Detection and calculation method for vulnerable nodes of network assets

Abstract

The invention belongs to the field of data analysis, and particularly designs a method for detecting and calculating vulnerable nodes of network assets, which comprises the following steps of: collecting exposed surface information data of the network assets, and then sorting and de-weighting the exposed surface information data of the network assets; secondly, constructing a network topological graph, and analyzing the topological graph to obtain network asset fragile nodes; and finally, vulnerability severity calculation is carried out on the vulnerable nodes, so that the vulnerable nodes in the target network are found by using the network topological graph, and the network security protection capability is improved.

Description

Technical Field

[0001] The present invention belongs to the field of data analysis, and in particular relates to a detection and calculation method for vulnerable nodes of network assets. Background Art

[0002] Network assets are the sum of resources owned and controlled by an enterprise or individual in the Internet environment. These assets include but are not limited to websites, servers, domain names, network resources, databases, etc., which are the basis for enterprises to operate Internet business. Network assets are not only the core component of enterprise information construction, but also the key element to enhance competitiveness and achieve business goals.

[0003] The main types of network assets include: 1. Websites and servers: These are important platforms for companies to display their image, provide services and products. The content, design and functions of the website directly affect the user experience and the image of the company. The server is the hardware foundation for the operation of the website, ensuring that the website runs uninterruptedly 24 hours a day. 2. Domain name: It is the network logo of the company, similar to the trademark in reality, and is an important part of the brand image. The choice of domain name is directly related to the company's network visibility and brand image. 3. Network resources: Including the company's network infrastructure, bandwidth resources, etc., these are the basis for ensuring the normal operation of the company's network. 4. Database: Storing and managing the company's key data is an important support for corporate decision-making and operations.

[0004] However, network assets also have great vulnerabilities. Vulnerabilities can also be called weaknesses or loopholes. They are weak links in assets or asset groups that may be exploited by threats to cause damage. Once a vulnerability is successfully exploited by a threat, it may cause damage to the asset. Vulnerabilities may exist in various aspects such as the physical environment, organization, process, personnel, management, configuration, hardware, software and information. Vulnerabilities are closely linked to assets and are their inherent attributes. The objective existence is absolute, but the existence of vulnerabilities does not necessarily lead to security incidents. If not exploited by the corresponding threat, the simple vulnerability itself will not cause damage to the asset.

[0005] Therefore, how to detect the vulnerability of network assets often requires detecting its vulnerable nodes, but existing means make it difficult to detect and discover vulnerable nodes, and it is difficult to determine whether they are real vulnerable nodes. Summary of the invention

[0006] In order to solve the above problems, this application designs a detection and calculation method for vulnerable nodes of network assets, so that through the above design, by using the network topology map, vulnerable nodes in the target network are discovered, and whether they are vulnerable nodes is determined, thereby improving network security protection capabilities.

[0007] A method for detecting and calculating vulnerable nodes of network assets comprises the following steps: Step S1, collecting network asset exposure information data; Step S2: sorting and removing duplicate information of network asset exposure surface data; Step S3: construct a network topology map, and analyze the topology map to obtain vulnerable nodes of network assets; Step S4: Calculate the vulnerability severity of the vulnerable nodes.

[0008] Preferably, step S2 comprises: Step S21, using a data processing tool to clean the data collected in step S1 to remove duplicate and invalid data; Step S22: classify the cleaned data according to asset type; Step S23: Aggregate the classified data and the asset data scanned by the scanning tool to build a network asset database.

[0009] Preferably, the information data collection method in step S1 includes: active IP detection, passive traffic analysis and non-invasive search engine crawling; The active IP detection includes: Step S101: Use a scanning tool to scan the IP segment of the target network, send a detection data packet to the target IP range, and record the reply IP address and open port to identify online devices and services; Step S102: After identifying the open ports, use the service fingerprint recognition function of the scanning tool to obtain detailed information about the services provided by each port; The passive traffic analysis includes: Step S111: deploy a traffic analysis tool at the network inlet or outlet to capture all data packets flowing through the network and perform traffic collection; Step S112: Analyze the collected traffic and extract key information, including source IP, target IP, protocol type, and traffic size; The non-intrusive search engine crawling includes: performing information retrieval through traditional search engines and special security search engines to obtain public information related to the target network.

[0010] Preferably, in step S3, constructing a network topology map and analyzing the topology map to obtain network asset vulnerable nodes comprises the following steps: Step S31, define topology elements: Step S32: Select a suitable network visualization tool to construct a network topology diagram; Step S33: Analyze the network topology diagram to obtain vulnerable nodes.

[0011] Preferably, in step S31, defining topology map elements includes: Node v: Each device in the network is a node; Edge e: represents the connection relationship between nodes; Let G=(V,E) represent a graph, where V is the set of nodes and E is the set of edges; Each node vi∈V represents a network device with the following properties: vi=(IIDi,Typei,IPi,OSi); where IIDi is the unique identifier of the node, Typei is the node type, IPi is the IP address of the node, and OSi is the operating system type of the node; Define edges: Each edge ej∈E connects two nodes va and vb and has the following properties: ej =(va,vb,Bandwidthj,Latencyj,Protocolj); Bandwidth is the connection bandwidth, Latency is the delay, and Protocol is the protocol used.

[0012] Preferably, in step S32, the mathematical expression for constructing the network topology graph is: ; The topological graph G is composed of a node set V and an edge set E, where each edge connects two nodes. i is the i-th node, e j is the jth edge.

[0013] Preferably, in step S33, analyzing the network topology diagram to obtain vulnerable nodes includes the following steps: Step S3301, calculate the degree centrality of the nodes, and select nodes with high degree centrality as vulnerable nodes; Step S3302, calculate the betweenness centrality of the nodes, and select the nodes with high betweenness centrality as vulnerable nodes; Step S3303: Calculate the closeness centrality of the nodes, and select nodes with high closeness centrality as vulnerable nodes.

[0014] Preferably, in step S4, calculating the vulnerable nodes includes the following steps: Step S41, matching the vulnerable node obtained in step S33 with the vulnerability database to obtain a known vulnerable node; Step S42: Calculate the vulnerability severity of the known vulnerability node using CVSS; Step S43: sort out a list of vulnerable nodes according to the severity of the vulnerability.

[0015] The advantages and effects of this application are as follows: The present application designs a method for detecting and calculating vulnerable nodes of network assets. The method collects network asset exposure surface information data, then organizes and removes duplicates of the network asset exposure surface information data; secondly, constructs a network topology map, analyzes the topology map to obtain network asset vulnerable nodes; finally, calculates the severity of vulnerabilities of vulnerable nodes, thereby realizing the use of network topology maps to discover vulnerable nodes in the target network and improve network security protection capabilities.

[0016] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application so that it can be implemented in accordance with the contents of the specification, and to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following is a detailed description of the preferred embodiments of the present application in conjunction with the accompanying drawings as follows.

[0017] Based on the detailed description of the specific embodiments of the present application in combination with the accompanying drawings below, those skilled in the art will become more aware of the above and other objects, advantages and features of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings without creative work. In all drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, each element or part is not necessarily drawn according to the actual scale.

[0019] Figure 1 A flow chart of a detection and calculation method for vulnerable nodes of network assets designed for this application. DETAILED DESCRIPTION

[0020] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, rather than all of the embodiments. In the following description, specific details such as specific configuration and components are provided only to help fully understand the embodiments of the present application. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. In addition, for clarity and brevity, the description of known functions and structures is omitted in the embodiment.

[0021] It should be understood that the references to "one embodiment" or "this embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "one embodiment" or "this embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0022] In addition, the present application may repeat reference numerals and / or letters in different examples. This repetition is for the purpose of simplicity and clarity, and does not in itself indicate the relationship between the various embodiments and / or settings discussed.

[0023] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" in this article describes another type of association object relationship, indicating that there can be two relationships. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0024] The term "at least one" in this article is merely a description of the association relationship of associated objects, indicating that there may be three relationships. For example, at least one of A and B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0025] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusions.

[0026] Example 1: Please refer to Figure 1 This embodiment mainly introduces a specific design of a detection and calculation method for a network asset vulnerable node, including the following steps: Step S1, collecting network asset exposure information data; Step S2: sorting and removing duplicate information of network asset exposure surface data; Step S3: construct a network topology map, and analyze the topology map to obtain vulnerable nodes of network assets; Step S4: Calculate the vulnerability severity of the vulnerable nodes.

[0027] Furthermore, the step S2 includes: Step S21: Use a data processing tool such as an ETL (data extraction, transformation, and loading) tool to clean the data collected in step S1 and remove duplicate and invalid data; Step S22: classify the cleaned data according to asset type (such as server, router, etc.); Step S23: Use the classified data and the assets scanned by Nmap together in a MySql database to define a table containing: asset ID, asset type (such as server, router), IP address, operating system, service information, and security status (such as vulnerability information), fill in the data, and build a network asset database.

[0028] Furthermore, the information data collection method in step S1 includes: active IP detection, passive traffic analysis and non-invasive search engine crawling; The active IP detection includes: Step S101, use the scanning tool Nmap to scan the IP segment of the target network, send a detection data packet such as an ICMP request to the target IP range, and record the reply IP address and open port to identify online devices and services; Step S102: After identifying the open ports, use Nmap's own service fingerprint recognition function to obtain detailed information about the services provided by each port, such as the operating system, software version, etc. The passive traffic analysis includes: Step S111: deploy a traffic analysis tool (such as Wireshark, Zeek) at the network inlet or outlet to capture all data packets flowing through the network, collect traffic, and provide data for the next step of analyzing traffic characteristics; Step S112: Use the K-Means clustering algorithm to analyze the collected traffic and extract key information, including source IP, target IP, protocol type, and traffic size; this information helps identify assets in the network.

[0029] Steps of K-Means Clustering Algorithm: Data preparation: First, use the wireshark tool to analyze the specific traffic from the collected network traffic and construct the extracted key information into a feature matrix. Each row represents a data packet and each column represents a feature, for example: [Source IP, Destination IP, Protocol, Source Port, Destination Port, Packet Size, Timestamp] Remove duplicate and invalid data to ensure the accuracy of the feature matrix.

[0030] These features constitute the feature matrix X, where each row represents a traffic record and each column represents a feature.

[0031] Set the number of clusters k: Determine the appropriate number of clusters k through the time-part method (for different values ​​of the number of clusters k, calculate the cost function value corresponding to each k, use the number of clusters k as the horizontal axis and the cost function value as the vertical axis, draw a line graph, find the trend of the cost function value decreasing as k increases, and determine the point where the downward trend begins to slow down. The k value corresponding to this point is the appropriate number of clusters), and determine the appropriate number of clusters k. The number of clusters represents how many categories you want to divide the traffic data into to identify different types of network assets.

[0032] Initialize cluster centers: Randomly select k data points as initial cluster centers (centroids), which are used to calculate the distance between data points and clusters.

[0033] Assign data points: Calculate the Euclidean distance between each data point and each centroid and assign the data point to the cluster with the closest distance. i and the center of mass μ j The Euclidean distance calculation formula between them is: ; Among them, x i,l and μ j,l are the data point x and the centroid μ respectively j The value at the first feature, n is the number of features.

[0034] Update the centroid: Recalculate the centroid of each cluster to make it the mean of all data points in the current cluster. The formula for updating the centroid is: ; Among them, C j is the set of data points of the jth cluster, |C j | is the number of data points in the cluster.

[0035] Iteration: Repeat the steps of assigning data points and updating centroids until the centroids no longer change significantly (i.e., convergence conditions are met), or the preset maximum number of iterations is reached.

[0036] Complete clustering: After multiple iterations, the final clusters contain traffic data with similar characteristics, which can be used to identify and classify different network assets.

[0037] The non-invasive search engine crawling includes: performing information retrieval through traditional search engines and specialized security search engines such as Shodan and Zoomeye, and using specific query syntax (such as intitle:, site:) to obtain public information related to the target network.

[0038] like: Find information about a specific website: Example: site:example.com; This query will return all pages under the example.com domain, helping to obtain public information about the website.

[0039] Find pages with a specific title containing a keyword: Example: intitle:"login" site:example.com.

[0040] This query returns all pages that have "login" in their title and is commonly used to find login pages.

[0041] To find files of a specific type: Example: filetype:pdf site:example.com; This query will return all PDF files on the example.com website, which may contain useful documents and reports.

[0042] Search for specific keywords: Example: "confidential" site:example.com; This query will return all pages containing the word "confidential", potentially revealing sensitive information.

[0043] Furthermore, in step S3, a network topology map is constructed, and the topology map is analyzed to obtain vulnerable nodes of network assets; the following steps are included: Step S31, define topology elements: Step S32: Select a suitable network visualization tool to construct a network topology diagram; like: In Graphviz; graph G { / / Define nodes node1 [label="ID1\nType: Server\nIP: 192.168.1.1\nOS: Linux"]; node2 [label="ID2\nType: Router\nIP: 192.168.1.2\nOS: Cisco"]; / / Define edges node1--node2[label="Bandwidth:ej.Namdwodth\Latency: ej.Latency\Protocol: ej.Protocol"\nShortLength:"SP(v_a,v_b)"]; } Generate graphs using Graphviz commands; dot -Tpng -o topology.png topology.dot Through in-depth analysis, vulnerable nodes in the target network can be identified, which is crucial to improving network security protection capabilities.

[0044] The following are the specific implementation steps to analyze the network topology and obtain vulnerable nodes.

[0045] Step S33: Analyze the network topology diagram to obtain vulnerable nodes.

[0046] Furthermore, in step S31, defining topology map elements includes: Node v: Each device in the network is a node; Edge e: represents the connection relationship between nodes; Let G=(V,E) represent a graph, where V is the set of nodes and E is the set of edges; Each node vi∈V represents a network device with the following properties: vi=(IIDi,Typei,IPi,OSi); where IIDi is the unique identifier of the node, Typei is the node type, IPi is the IP address of the node, and OSi is the operating system type of the node; Define edges: Each edge ej∈E connects two nodes va and vb and has the following properties: ej =(va,vb,Bandwidthj,Latencyj,Protocolj); Bandwidth is the connection bandwidth, Latency is the delay, and Protocol is the protocol used.

[0047] Furthermore, in step S32, the mathematical expression for constructing the network topology graph is: ; The topological graph G is composed of a node set V and an edge set E, where each edge connects two nodes. i is the i-th node, e j is the jth edge.

[0048] Further, the feature calculation of the topological graph: In order to further analyze the topological graph, some important features can be calculated: Degree: D(vi)=|{ej∈E|ejconnectstovi|, nodes with high degrees are usually the "central nodes" in the network, which can influence more other nodes and represent their importance in the network.

[0049] Clustering Coefficient: ; The clustering coefficient can reflect the local connectivity of the network. Nodes with high clustering coefficients usually mean that they are more likely to form close groups in structures such as social networks or biological networks. Among them, "number of connections between neighbors of v" refers to the number of connections between nodes adjacent to node v (that is, nodes directly connected to v); Shortest Path: ; The shortest path represents the efficiency of information or resource transmission in the network. It can help identify the most direct connection method in the network, affecting data transmission, network attack propagation, etc.

[0050] Furthermore, nodes with high degrees are usually regarded as central nodes because they connect more other nodes. The judgment of central nodes includes degree centrality, betweenness centrality, and closeness centrality. Therefore, in step S33, the network topology is analyzed to obtain vulnerable nodes, including the following steps: Step S3301, calculate the degree centrality of the node, and select the node with high centrality as the vulnerable node; the degree centrality is a measure of the importance of the node, and the formula is: ; Among them C D is the degree centrality, and n is the total number of nodes in the graph. The higher the degree centrality, the more it reflects the number of other nodes a node is directly connected to. Nodes with high degree centrality are often considered "important" nodes in the network because they can directly interact with more other nodes. Therefore, nodes with high degree centrality values ​​require stricter permission management and control.

[0051] Step S3302: Calculate the betweenness centrality of the node, and select the node with high betweenness centrality as the vulnerable node; Betweenness centrality measures the importance of the node in the shortest path between other nodes, and the formula is: ; in: It is a slave node To Node The number of shortest paths. It passes through the node The number of shortest paths.

[0052] Nodes with high betweenness centrality can spread information or resources more efficiently because they have shorter paths to other nodes. The larger this value is, the more backup systems or redundant paths need to be set up for these key nodes to reduce the risk of single point failures.

[0053] Step S3303, calculate the closeness centrality of the node, and select the node with high closeness centrality as the vulnerable node; Closeness Centrality Closeness centrality reflects the average distance from a node to other nodes, and the formula is: ; in Is a node To Node The shortest path length. When the network changes (such as nodes joining or leaving), nodes with high proximity centrality can adjust their connections with other nodes more quickly to maintain the stability of the network.

[0054] Furthermore, in step S4, calculating the vulnerable nodes includes the following steps: Step S41, matching the vulnerable node obtained in step S33 with the vulnerability database to obtain a known vulnerable node; for example, if a server has an unpatched operating system vulnerability and is connected to multiple key devices in the topology, then the server can be regarded as a vulnerable node.

[0055] Step S42, assigning a risk score to each node: using CVSS to calculate the vulnerability severity of the known vulnerable nodes; Step S43: According to the severity of the vulnerability, a list of vulnerable nodes is compiled as needed.

[0056] For example: vulnerable node list: Based on the above analysis, a list of vulnerable nodes is compiled. Each node should include the following information: Node name (such as IP address or device name); Vulnerability information (description of known vulnerabilities and their severity); Risk score (e.g., high, medium, low); Recommended actions (such as patch updates, configuration changes, etc.); Visualization: Use visualization tools (such as Visio, Lucidchart) to highlight vulnerable nodes in the topology diagram. Use different colors or shapes to identify nodes of different risk levels for intuitive understanding.

[0057] Generate an analysis report that describes in detail the analysis process, results, and security recommendations of vulnerable nodes for reference by the network security team.

[0058] Furthermore, this application can also make a continuous monitoring and feedback mechanism; Dynamic monitoring: Continuously monitor the network and regularly update the topology map and analysis results of vulnerable nodes. It can be combined with the SIEM (Security Information and Event Management) system to detect and report network status changes in real time.

[0059] Feedback and Improvement: Based on feedback from actual network attacks or security incidents, we continuously optimize the methods and processes for identifying vulnerable nodes. We also use newly discovered vulnerabilities and attack patterns to update risk calculation models and ensure the effectiveness of the identification mechanism.

[0060] The present application designs a method for detecting and calculating vulnerable nodes of network assets. The method collects network asset exposure surface information data, then organizes and removes duplicates of the network asset exposure surface information data; secondly, constructs a network topology map, analyzes the topology map to obtain network asset vulnerable nodes; finally, calculates the severity of vulnerabilities of vulnerable nodes, thereby realizing the use of network topology maps to discover vulnerable nodes in the target network and improve network security protection capabilities.

[0061] The above description is only the preferred embodiment of the present invention, which does not limit the protection scope of the present invention. For those skilled in the art, the present invention can be modified and varied in various ways. Within the spirit and principle of the present invention, any change, modification, replacement, integration and parameter change of these embodiments by conventional substitution or capable of achieving the same function without departing from the principle and spirit of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for detecting and calculating vulnerable nodes of network assets, characterized in that: The following steps are involved: Step S1, collecting network asset exposure information data; Step S2: sorting and removing duplicate information of network asset exposure surface data; Step S3: construct a network topology map, and analyze the topology map to obtain vulnerable nodes of network assets; Step S4, calculating the severity of the vulnerability of the vulnerable node; In the step S3, a network topology map is constructed, and the topology map is analyzed to obtain vulnerable nodes of network assets; the steps include: Step S31, define topology elements: Step S32: Select a network visualization tool to construct a network topology diagram; Step S33, analyzing the network topology map to obtain vulnerable nodes; In step S31, defining topology map elements includes: Node v: Each device in the network is a node; Edge e: represents the connection relationship between nodes; Let G=(V,E) represent a graph, where V is the set of nodes and E is the set of edges; Each node vi∈V represents a network device with the following properties: vi=(IIDi,Typei,IPi,OSi); where IIDi is the unique identifier of the node, Typei is the node type, IPi is the IP address of the node, and OSi is the operating system type of the node; Define edges: Each edge ej∈E connects two nodes va and vb and has the following properties: ej =(va,vb,Bandwidthj,Latencyj,Protocolj); Bandwidth is the connection bandwidth, Latency is the delay, and Protocol is the protocol used.

2. A method for detecting and calculating vulnerable nodes of network assets according to claim 1, characterized in that: The step S2 comprises: Step S21, using a data processing tool to clean the data collected in step S1 to remove duplicate and invalid data; Step S22: classify the cleaned data according to asset type; Step S23: Aggregate the classified data and the asset data scanned by the scanning tool to build a network asset database.

3. A method for detecting and calculating vulnerable nodes of network assets according to claim 1, characterized in that: The information data collection method in step S1 includes: active IP detection, passive traffic analysis and non-invasive search engine crawling; The active IP detection includes: Step S101: Use a scanning tool to scan the IP segment of the target network, send a detection data packet to the target IP range, and record the reply IP address and open port to identify online devices and services; Step S102: After identifying the open ports, use the service fingerprint recognition function of the scanning tool to obtain detailed information about the services provided by each port; The passive traffic analysis includes: Step S111: deploy a traffic analysis tool at the network inlet or outlet to capture all data packets flowing through the network and perform traffic collection; Step S112: Analyze the collected traffic and extract key information, including source IP, target IP, protocol type, and traffic size; The non-intrusive search engine crawling includes: performing information retrieval through traditional search engines and secure search engines to obtain public information related to the target network.

4. A method for detecting and calculating vulnerable nodes of network assets according to claim 1, characterized in that: In step S32, the mathematical expression for constructing the network topology graph is: ； The topological graph G is composed of a node set V and an edge set E, where each edge connects two nodes. i is the i-th node, e j is the jth edge.

5. A method for detecting and calculating vulnerable nodes of network assets according to claim 1, characterized in that: In step S33, the network topology diagram is analyzed to obtain vulnerable nodes, including the following steps: Step S3301, calculate the degree centrality of the nodes, and select nodes with high degree centrality as vulnerable nodes; Step S3302, calculate the betweenness centrality of the nodes, and select the nodes with high betweenness centrality as vulnerable nodes; Step S3303: Calculate the closeness centrality of the nodes, and select nodes with high closeness centrality as vulnerable nodes.

6. A method for detecting and calculating vulnerable nodes of network assets according to claim 1, characterized in that: In step S4, calculating the vulnerable nodes includes the following steps: Step S41, matching the vulnerable node obtained in step S33 with the vulnerability database to obtain a known vulnerable node; Step S42: Calculate the vulnerability severity of the known vulnerability node using CVSS; Step S43: sort out a list of vulnerable nodes according to the severity of the vulnerability.

Images