of the two segmentations is used as the importance parameter of the new segmentation;

[0177] For each segmentation included in the current segmentation set, the segmentation whose corresponding importance parameter is greater than a preset value is taken as a keyword, extracted into the keyword set of the text data, and the extracted segmentation is deleted from the segmentation set.

[0178] Optionally, the construction unit 604 is further configured to:

[0179] If the sum of the importance parameters of the remaining word segments in the word segmentation set is not greater than the preset value, the screening is stopped and the current keyword set is used as the keyword set of the text data.

[0180] Optionally, the determining unit 602 is specifically configured to:

[0181] The node features of the target organization node are fused with the preset initial features to obtain the output features of the target organization node;

[0182] For each node except the target organization node, the node features and input features of the node are fused to obtain the output features of the node. The node is an IP address node or an intermediate node. The input features are obtained based on the output features of each upper-level node pointing to the node.

[0183] The output features of the IP address nodes are mapped to obtain correlation parameters.

[0184] Optionally, the associating unit 603 is specifically configured to:

[0185] If the correlation parameter is greater than a preset score threshold, it is determined that the IP address corresponding to the IP address node belongs to the target organization.

[0186] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0187] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0188] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0189] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device may be a server, such as Figure 1 In this embodiment, the structure of the electronic device can be as follows: Figure 7 As shown, it includes a first memory 701 , a communication module 703 and one or more first processors 702 .

[0190] The first memory 701 is used to store the computer program executed by the first processor 702. The first memory 701 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc. The first memory 701 may be a volatile memory (volatile memory), such as a random-access memory (RAM); the first memory 701 may also be a non-volatile memory (non-volatile memory), such as a read-only memory, a flash memory (flash memory), a hard disk drive (HDD) or a solid-state drive (SSD); or the first memory 701 is any other medium that can be used to carry or store the desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The first memory 701 may be a combination of the above memories.

[0191] The first processor 702 may include one or more central processing units (CPU) or a digital processing unit, etc. The first processor 702 is configured to implement the above network resource identification method when calling the computer program stored in the first memory 701 .

[0192] The communication module 703 is used to communicate with terminal devices and other servers.

[0193] The specific connection medium between the first memory 701, the communication module 703 and the first processor 702 is not limited in the embodiment of the present application. Figure 7 In the embodiment, the first memory 701 and the first processor 702 are connected via a bus 704. The bus 704 is Figure 7 The connections between the other components are only for illustration and are not intended to be limiting. The bus 704 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 7 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0194] The first memory 701 stores a computer storage medium, and the computer storage medium stores computer executable instructions, which are used to implement the network resource identification method of the embodiment of the present application. The first processor 702 is used to execute the above-mentioned network resource identification method, such as Figure 2 shown.

[0195] In another embodiment, the electronic device may also be other electronic devices, such as Figure 1 In this embodiment, the structure of the electronic device can be as follows: Figure 8 As shown, it includes: a communication component 810, a second memory 820, a display unit 830, a camera 840, a sensor 850, an audio circuit 860, a Bluetooth module 870, a second processor 880 and other components.

[0196] The communication component 810 is used to communicate with the server. In some embodiments, a wireless fidelity (WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help the user to send and receive information through the WiFi module.

[0197] The second memory 820 can be used to store software programs and data. The second processor 880 executes various functions and data processing of the terminal device by running the software programs or data stored in the second memory 820. The second memory 820 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. The second memory 820 stores an operating system that enables the terminal device to run. In the present application, the second memory 820 can store an operating system and various application programs, and can also store a computer program for executing the network resource identification method of the embodiment of the present application.

[0198] The display unit 830 can also be used to display information input by the user or information provided to the user and a graphical user interface (GUI) of various menus of the terminal device. Specifically, the display unit 830 may include a display screen 832 disposed on the front of the terminal device. The display screen 832 may be configured in the form of a liquid crystal display, a light emitting diode, etc. The display unit 830 may be used to display the network resource identification user interface in the embodiment of the present application, etc.

[0199] The display unit 830 can also be used to receive input digital or character information and generate signal input related to user settings and function control of the terminal device. Specifically, the display unit 830 may include a touch screen 831 arranged on the front of the terminal device, which can collect user touch operations on or near it, such as clicking a button, dragging a scroll box, etc.

[0200] The touch screen 831 can be covered on the display screen 832, or the touch screen 831 and the display screen 832 can be integrated to realize the input and output functions of the terminal device, and the integrated display screen can be referred to as a touch display screen. In this application, the display unit 830 can display the application and the corresponding operation steps.

[0201] The camera 840 can be used to capture still images, and users can post comments on the images taken by the camera 840 through the application. The camera 840 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the second processor 880 to convert it into a digital image signal.

[0202] The terminal device may also include at least one sensor 850, such as an acceleration sensor 851, a distance sensor 852, a fingerprint sensor 853, and a temperature sensor 854. The terminal device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor. The audio circuit 860, the speaker 861, and the microphone 862 may provide an audio interface between the user and the terminal device. The audio circuit 860 may transmit the electrical signal converted from the received audio data to the speaker 861, which is converted into a sound signal for output by the speaker 861. The terminal device may also be configured with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 862 converts the collected sound signal into an electrical signal, which is received by the audio circuit 860 and converted into audio data, and then the audio data is output to the communication component 810 to be sent to, for example, another terminal device, or the audio data is output to the second memory 820 for further processing.

[0203] The Bluetooth module 870 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 870 to exchange data.

[0204] The second processor 880 is the control center of the terminal device. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal device and processes data by running or executing software programs stored in the second memory 820 and calling data stored in the second memory 820. In some embodiments, the second processor 880 may include one or more processing units; the second processor 880 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes an operating system, a user interface, and an application program, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the second processor 880. In the present application, the second processor 880 can run an operating system, an application program, a user interface display and a touch response, as well as a network resource identification method of an embodiment of the present application. In addition, the second processor 880 is coupled to the display unit 830.

[0205] In some possible implementations, various aspects of the network resource identification method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to perform the steps of the network resource identification method according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may perform the following steps: Figure 2 Follow the steps shown in .

[0206] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0207] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0208] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0209] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0210] The computer program for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The computer program can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or completely on the remote electronic device or server. In the case of involving a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0211] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0212] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0213] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0214] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0215] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0216] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0217] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0218] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network resource identification method, characterized in that: The method comprises: Searching for a target organization node for representing a target organization, an Internet Protocol IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-constructed organization resource graph, wherein the organization resource graph includes a node set corresponding to each candidate organization, and the node set includes: a candidate organization node for representing a corresponding candidate organization, an IP address node associated with the candidate organization, and each intermediate node between the candidate organization node and the IP address node of the candidate organization, wherein the intermediate node is extracted based on the organization data, website data, and domain name data of the candidate organization; The node features of the target organization node are fused with the preset initial features to obtain the output features of the target organization node; for each node except the target organization node, the node features of the node and the input features are fused to obtain the output features of the node, wherein the node features are used to represent the semantics and connection relationship of the corresponding node; the node is the IP address node or the intermediate node, and the input features are obtained based on the output features of each upper-level node pointing to the node; Mapping the output features of the IP address node to obtain a correlation parameter between the target organization node and the IP address node; If the correlation parameter is greater than a preset score threshold, it is determined that the IP address corresponding to the IP address node belongs to the target organization.

2. The method according to claim 1, characterized in that The organizational resource map is constructed in the following way: For each candidate organization, extract multiple text data from the organization data and website data of the candidate organization, and perform keyword extraction on the multiple text data to obtain keyword sets for each of the multiple text data; Extracting reference data of various preset types from the organization data, website data, and domain name data of the candidate organization; Each keyword set and each extracted reference data is respectively used as a node, connected according to a preset hierarchical structure, and the organizational resource map is generated.

3. The method according to claim 2, characterized in that The extracting keywords from the plurality of text data respectively to obtain keyword sets for the plurality of text data respectively includes: For each piece of text data, segment the text data to obtain a segmentation set of the text data; For each word segment in the word segment set, determining an importance parameter of the word segment based on the frequency of occurrence of the word segment in the text data and the amount of text data containing the word segment; Based on the importance parameters of each segmentation, at least one round of screening is performed on the segmentations in the segmentation set to obtain a keyword set for the text data.

4. The method according to claim 3, characterized in that The step of performing at least one round of screening on the segmented words in the segmented word set based on the importance parameters of each segmented word to obtain the keyword set of the text data includes: The following steps were performed in each round of screening: Merge the two participles with the smallest corresponding importance parameters in the participle set into a new participle, and use the sum of the importance parameters of the two participles as the importance parameter of the new participle; For each segmentation included in the current segmentation set, the segmentation whose corresponding importance parameter is greater than a preset value is taken as a keyword, extracted into the keyword set of the text data, and the extracted segmentation is deleted from the segmentation set.

5. The method according to claim 4, characterized in that The method further comprises: If the sum of the importance parameters of the remaining word segments in the word segmentation set is not greater than the preset value, the screening is stopped and the current keyword set is used as the keyword set of the text data.

6. A network resource identification device, characterized in that: include: A search unit, used to search for a target organization node for representing a target organization, an Internet Protocol IP address node connected to the target organization node, and an intermediate node on a connection path between the target organization node and the IP address node from a pre-constructed organization resource map, wherein the organization resource map includes a node set corresponding to each candidate organization, and the node set includes: a candidate organization node for representing a corresponding candidate organization, an IP address node associated with the candidate organization, and each intermediate node between the candidate organization node and the IP address node of the candidate organization, wherein the intermediate node is extracted based on the organization data, website data, and domain name data of the candidate organization; A determination unit, used to perform feature fusion on the node features of the target organization node and the preset initial features to obtain the output features of the target organization node; for each node other than the target organization node, perform feature fusion on the node features and input features of the node to obtain the output features of the node, wherein the node features are used to represent the semantics and connection relationship of the corresponding node; and map the output features of the IP address node to obtain the correlation parameter between the target organization node and the IP address node; An association unit is used to determine that the IP address corresponding to the IP address node belongs to the target organization if the correlation parameter is greater than a preset score threshold.

7. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: It stores a computer program, and when the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any method described in claims 1 to 5.

Images