An information determination method, apparatus, device, computer storage medium, and computer program product

Abstract

Embodiments of the present application disclose an information determination method, comprising: obtaining historical running data of an asset in a network system, first data of the asset for a historical access request, and second data of the asset for a target access request; generating target detection information of a service provided by the asset based on the historical running data, the first data, and the second data; obtaining target data of the asset for a to-be-processed access request, and determining a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information. Embodiments of the present application also disclose an information determination apparatus, device, computer storage medium, and computer program product.

Description

Technical Field

[0001] This application relates to information determination technology in the field of computers, and more particularly to an information determination method, apparatus, device, computer storage medium, and computer program product. Background Technology

[0002] With the widespread adoption of the internet and advancements in technology, security threats to assets within network systems are becoming increasingly serious. Therefore, improving the security of assets in network systems has become increasingly important. However, the use of open-source frameworks when deploying applications on these assets inherently creates serious security vulnerabilities. This necessitates pre-emptive detection of the services provided by these assets within the network system and real-time monitoring of asset information based on the detection results to anticipate potential risk events and thus enhance asset security. Currently, related technologies use regular expressions and keyword matching to detect specific services corresponding to assets in specific scenarios. However, these methods suffer from low accuracy in service detection. Summary of the Invention

[0003] To address the aforementioned technical problems, this application aims to provide an information determination method, apparatus, device, storage medium, and computer program product, thereby resolving the issue of low accuracy in service detection in related technologies.

[0004] An information determination method, the method comprising:

[0005] Acquire historical operational data of assets in the network system, first data of the assets in response to historical access requests, and second data of the assets in response to target access requests;

[0006] Based on the historical operational data, the first data, and the second data, target detection information for the service is generated; wherein, the service is a service provided by the asset.

[0007] Obtain the target data of the asset for the pending access request, and based on the target data and the target detection information, determine the target service of the asset for the pending access request from the target database.

[0008] In the above scheme, generating target detection information for the service based on the historical operating data, the first data, and the second data includes:

[0009] Based on the historical operational data and the first data, initial detection information for the service is generated.

[0010] The initial detection information is corrected based on the second data to obtain the target detection information.

[0011] In the above scheme, generating initial detection information for the service based on the historical operating data and the first data includes:

[0012] Based on the historical operation data and the first data, the target detection parameters for the service are determined;

[0013] Determine the target detection method and target detection type for the service; wherein, the target detection type represents the type of data that can be detected;

[0014] The initial detection information is generated based on the target detection parameters, the target detection method, and the target detection type.

[0015] In the above scheme, determining the target detection parameters for the service based on the historical operating data and the first data includes:

[0016] The historical operation data and the first data are processed to obtain multiple different characteristic parameters of the service;

[0017] Target detection parameters for the service are determined from the plurality of different feature parameters.

[0018] In the above scheme, determining the target service of the asset for the pending access request based on the target data and the target detection information from the target database includes:

[0019] The target data is processed to obtain the processed target data;

[0020] Based on the target detection information, the processed target data and the data in the target database are matched.

[0021] If the target database contains first matching data whose different feature parameters all match the processed target data, the service corresponding to the first matching data is determined to be the target service.

[0022] The method in the above scheme further includes:

[0023] If the matching data does not exist in the target database, determine the number of feature parameters that do not match any feature parameter in the target database among the different feature parameters;

[0024] The target value is determined based on the quantity;

[0025] If the target value is less than or equal to the target threshold, a first data to be matched is determined from the target database, and the service corresponding to the first data to be matched is determined to be the target service.

[0026] The method in the above scheme further includes:

[0027] If the target value is greater than the target threshold, a second data to be matched is determined from the target database based on the target value;

[0028] Based on the target detection information, the second data to be matched and the processed target data are matched.

[0029] If there is second matching data in the second data to be matched that matches all the different feature parameters, then the service corresponding to the second matching data is determined to be the target service;

[0030] If the second matching data does not exist in the second data to be matched, the target self-learning algorithm is used to process the processed target data to obtain the target feature information of the processed target data and store it in the target database.

[0031] The method in the above scheme further includes:

[0032] Based on the target data, a target time series model is used to predict the target access data of the asset;

[0033] Based on the target access data, generate a risk access strategy for the asset in response to the pending access request;

[0034] Based on the risk access policy, the target access data, and the different characteristic parameters of the target service, the risk assessment result of the asset for the pending access request is determined.

[0035] In the above scheme, determining the risk assessment result of the asset for the pending access request based on the risk access policy, the target access data, and the different characteristic parameters of the target service includes:

[0036] Based on the target access data, the different characteristic parameters of the target service, and the target risk database, the target risk value of the access request to be processed is determined.

[0037] Determine the target trust level of the access request to be processed;

[0038] Based on the risk access policy, the target risk value, and the target trust level, the risk assessment result of the asset for the pending access request is determined.

[0039] An information determining device, the device comprising:

[0040] The acquisition unit is used to acquire historical operational data of assets in the network system, first data of the assets in response to historical access requests, and second data of the assets in response to target access requests.

[0041] The processing unit is configured to generate target detection information for the service based on the historical operating data, the first data, and the second data; wherein the service is a service provided by the asset.

[0042] The determining unit is used to acquire the target data of the asset for the pending access request, and based on the target data and the target detection information, determine the target service of the asset for the pending access request from the target database.

[0043] An information determining device, the device comprising: a processor, a memory, and a communication bus;

[0044] The communication bus is used to realize the communication connection between the processor and the memory;

[0045] The processor is used to execute the information determination program in the memory to implement the steps of the information determination method described above.

[0046] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the information determination method described above.

[0047] A computer program product comprising a computer program that, when executed by a processor, implements a method for determining information as described above.

[0048] The information determination method, apparatus, device, computer storage medium, and computer program product provided in the embodiments of this application can acquire historical operating data of assets in a network system, first data of assets for historical access requests, and second data of assets for target access requests. Based on the historical operating data, the first data, and the second data, target detection information for services provided by the asset is generated. It also acquires target data of the asset for pending access requests and, based on the target data and target detection information, determines the target service of the asset for the pending access request from a target database. Thus, target detection information for all services provided by the asset can be generated based on data from multiple dimensions of the asset. The determination of the target service for the pending access request is achieved by combining the target detection information and the target data of the asset for the pending access request. This ensures that the target detection information considers data from various dimensions of the asset when generating target detection information for services. This allows the generated target detection information to detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in related technologies. This solves the problem of low accuracy in service detection in related technologies. Attached Figure Description

[0049] Figure 1 A flowchart illustrating an information determination method provided in an embodiment of this application;

[0050] Figure 2 A flowchart illustrating yet another information determination method provided in an embodiment of this application;

[0051] Figure 3 This is a schematic diagram of the system structure corresponding to an information determination method provided in an embodiment of this application;

[0052] Figure 4 A flowchart illustrating the risk access policy generation method in an information determination method provided in this application embodiment;

[0053] Figure 5 A flowchart illustrating a risk assessment method within an information determination method provided in this application embodiment;

[0054] Figure 6 This is a schematic diagram of the structure of an information determination device provided in an embodiment of this application;

[0055] Figure 7 This is a schematic diagram of the structure of an information determination device provided in an embodiment of this application. Detailed Implementation

[0056] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0057] It should be understood that the phrases "embodiments of this application" or "foreign embodiments" throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "embodiments of this application" or "in the foreign embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0058] Unless otherwise specified, any step in the embodiments of this application performed by the electronic device may be executed by the processor of the electronic device. It is also worth noting that the embodiments of this application do not limit the order in which the electronic device performs the following steps. Furthermore, the methods used to process data in different embodiments may be the same or different methods. It should also be noted that any step in the embodiments of this application can be executed independently by the electronic device; that is, when the electronic device performs any step in the following embodiments, it may not depend on the execution of other steps.

[0059] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0060] This application provides an information determination method, which can be applied to an information determination device. (Refer to...) Figure 1 As shown, the method may include the following steps:

[0061] Step 101: Obtain historical operational data of assets in the network system, first data of assets in response to historical access requests, and second data of assets in response to target access requests.

[0062] In this embodiment, "assets" can refer to network devices deployed in a network system, and "historical operational data" can refer to the historical security logs of the network devices. The first data can refer to historical data collected from network devices in the network system regarding various service access requests, and the second data can refer to response data collected from network devices in the network system regarding specific access requests. It should be noted that network devices can include physical devices and virtual devices; historical operational logs can be obtained through Network Detection and Response (NDR) technology and Web Application Firewall (WAF) systems, and the historical security logs include data related to attack behaviors against assets and data related to the services provided by the assets.

[0063] Step 102: Based on historical operational data, the first data, and the second data, generate target detection information for the service.

[0064] Here, "service" refers to the services that an asset can provide. In one feasible approach, a service can refer to the services provided by the open-source frameworks, middleware, and application components corresponding to the applications deployed on the asset.

[0065] In this application embodiment, target detection information can be used to detect a specified service from multiple services of an asset. In one possible implementation, the target detection information may include detection parameters required to detect the service, specific detection methods, and types of data that can be detected.

[0066] In this embodiment of the application, initial detection information can be determined first based on historical operation data and first data of assets for historical access requests, and then the initial detection information can be adjusted based on second data of assets for target access requests to obtain the final target detection information.

[0067] In this embodiment of the application, by obtaining the historical operation data of the asset, the first data of the asset for historical access requests, and the second data of the asset for target access requests, target detection information can be generated for services provided by the open source framework, middleware, and application components corresponding to the application. In this way, the target detection information can be used to detect the services provided by the open source framework, middleware, etc. corresponding to the application, which significantly improves the coverage of service detection.

[0068] Step 103: Obtain the target data of the asset for the pending access request, and based on the target data and target detection information, determine the target service of the asset for the pending access request from the target database.

[0069] Here, the pending access request can refer to a real-time access request to a network device; the target data can refer to the asset's response data to the pending access request; and the target database can be a pre-defined database that includes relevant data about various services provided by the asset. In one possible implementation, the relevant data for various services can include data such as the service name, the port corresponding to the service, and a detailed description of the service.

[0070] In this embodiment of the application, after obtaining the target data, the target data can be matched with each data in the target database according to the pre-generated target detection information, and the target service of the asset for the access request to be processed can be determined based on the multiple matching results.

[0071] In other embodiments of this application, by acquiring data from various dimensions of the asset, target detection information for all services provided by the asset can be generated. This target detection information can then be used to detect various services in various scenarios, thereby improving the accuracy and efficiency of service detection.

[0072] The information determination method provided in the embodiments of this application can generate target detection information for all services provided by an asset based on data from multiple dimensions of the asset. The method combines the target detection information with the target data of the asset for the pending access request when determining the target service of the asset. This achieves the goal of considering data from various dimensions of the asset when generating target detection information for services. This allows the generated target detection information to detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in related technologies. This solves the problem of low accuracy in service detection in related technologies.

[0073] Based on the foregoing embodiments, embodiments of this application provide an information determination method, referring to... Figure 2 As shown, the method may include the following steps:

[0074] Step 201: The information determination device obtains historical operational data of assets in the network system, first data of assets in response to historical access requests, and second data of assets in response to target access requests.

[0075] In the embodiments of this application, such as Figure 3The system corresponding to the device shown in the information determination can include a source data unit and an auxiliary unit. The source data unit includes initial operating data, first initial data, and second initial data. Specifically, the initial operating data of the asset, the first initial data of the asset for historical access requests, and the second initial data of the asset for target access requests can be obtained from the source data unit in the system corresponding to the information determination device. Then, the service name, service version, and corresponding operating system information in the initial operating data and the first initial data are marked to obtain historical operating data and the first data carrying the marks.

[0076] It should be noted that, as Figure 3 The information shown indicates that the system corresponding to the device also includes an auxiliary unit, which includes a request response module, a traffic acquisition module, and a log synchronization module. The traffic acquisition module is used to receive the first initial data of the asset for historical access requests and the second initial data for target access requests. The log synchronization module is used to receive the asset's security log (i.e., historical operation data).

[0077] Step 202: The information determination device generates initial detection information for the service based on historical operating data and the first data.

[0078] In this embodiment, the information determining device processes historical operating data and first data to obtain detection parameters for the service, and determines the detection method and detection type for the service. Then, it generates initial detection information by combining the detection parameters, detection method, and detection type. The detection parameters may refer to the detection fields required when detecting the service.

[0079] It should be noted that assets can provide a variety of different services through open-source frameworks, middleware, and application components. For each service, an initial detection information can be generated, meaning that one initial detection information corresponds to one service.

[0080] In this embodiment of the application, step 202 can be implemented through steps 202a to 202c:

[0081] Step 202a: The information determination device determines the target detection parameters for the service based on historical operating data and the first data.

[0082] In this embodiment, the information determination device can process historical operating data and first data to obtain multiple feature parameters of the service, and then filter these feature parameters to obtain target detection parameters. In one possible implementation, the multiple feature parameters of the service may refer to the service name, the operating system corresponding to the service, the port information corresponding to the service, the middleware providing the service, application plugins, and basic information of application components, etc.

[0083] In this embodiment of the application, step 202a can be implemented through steps 202a1 to 202a2:

[0084] Step 202a1: The information determination device processes the historical operating data and the first data to obtain multiple different characteristic parameters of the service.

[0085] In the embodiments of this application, such as Figure 3 As shown, the system corresponding to the information determining device also includes a data processing unit, which comprises a data initialization module and a data cleaning module. Specifically, the data initialization module is used to format the acquired historical or real-time data; the data cleaning module is used to filter out some abnormal data in the data obtained after formatting by the data initialization module.

[0086] In this embodiment, the historical operating data and the first data can first be formatted to convert them into data of a specified format. Then, the format-converted data is processed to obtain the transmission data corresponding to the service. Further processing of the transmission data yields multiple different characteristic parameters of the service. Specifically, the information determination device can first format the historical operating data and the first data through the data initialization module in the data processing unit, then filter out abnormal data from the formatted data through the data cleaning module, and finally process the filtered data using data processing tools to obtain the transmission data corresponding to the service. Here, the transmission data can refer to the specific data of the transmission protocol used when the asset provides the service.

[0087] In one possible implementation, the data processing tool could refer to software like Wireshark or a network data acquisition and analysis tool; the transmission protocol could include Hypertext Transfer Protocol (HTTP) and Transmission Control Protocol (TCP).

[0088] For example, if the transport protocol is HTTP, the data can be transmitted as follows:

[0089] POST / login.php HTTP / 1.1\r\n#Name of the transport protocol

[0090] Expert Info(Chat / Sequence):POST / login.php HTTP / 1.1\r\n

[0091] POST / hacker.php HTTP / 1.1\r\n

[0092] Severity level: Chat

[0093] Request Method: POST (HTTP Request Method)

[0094] Request URI: / hacker.php

[0095] Request Version: HTTP / 1.1

[0096] #HTTP header

[0097] User-Agent:Java / 1.8.0_112\r\n

[0098] Host:192.168.193.129:8080\r\n

[0099] Accept: text / html,image / gif,image / jpeg,*; q=.2,* / *; q=.2\r\n

[0100] Connection: keep-alive\r\n

[0101] #HTTP request body

[0102] Content-type: application / x-www-form-urlencoded\r\n#Payload information

[0103] Content-Length: 633\r\n

[0104] Content length: 633

[0105] Full request URI: http: / / 192.168.193.129 / hacker.php # Requested URL

[0106] HTTP request 1 / 1

[0107] Furthermore, based on the session identifier carried in the transmitted data, a clustering algorithm can be used to group the obtained transmitted data. This involves grouping data belonging to the same session together and deduplicating duplicate data within each request group based on network data attribute information. Then, the data in each group is arranged according to IP address and timing information to obtain a group of transmitted data with contextual relationships. Finally, a data parsing tool is used to process the obtained transmitted data to obtain multiple different feature parameters corresponding to different services. It should be noted that the network data attribute information can include the source IP address, destination IP address, source port number, destination port number, and the name of the transport protocol. The data parsing tool can refer to the PyShark module in Python. In one feasible approach, if the protocol corresponding to the service is Hypertext Transfer Protocol (HTTP), then duplicate data in each group needs to be deduplicated simultaneously based on the network data attribute information, the payload information in the HTTP request header, and the data in the HTTP request body.

[0108] In this embodiment of the application, different services and their corresponding feature parameters can be combined to form data for different services, and multiple data can be sent to the feature library in the knowledge base unit for storage.

[0109] Step 202a2: The information determination device determines the target detection parameters for the service from multiple different feature parameters.

[0110] In this embodiment, the frequency of each feature parameter of a service appearing in the transmitted data can be statistically analyzed, and the frequency of each feature parameter can be compared with a preset threshold. Then, based on the comparison results, feature parameters with frequencies higher than the preset threshold are selected from multiple different feature parameters. Specifically, feature parameters with frequencies higher than the preset threshold can be used as the final detection parameters (i.e., target detection parameters) for the service, while feature parameters with frequencies lower than the preset threshold are discarded. It should be noted that the determined target detection parameters can be different for different services.

[0111] Step 202b: The information determination device determines the target detection method and target detection type for the service.

[0112] Among them, the target detection type represents the type of data that can be detected.

[0113] In this embodiment, the target detection method can refer to the method of matching target data with data in a target database. In one possible implementation, the target detection method may include matching using regular expressions, matching using global matching, and / or matching using a uniform resource locator (URL); the target detection type may include string type and text type.

[0114] It should be noted that object detection methods also include other matching methods, which are not specifically limited here.

[0115] Step 202c: The information determination device generates initial detection information based on the target detection parameters, target detection method, and target detection type.

[0116] In one feasible approach, the initial detection information can be as shown in Table 1 below:

[0117]

[0118] Table 1

[0119] In Table 1, the detection parameters are the target detection parameters, including service name, service version, service description, and service reference information; the detection method is the target detection method, including regular expression, global matching, and URL matching; and the detection type is the target detection type, including string and text types. It should be noted that the fields in the initial detection information can be added or removed for different application scenarios. That is, the specific content in the detection parameters, detection method, and detection type can all be added or removed accordingly, and the fields in the initial detection information can also be changed according to user needs.

[0120] For example, the specific code for initial detection information can be as follows:

[0121]

[0122] :text=>'org.apache.struts.',},{:url=>' / ?actionErrors=notfoundnotfound',:regexp=> / (Struts Problem Report|org.apache.struts2|struts.devMode|struts-tags|There is no Actionmapped for namespace) / }]# Detection method (i.e., target detection method) and detection type (i.e., target detection type)

[0123] Step 203: The information determination device corrects the initial detection information based on the second data to obtain the target detection information.

[0124] In this embodiment, the second data can first be format-converted to a specified format. Then, the initial detection information is corrected based on the format-converted second data to obtain target detection information. Specifically, the information determination device can use the second data to verify the validity of multiple generated initial detection information sets and determine the final target detection information based on the verification results. Specifically, the second data can first be processed using data processing and data parsing tools to obtain processed second data. Then, the processed second data is matched with data in a feature library according to the initial detection information, and the initial detection information is adjusted based on the matching results to obtain the final multiple target detection information sets. It should be noted that the processed second data can include feature parameters from multiple different services. That is, during matching, the information determination device can match the processed second data with multiple different data sets in the feature library based on different initial detection information to determine multiple services.

[0125] Specifically, for initial detection information with high matching frequency and high recognition rate, the detection parameters and methods in the initial detection information can be adjusted, and the adjusted initial detection information can be used as the target detection information. In one feasible approach, the initial detection information can be adjusted by reducing the number of extra wildcard characters in the regular expression. It should be noted that matching frequency can refer to the ratio of the number of times a particular initial detection information is used during the matching process to the total number of times all initial detection information is used; recognition rate can refer to the ratio of the number of initial detection information pieces that ultimately detect the service to the total number of initial detection information pieces used during the matching process, and a high recognition rate can mean a recognition rate greater than 95%.

[0126] Correspondingly, initial detection information with high matching frequency and low recognition rate can be merged or directly deleted; while initial detection information with low matching frequency and high recognition rate does not need to be changed and can be directly used as target detection information; other initial detection information that is not used in the matching process is directly deleted.

[0127] Step 204: The information determination device obtains the target data of the asset for the access request to be processed, and processes the target data to obtain the processed target data.

[0128] In the embodiments of this application, such as Figure 3As shown, the auxiliary unit may also include a request-response module. Specifically, the information determination device can receive the asset's response data (i.e., target data) to the access request to be processed through the request-response module in the auxiliary unit. Then, the target data is formatted by the data initialization module, and abnormal data in the formatted target data is filtered by the data cleaning module in the data processing unit. Finally, the filtered target data is processed by data processing tools and data parsing tools to obtain processed target data with different characteristic parameters.

[0129] Step 205: The information determination device matches the processed target data with the data in the target database based on the target detection information.

[0130] In the embodiments of this application, such as Figure 3 As shown, the system corresponding to the information determination device may also include a knowledge base unit, which includes a feature base, a historical analysis base, and a classification knowledge base. The feature base is used to store data on various feature parameters of different services provided by different assets; the classification knowledge base is used to store service data indexed by each feature parameter of the service; and the historical analysis base is used to analyze target data that does not match the data in the target database and store the analysis results.

[0131] In this application embodiment, the target database may refer to, for example, Figure 3 The information shown determines the knowledge base unit in the system corresponding to the device. Specifically, the information determining device can use the service matching module in the data processing unit to match the feature parameters of the processed target data with the feature parameters of the data in the feature library of the knowledge base unit (i.e., the target database) based on the target detection information, and then determine the target service of the asset for the access request to be processed based on the matching result.

[0132] In the embodiments of this application, step 206 or steps 207 to 209 can be executed after step 205.

[0133] Step 206: If there is a first matching data in the target database that matches all the different feature parameters of the processed target data, the information determining device determines the service corresponding to the first matching data as the target service.

[0134] In the embodiments of this application, such as Figure 3The data processing unit may further include a service matching module. Specifically, the service matching module matches the target data of the acquired access request to be processed with data in the target database. Specifically, if the service matching module determines that multiple feature parameters of the processed target data match multiple feature parameters of a certain data in the feature library of the target database, then that data is the matching data that completely matches the target data (i.e., the first matching data), and the service corresponding to the first matching data can then be identified as the target service. In one possible implementation, if multiple feature parameters of the processed target data match multiple feature parameters of multiple data in the target database, then the service corresponding to each matching data can be identified as one of the multiple target services for the access request to be processed.

[0135] Step 207: If no matching data exists in the target database, the information determining device determines the number of feature parameters that do not match any feature parameter in the target database.

[0136] In this embodiment of the application, if there is no matching data in the feature library of the target database, the number of feature parameters that do not match the feature parameters of the data in the feature library can be determined from multiple different feature parameters of the target data. Specifically, if there is no matching data in the feature library that matches multiple feature parameters of the processed target data, that is, if there is a conflict between the processed target data and the data in the feature library, the information determining device can, as follows: Figure 3 The data classification module in the data processing unit shown divides the target data according to different feature parameters to obtain data corresponding to each feature parameter. Then, it identifies feature parameters that do not match the feature parameters of the data in the target database from multiple feature parameters and determines the number of mismatched feature parameters.

[0137] Step 208: The information determination device determines the target value based on the quantity.

[0138] In this embodiment, the target value can refer to the conflict coefficient. Specifically, the information determining device can determine the amount of target detection information used in the matching process. Then, the target value can be determined based on the number of mismatched feature parameters and the amount of target detection information used in the matching process. It should be noted that the conflict coefficient can characterize the degree of matching between the processed target data and the data in the target database.

[0139] In the embodiments of this application, step 209 or steps 210-211 can be executed after step 208.

[0140] Step 209: If the target value is less than or equal to the target threshold, the information determining device determines the first data to be matched from the target database and determines the service corresponding to the first data to be matched as the target service.

[0141] In this embodiment, after determining the target value, it can be compared with a target threshold. If the target value is less than or equal to the target threshold (i.e., the conflict coefficient is small), the information determining device can determine the data (i.e., the first data to be matched) whose feature parameters have been successfully matched from the classification knowledge base in the knowledge base unit (i.e., the target database). Then, the similarity between multiple first data to be matched and the processed target data can be calculated, and the data whose similarity meets the threshold can be used as the final first data to be matched. Finally, the service corresponding to the selected first data to be matched can be used as the final target service to be determined. It should be noted that the target threshold is set based on historical data and the actual application scenario.

[0142] In one feasible approach, if the processed target data includes three feature parameters: service version, service port, and the corresponding operating system, and no data matching the service version exists in the feature library, then it can be obtained from... Figure 3 The classification knowledge base in the target database shown selects data indexed by service port and corresponding operating system as the first matching data, and the service corresponding to the first matching data is selected as the final target service. The data indexed by service port includes not only the specific data of the service port, but also the specific data of the service version and the corresponding operating system; similarly, the data indexed by the corresponding operating system includes not only the specific data of the operating system, but also the specific data of the service version and the service port.

[0143] Step 210: If the target value is greater than the target threshold, the information determination device determines the second data to be matched from the target database based on the target value.

[0144] In this embodiment, if the target value is greater than the target threshold (i.e., the conflict coefficient is large), it indicates that there is no first matching data matching the target data in the classification knowledge base of the target database. In this case, the information determining device can select data that is close to the target value of the processed target data from the historical judgment database of each data in the knowledge base unit (i.e., the target database) as the second matching data. It should be noted that there can be multiple second matching data.

[0145] Step 211: The information determination device matches the second data to be matched with the processed target data based on the target detection information.

[0146] In this embodiment, the service matching module in the data processing unit can perform matching processing on the feature parameters of the processed target data and the feature parameters of the second data to be matched based on the target detection information, and then determine the target service for the access request to be processed based on the matching result.

[0147] In the embodiments of this application, step 212 or step 213 can be executed after step 211.

[0148] Step 212: If there is a second matching data in the second data to be matched that has different feature parameters that match the processed target data, the information determining device determines that the service corresponding to the second matching data is the target service.

[0149] In this embodiment of the application, if a certain data in the second data to be matched has a feature parameter that matches different feature parameters of the processed target data, then the information determining device will determine the service corresponding to that data (i.e. the second matching data) as the target service of the asset for the access request to be processed.

[0150] Step 213: If there is no second matching data in the second data to be matched, the information determining device uses a target self-learning algorithm to process the processed target data, obtain the target feature information of the processed target data, and store it in the target database.

[0151] In this embodiment of the application, if there is still no second matching data in the second data to be matched that completely matches the feature parameters of the processed target data, the information determining device will, as follows: Figure 3 The feature self-learning module in the data processing unit shown uses a self-learning algorithm to extract and learn features from the processed target data, that is, to mine the features of the target service, obtain the target feature information of the processed target data, and store the target feature information in the feature library of the target database to provide better data support for subsequent service detection.

[0152] In this embodiment of the application, during the service detection process, if there is no service matching the target data in the target database, the target value is calculated to perform a secondary detection on the target data, which significantly improves the accuracy of the target service detection.

[0153] In other embodiments of this application, the following steps may also be performed after step 213:

[0154] Step 214: The information determination device uses a target time series model to predict the target access data of the asset based on the target data.

[0155] In this embodiment, the target time series model can be used to predict access data of an asset over a future period (i.e., target access data). Target access data can be data generated after a target access operation is performed on the asset, and can include the number of times the asset is accessed, the login data of the user corresponding to the target access operation, and the address of the terminal corresponding to the target access operation. In one possible implementation, the target time series model can refer to an autoregressive moving average.

[0156]

[0157] In this embodiment of the application, an initial time series model can be trained to obtain a target time series model. Then, the information determination device can input the target data into the target time series model. After the target time series model processes the target data of the asset in response to the real-time access request, it can obtain the target access data of the asset.

[0158] In the embodiments of this application, such as Figure 4 The target time series model shown can be obtained through methods A1 to A4:

[0159] A1. Acquire threat intelligence data and Security Information and Event Management (SIEM) logs for assets. SIEM logs can be collected through a SIEM system. Threat intelligence data refers to potential or ongoing threat information targeting the assets. It should be noted that the information determination device can also acquire other information sources related to asset security information from other channels.

[0160] In one feasible approach, threat intelligence data for assets can be presented as shown in Table 2 below:

[0161]

[0162] Table 2

[0163] It should be noted that the threat intelligence data shown in Table 2 may include specific data such as the number, IP address, IP location, reverse lookup domain information, tag, intelligence data, and request parameters. Among them, the number may refer to the number of the threat event; the IP address may refer to the IP address that initiated the threat event; the IP location may refer to the specific location of the IP address corresponding to the threat event; the reverse lookup domain information may refer to the domain information of the physical device corresponding to the threat event; the tag refers to the type of threat event; the intelligence data may refer to data such as the time when the threat event occurred; and the request data may refer to the information of the request message sent to the asset.

[0164] In one feasible approach, the SIEM log of an asset can be as shown in Table 3 below:

[0165]

[0166] Table 3

[0167] It should be noted that the SIEM logs shown in Table 3 contain data related to attack events targeting assets. Here, "Number" refers to the attack event's ID; "Attack Time" refers to the time the attack occurred; "Attack Source" refers to the IP address that initiated the attack; "Attacked Domain" refers to the domain name of the asset attacked; "Attack Type" refers to the type of attack; "URL" refers to the URL corresponding to the attack; "Request Parameters" refers to the region where the IP address corresponding to the attack is located; "Severity Level" refers to the severity of the attack; and "Handling Action" refers to how the asset handled the attack.

[0168] A2. Process the historical operation data to obtain the asset access list; in one feasible way, the asset access list can be as shown in Table 4 below:

[0169] location Application Name Data Classification Description of sensitive information Sensitivity Level Terminal IP address ** ＊＊＊* A2-1 User access password Level 4 172.26.110.44 ** ＊＊＊* A1-5 User address Level 4 172.26.110.44 ** ＊＊＊* A1-2 User's mobile phone number, email address Level 2 172.26.110.44 ** ＊＊＊* C1-4 Location data Level 3 172.26.110.44

[0170] Table 4

[0171] It should be noted that the asset access list shown in Table 4 refers to the access data when accessing assets. The access list may include the location of the asset, the name of the application being accessed, the type of accessed data (data classification), the access information corresponding to the accessed data (sensitive information description), the importance of the accessed data (sensitivity level), and the IP address of the terminal corresponding to the access operation.

[0172] A3. Format the access list, SIEM logs, and threat intelligence data to obtain formatted data in a unified format. Then, perform clustering and association operations on the formatted data to associate the formatted data according to the time sequence information to obtain sample data.

[0173] The sample data is used to train the initial time series prediction model. Specifically, the sample data may include the number of times the asset was accessed in the past period, the login data of users who accessed the asset, and the address of the terminal corresponding to the access operation.

[0174] A4. Use sample data to train the initial time series model to obtain the target time series model.

[0175] In this embodiment, historical data from a pre-set database can be acquired and preprocessed to obtain processed data that meets the preset format requirements. Then, the stationarity of the processed data is checked. If the processed data is stationary, an initial time series model that meets expectations is constructed using autocorrelation and partial autocorrelation functions, combined with the Akaike information criterion (AIC) and the Bayesian information criterion (BIC). If the processed data is not stationary, differencing is performed on the processed data. If the data obtained after the difference operation is stationary, an initial time series model can be directly constructed using autocorrelation, partial autocorrelation functions, the AIC criterion, and the BIC criterion. If the data after the difference operation is still not stationary, differencing is continued until stationary data is obtained. A model can then be constructed based on the stationary data. Finally, the initial time series model can be trained using sample data to obtain the target time series model.

[0176] Step 215: The information determination device generates a risk access policy for the asset based on the target access data for the access request to be processed.

[0177] In the embodiments of this application, such as Figure 4 The information provided indicates that after determining the target access data for the asset, the device can generate an initial risk access policy for the access request to be processed. Subsequently, the initial risk access policy can be adjusted based on existing historical access policies to obtain the final risk access policy. In one feasible approach, the initial risk access policy can also be adjusted in conjunction with expert experience.

[0178] Step 216: The information determination device determines the risk assessment result of the asset for the access request to be processed based on the risk access policy, target access data and different characteristic parameters of the target service.

[0179] In the embodiments of this application, such as Figure 5 The information shown indicates that the device can first determine the target risk value of the access request to be processed based on the target risk database, target access data, and multiple different characteristic parameters of the target service, then determine the target trust level of the access request to be processed, and finally combine the target risk value, target trust level, and generated risk access policy to determine the final risk assessment result.

[0180] In this embodiment of the application, step 216 can be implemented through steps 216a to 216c:

[0181] Step 216a: The information determination device determines the target risk value of the access request to be processed based on the target access data, the different characteristic parameters of the target service, and the target risk database.

[0182] In this embodiment, the information determination device can determine a first risk value for the user corresponding to the target access operation and a second risk value for the terminal corresponding to the target access operation based on the target access data and the target risk database. Then, it can determine a third risk value for the target service based on different characteristic parameters of the target service and the target risk database. Finally, the first, second, and third risk values ​​can be multiplied by their corresponding weights to obtain the final target risk value for the access request to be processed. It should be noted that the target risk database is pre-set according to the actual application scenario; the weights can be set based on historical data and the actual application scenario.

[0183] Step 216b: The information determination device determines the target trust level of the access request to be processed.

[0184] In this context, target trust level can refer to the degree to which an asset trusts the access request being processed.

[0185] In this embodiment, the information determination device can determine the target trust level of an asset for a pending access request from a target information database. It should be noted that the target information database is pre-set according to the actual application scenario.

[0186] Step 216c: The information determination device determines the risk assessment result of the asset for the pending access request based on the risk access policy, target risk value, and target trust level.

[0187] In this embodiment of the application, the information determination device can combine the generated risk access policy, the target risk value of the pending access request, and the target trust level of the pending access request to determine the risk assessment result of the asset for the pending access request.

[0188] The information determination method provided in the embodiments of this application can generate target detection information for all services provided by an asset based on data from multiple dimensions of the asset. The method combines the target detection information with the target data of the asset for the pending access request when determining the target service of the asset. This achieves the goal of considering data from various dimensions of the asset when generating target detection information for services. This allows the generated target detection information to detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in related technologies. This solves the problem of low accuracy in service detection in related technologies.

[0189] Based on the foregoing embodiments, this application provides an information determining device, which can be applied to... Figures 1-2 In the information determination method provided in the corresponding embodiment, refer to Figure 6 As shown, the information determining device 3 may include: an acquisition unit 31, a processing unit 32, and a determining unit 33, wherein:

[0190] Acquisition unit 31 is used to acquire historical operation data of assets in the network system, first data of assets in response to historical access requests, and second data of assets in response to target access requests;

[0191] Processing unit 32 is used to generate target detection information for a service based on historical operating data, first data, and second data; wherein the service is a service provided by the asset.

[0192] The determining unit 33 is used to acquire the target data of the asset for the pending access request, and based on the target data and target detection information, determine the target service of the asset for the pending access request from the target database.

[0193] In other embodiments of this application, the processing unit 32 is further configured to perform the following steps:

[0194] Based on historical operational data and initial data, generate initial detection information for the service;

[0195] The initial detection information is corrected based on the second data to obtain the target detection information.

[0196] In other embodiments of this application, the processing unit 32 is further configured to perform the following steps:

[0197] Based on historical operational data and initial data, determine the target detection parameters for the service;

[0198] Determine the target detection method and target detection type for the service; whereby the target detection type represents the type of data that can be detected.

[0199] Initial detection information is generated based on target detection parameters, target detection method, and target detection type.

[0200] In other embodiments of this application, the processing unit 32 is further configured to perform the following steps:

[0201] By processing historical operational data and initial data, multiple different characteristic parameters of the service are obtained;

[0202] Determine the target detection parameters for the service from multiple different feature parameters.

[0203] In other embodiments of this application, the determining unit 33 is further configured to perform the following steps:

[0204] The target data is processed to obtain the processed target data;

[0205] Based on the target detection information, the processed target data is matched with the data in the target database;

[0206] If the target database contains first matching data whose different feature parameters all match the processed target data, then the service corresponding to the first matching data is determined to be the target service.

[0207] In other embodiments of this application, the determining unit 33 is further configured to perform the following steps:

[0208] If no matching data exists in the target database, determine the number of feature parameters that do not match any feature parameter in the target database.

[0209] Determine the target value based on the quantity;

[0210] If the target value is less than or equal to the target threshold, the first data to be matched is determined from the target database, and the service corresponding to the first data to be matched is determined as the target service.

[0211] In other embodiments of this application, the determining unit 33 is further configured to perform the following steps:

[0212] If the target value is greater than the target threshold, the second data to be matched is determined from the target database based on the target value;

[0213] Based on the target detection information, the second data to be matched and the processed target data are matched.

[0214] If there is a second matching data in the second data to be matched that matches all different feature parameters, then the service corresponding to the second matching data is determined to be the target service;

[0215] If there is no second matching data in the second data to be matched, the target self-learning algorithm is used to process the processed target data to obtain the target feature information of the processed target data and store it in the target database.

[0216] In other embodiments of this application, the determining unit 33 is further configured to perform the following steps:

[0217] Based on the target data, a target time series model is used to predict the target access data of the asset.

[0218] Generate risk access policies for assets based on pending access requests, using the target access data.

[0219] Based on the risk access strategy, target access data, and different characteristic parameters of the target service, the risk assessment results of the asset for the access request to be processed are determined.

[0220] In other embodiments of this application, the determining unit 33 is further configured to perform the following steps:

[0221] Based on the target access data, the different characteristic parameters of the target service, and the target risk database, determine the target risk value of the access request to be processed.

[0222] Determine the target trust level for the pending access requests;

[0223] Based on the risk access strategy, target risk value, and target trust level, determine the risk assessment results of the asset for the pending access request.

[0224] It should be noted that a detailed explanation of the steps performed by each unit can be found in [reference needed]. Figures 1-2 The information determination method provided in the corresponding embodiments will not be described again here.

[0225] The information determination apparatus provided in the embodiments of this application can generate target detection information for all services provided by an asset based on data from multiple dimensions of the asset. The determination of the target service for a pending access request is achieved by combining the target detection information with the target data of the asset for the pending access request. This ensures that the target detection information for services is generated by considering data from various dimensions of the asset. This allows the generated target detection information to detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in related technologies. This solves the problem of low accuracy in service detection in related technologies.

[0226] Based on the foregoing embodiments, embodiments of this application provide an information determining device, which can be applied to... Figures 1-2 In the information determination method provided in the corresponding embodiment, refer to Figure 7 As shown, the information determining device 4 may include: a processor 41, a memory 42, and a communication bus 43, wherein:

[0227] Communication bus 43 is used to realize the communication connection between processor 41 and memory 42;

[0228] The processor 41 is used to execute the information determination program in the memory 42 to perform the following steps:

[0229] Acquire historical operational data of assets in the network system, first data of assets in response to historical access requests, and second data of assets in response to target access requests;

[0230] Based on historical operational data, first data, and second data, target detection information for the service is generated; where the service is the service provided by the asset.

[0231] Obtain the target data of the asset for the pending access request, and based on the target data and target detection information, determine the target service of the asset for the pending access request from the target database.

[0232] In other embodiments of this application, processor 41 is used to execute an information determination program in memory 42 to generate target detection information for a service based on historical running data, first data, and second data, in order to implement the following steps:

[0233] Based on historical operational data and initial data, generate initial detection information for the service;

[0234] The initial detection information is corrected based on the second data to obtain the target detection information.

[0235] In other embodiments of this application, processor 41 is used to execute an information determination program in memory 42 to generate initial detection information for the service based on historical running data and first data, in order to implement the following steps:

[0236] Based on historical operational data and initial data, determine the target detection parameters for the service;

[0237] Determine the target detection method and target detection type for the service; whereby the target detection type represents the type of data that can be detected.

[0238] Initial detection information is generated based on target detection parameters, target detection method, and target detection type.

[0239] In other embodiments of this application, processor 41 is configured to execute an information determination program stored in memory 42 to determine target detection parameters for a service based on historical running data and first data, in order to implement the following steps:

[0240] By processing historical operational data and initial data, multiple different characteristic parameters of the service are obtained;

[0241] Determine the target detection parameters for the service from multiple different feature parameters.

[0242] In other embodiments of this application, processor 41 is configured to execute an information determination program in memory 42 to determine the target service of an asset for a pending access request from a target database based on target data and target detection information, in order to perform the following steps:

[0243] The target data is processed to obtain the processed target data;

[0244] Based on the target detection information, the processed target data is matched with the data in the target database;

[0245] If the target database contains first matching data whose different feature parameters all match the processed target data, then the service corresponding to the first matching data is determined to be the target service.

[0246] In other embodiments of this application, the processor 41 is used to execute an information determination program in the memory 42 to perform the following steps:

[0247] If no matching data exists in the target database, determine the number of feature parameters that do not match any feature parameter in the target database.

[0248] Determine the target value based on the quantity;

[0249] If the target value is less than or equal to the target threshold, the first data to be matched is determined from the target database, and the service corresponding to the first data to be matched is determined as the target service.

[0250] In other embodiments of this application, the processor 41 is used to execute an information determination program in the memory 42 to perform the following steps:

[0251] If the target value is greater than the target threshold, the second data to be matched is determined from the target database based on the target value;

[0252] Based on the target detection information, the second data to be matched and the processed target data are matched.

[0253] If there is a second matching data in the second data to be matched that matches all different feature parameters, then the service corresponding to the second matching data is determined to be the target service;

[0254] If there is no second matching data in the second data to be matched, the target self-learning algorithm is used to process the processed target data to obtain the target feature information of the processed target data and store it in the target database.

[0255] In other embodiments of this application, the processor 41 is used to execute an information determination program in the memory 42 to perform the following steps:

[0256] Based on the target data, a target time series model is used to predict the target access data of the asset.

[0257] Generate risk access policies for assets based on pending access requests, using the target access data.

[0258] Based on the risk access strategy, target access data, and different characteristic parameters of the target service, the risk assessment results of the asset for the access request to be processed are determined.

[0259] In other embodiments of this application, the processor 41 is used to execute an information determination program in the memory 42 to perform the following steps:

[0260] Based on the target access data, the different characteristic parameters of the target service, and the target risk database, determine the target risk value of the access request to be processed.

[0261] Determine the target trust level for the pending access requests;

[0262] Based on the risk access strategy, target risk value, and target trust level, determine the risk assessment results of the asset for the pending access request.

[0263] It should be noted that a detailed description of the steps performed by the processor can be found in [reference needed]. Figures 1-2 The information determination method provided in the corresponding embodiments will not be described again here.

[0264] The information determination device provided in the embodiments of this application can generate target detection information for all services provided by an asset based on data from multiple dimensions of the asset. The determination of the target service for a pending access request is achieved by combining the target detection information with the target data of the asset for the pending access request. This ensures that the target detection information for services is generated by considering data from various dimensions of the asset. This allows the generated target detection information to detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in related technologies. This solves the problem of low accuracy in service detection in related technologies.

[0265] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement... Figures 1-2 The corresponding embodiments provide the steps of the information determination method.

[0266] Based on the foregoing embodiments, embodiments of this application provide a computer program product, which includes a computer program that is implemented when executed by processor 41. Figures 1-2 The corresponding embodiments provide the steps of the information determination method.

[0267] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0268] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0269] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0270] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0271] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for determining information, characterized in that, The method includes: Acquire historical operational data of assets in the network system, first data of the assets in response to historical access requests, and second data of the assets in response to target access requests; Based on the historical operational data, the first data, and the second data, target detection information for the service is generated; wherein, the service is a service provided by the asset. Obtain the target data of the asset for the pending access request, and based on the target data and the target detection information, determine the target service of the asset for the pending access request from the target database.

2. The method according to claim 1, characterized in that, The step of generating target detection information for the service based on the historical operational data, the first data, and the second data includes: Based on the historical operational data and the first data, initial detection information for the service is generated. The initial detection information is corrected based on the second data to obtain the target detection information.

3. The method according to claim 2, characterized in that, The step of generating initial detection information for the service based on the historical operational data and the first data includes: Based on the historical operation data and the first data, the target detection parameters for the service are determined; Determine the target detection method and target detection type for the service; wherein, the target detection type represents the type of data that can be detected; The initial detection information is generated based on the target detection parameters, the target detection method, and the target detection type.

4. The method according to claim 3, characterized in that, The step of determining the target detection parameters for the service based on the historical operating data and the first data includes: The historical operation data and the first data are processed to obtain multiple different characteristic parameters of the service; Target detection parameters for the service are determined from the plurality of different feature parameters.

5. The method according to claim 1, characterized in that, The step of determining the target service of the asset for the pending access request from the target database based on the target data and the target detection information includes: The target data is processed to obtain the processed target data; Based on the target detection information, the processed target data and the data in the target database are matched. If the target database contains first matching data whose different feature parameters all match the processed target data, the service corresponding to the first matching data is determined to be the target service.

6. The method according to claim 5, characterized in that, The method further includes: If the matching data does not exist in the target database, determine the number of feature parameters that do not match any feature parameter in the target database among the different feature parameters; The target value is determined based on the quantity; If the target value is less than or equal to the target threshold, a first data to be matched is determined from the target database, and the service corresponding to the first data to be matched is determined to be the target service.

7. The method according to claim 6, characterized in that, The method further includes: If the target value is greater than the target threshold, a second data to be matched is determined from the target database based on the target value; Based on the target detection information, the second data to be matched and the processed target data are matched. If there is second matching data in the second data to be matched that matches all the different feature parameters, then the service corresponding to the second matching data is determined to be the target service; If the second matching data does not exist in the second data to be matched, the target self-learning algorithm is used to process the processed target data to obtain the target feature information of the processed target data and store it in the target database.

8. The method according to claim 1, characterized in that, The method further includes: Based on the target data, a target time series model is used to predict the target access data of the asset; Based on the target access data, generate a risk access strategy for the asset in response to the pending access request; Based on the risk access policy, the target access data, and the different characteristic parameters of the target service, the risk assessment result of the asset for the pending access request is determined.

9. The method according to claim 8, characterized in that, The process of determining the risk assessment result of the asset for the pending access request based on the risk access policy, the target access data, and different characteristic parameters of the target service includes: Based on the target access data, the different characteristic parameters of the target service, and the target risk database, the target risk value of the access request to be processed is determined. Determine the target trust level of the access request to be processed; Based on the risk access policy, the target risk value, and the target trust level, the risk assessment result of the asset for the pending access request is determined.

10. An information determining device, characterized in that, The device includes: The acquisition unit is used to acquire historical operational data of assets in the network system, first data of the assets in response to historical access requests, and second data of the assets in response to target access requests. The processing unit is configured to generate target detection information for the service based on the historical operating data, the first data, and the second data; wherein the service is a service provided by the asset. The determining unit is used to acquire the target data of the asset for the pending access request, and based on the target data and the target detection information, determine the target service of the asset for the pending access request from the target database.

11. An information determining device, characterized in that, The device includes: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information determination program in the memory to implement the steps of the information determination method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the information determination method as described in any one of claims 1 to 9.

13. A computer program product, the computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the information determination method according to any one of claims 1 to 9.

Images