Network attack surface discovery method and device, electronic equipment and readable storage medium

Abstract

The invention provides a network attack surface discovery method and device, electronic equipment and a readable storage medium, and the method comprises the steps: obtaining a public network IP, security group information bound with the public network IP, domain name information and a monitoring port, and determining an externally exposed port of the public network IP based on the monitoring port and the security group information; and determining an asset target based on the domain name information and the external exposure port, and performing application information scanning on the asset target to obtain application information, vulnerability information and a risk level. And forming a network attack surface based on the asset target, the application information, the vulnerability information and the risk level. In the scheme, the asset target is determined based on the security group information, the monitoring port and the like, and then the network attack surface is constructed for the asset target, so that the comprehensiveness, timeliness and accuracy of the network attack surface can be guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack surface discovery method, device, electronic device and readable storage medium. Background Art

[0002] Discovery of network attack surfaces is fundamental to ensuring network security and can provide organizations with a comprehensive security perspective, enabling them to take appropriate measures to protect their information systems and data. By discovering network attack surfaces, organizations can identify and assess the security risks they face, thereby better understanding the types of attacks they may suffer and their potential impact. In addition, network attack surface discovery can help organizations optimize the use of security resources and allocate priority resources by prioritizing the most critical assets and vulnerabilities. Therefore, discovery of network attack surfaces is very important in network security.

[0003] In the existing technology, in the network attack surface discovery implementation method, known network asset information is used to locate cloud asset information to determine the target asset, and then vulnerability scanning rules, sensitive data leakage detection rules, permission anomaly detection rules, etc. are used to judge the risk of the target asset to form a network attack surface. The method used in the existing technology needs to determine which cloud assets are target assets based on known asset information, which relies on the comprehensiveness and timeliness of known asset information, resulting in the defect of not being able to completely locate all cloud assets, and the composition of the attack surface is also lacking in practicality. Summary of the invention

[0004] The objectives of the present invention include providing a network attack surface discovery method, device, electronic device and readable storage medium, which can ensure the comprehensiveness, timeliness and accuracy of the network attack surface.

[0005] The embodiments of the present invention can be implemented as follows:

[0006] In a first aspect, the present invention provides a network attack surface discovery method, the method comprising:

[0007] Obtain the public IP, security group information, domain name information and listening port bound to the public IP;

[0008] Determine the externally exposed port of the public IP based on the listening port and the security group information;

[0009] Determine an asset target based on the domain name information and the externally exposed port;

[0010] Perform application information scanning on the asset target to obtain application information, vulnerability information and risk level;

[0011] A network attack surface is formed based on the asset targets, application information, vulnerability information and risk levels.

[0012] In an optional implementation, the security group information includes a destination port;

[0013] The step of determining the externally exposed port of the public IP based on the listening port and the security group information includes:

[0014] Compare the listening port with the destination port in the security group information to determine a target listening port that is consistent with the destination port and exists in the listening port;

[0015] Determine that the target listening port is the externally exposed port of the public IP.

[0016] In an optional implementation, the step of determining the asset target based on the domain name information and the externally exposed port includes:

[0017] Get the first correspondence between the public network IP and the externally exposed port;

[0018] Based on the domain name information and the public IP, obtain a second correspondence between the domain name and the public IP;

[0019] Based on the first correspondence and the second correspondence, obtaining a third correspondence between the domain name and the externally exposed port;

[0020] An asset target is determined based on the first corresponding relationship and the third corresponding relationship.

[0021] In an optional embodiment, the method further comprises:

[0022] The asset target is monitored, and if it is detected that the application information of the asset target changes, an alarm notification message is generated.

[0023] In an optional embodiment, the method further comprises:

[0024] Obtain new vulnerability intelligence information, and determine whether the application corresponding to the application information is affected based on the new vulnerability intelligence information;

[0025] If it is determined that the application is affected, an alarm prompt message is generated.

[0026] In an optional embodiment, the method further comprises:

[0027] Detecting whether the risk level of each application corresponding to the application information is higher than a preset level;

[0028] If there is an application whose risk level is higher than the preset level, the application is determined as a high-risk application and an alarm prompt information is generated.

[0029] In an optional implementation, the step of obtaining the listening port includes:

[0030] Determine the device type of the device bound to the public IP;

[0031] When the device type is a cloud virtual machine type, determining the default port as a listening port;

[0032] When the device type is a cloud load balancing device type, the monitoring port is obtained through external monitoring conditions.

[0033] In a second aspect, the present invention provides a network attack surface discovery device, the device comprising:

[0034] An acquisition module is used to obtain the public IP, the security group information bound to the public IP, the domain name information and the listening port;

[0035] A determination module, used to determine the externally exposed port of the public IP based on the listening port and the security group information;

[0036] The determination module is further used to determine the asset target based on the domain name information and the externally exposed port;

[0037] A scanning module, used to scan the asset target for application information to obtain application information, vulnerability information and risk level;

[0038] A building module is used to construct a network attack surface based on the asset target, application information, vulnerability information and risk level.

[0039] In a third aspect, the present invention provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to implement the network attack surface discovery method as described in any one of the aforementioned embodiments.

[0040] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement a network attack surface discovery method as described in any one of the foregoing embodiments.

[0041] The beneficial effects of the embodiments of the present invention include, for example:

[0042] The present invention provides a network attack surface discovery method, device, electronic device and readable storage medium, which obtains the public IP, the security group information, domain name information and listening port bound to the public IP, and determines the externally exposed port of the public IP based on the listening port and security group information. The asset target is determined based on the domain name information and the externally exposed port, and the application information of the asset target is scanned to obtain the application information, vulnerability information and risk level. The network attack surface is constructed based on the asset target, application information, vulnerability information and risk level. In this solution, the asset target is determined based on the security group information and the listening port, and then the network attack surface is constructed for the asset target, which can ensure the comprehensiveness, timeliness and accuracy of the network attack surface. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0044] Figure 1 A flowchart of a network attack surface discovery method provided by an embodiment of the present invention;

[0045] Figure 2 for Figure 1 A flowchart of the sub-steps included in S12;

[0046] Figure 3 for Figure 1 A flowchart of the sub-steps included in S13;

[0047] Figure 4 A flowchart of an alarm method in a network attack surface discovery method provided by an embodiment of the present invention;

[0048] Figure 5 Another flow chart of the alarm method in the network attack surface discovery method provided by the embodiment of the present invention;

[0049] Figure 6 A functional module block diagram of a network attack surface discovery device provided by an embodiment of the present invention;

[0050] Figure 7 This is a structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0052] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0054] In the description of the present invention, it should be noted that the terms “first”, “second”, etc., if used, are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0055] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0056] See also Figure 1 , is a flow chart of a network attack surface discovery method provided by an embodiment of the present invention, the network attack surface discovery method can be implemented by a network attack surface discovery device, the network attack surface discovery device can be implemented by software and / or hardware, and can be configured in an electronic device, the electronic device can be a computer device, a server, etc. The detailed steps of the network attack surface discovery method are introduced as follows.

[0057] S11, obtain the public IP, the security group information, domain name information and listening port bound to the public IP.

[0058] S12: Determine the externally exposed port of the public IP based on the listening port and the security group information.

[0059] S13: determining an asset target based on the domain name information and the externally exposed port.

[0060] S14, performing application information scanning on the asset target to obtain application information, vulnerability information and risk level.

[0061] S15, constructing a network attack surface based on the asset targets, application information, vulnerability information and risk levels.

[0062] In this embodiment, relevant information is obtained through the public cloud API (Application Programming Interface) and private cloud API used by the enterprise, including the public IP, security group information bound to the public IP, domain name information, and listening port. Among them, the security group can be understood as a virtual firewall for controlling inbound and outbound traffic. The security group contains a series of rules that define the traffic that is allowed or denied to flow into and out of the network resources associated with it. These rules in the security group can be understood as security group information, which includes source address, destination port, protocol, and action release.

[0063] The source address refers to the source address of the access request, such as 0.0.0.0. The destination port refers to the port that can be accessed, such as port 80 and port 443. The protocol refers to the supported protocol type, such as TCP, UDP, etc.

[0064] Action release means allowing specific network traffic to pass through security group rules. When the action of a security group rule is set to "release", traffic that meets the relevant rules will be allowed to pass through the security group and reach or leave the network resources associated with it. For example, it includes inbound rule release, which allows traffic on the external network or the Internet to enter the instance associated with the security group, for example, release inbound traffic on TCP port 22 to allow SSH remote login. In addition, it also includes outbound rule release, which allows instances associated with the security group to initiate traffic to the external network or the Internet, such as releasing all outbound traffic to allow instances to access Internet resources.

[0065] The security group information includes the destination port. The externally exposed port of the public IP is the port that matches the listening port and the destination port. Figure 2 When determining the externally exposed port of the public IP based on the listening port and security group information, it can be achieved in the following ways:

[0066] S121, comparing the listening port with the destination port in the security group information, and determining a target listening port in the listening port that is consistent with the destination port.

[0067] S122, determining that the target listening port is the externally exposed port of the public IP.

[0068] In this embodiment, assuming that the destination ports in the security group information include 80 and 443, and the obtained listening ports are 80 and 4443, after comparing the listening port with the destination port, it is determined that port 80 is the listening port that is consistent with the destination port, and the listening port 80 can be determined as the target listening port. That is, the externally exposed port of the public IP includes port 80.

[0069] Assuming that the public IP is 125.123.12.9 and the source address is 0.0.0.0, based on the above, we can get the result: the source address 0.0.0.0 can access port 80 monitored by the public IP 125.123.12.9.

[0070] Based on the above comparison rules, all externally exposed ports of the public IP can be determined.

[0071] The existing technology constructs a network attack surface based on known assets. This approach relies on the comprehensiveness of known assets and can easily lead to defects in the constructed network attack surface due to the incomplete and untimely determination of known assets.

[0072] In this embodiment, the asset target is determined based on the externally exposed port of the public network IP and the domain name information in the security group information. In this way, the determined asset target is consistent with the actual assets of the enterprise, thereby building a more comprehensive and timely network attack surface.

[0073] After determining the asset target, perform application information scanning. You can use security risk scanners for scanning, including Nessus, OpenVAS, Qualys, etc. Among them, Nessus is a widely used vulnerability scanner that can detect multiple types of vulnerabilities. OpenVAS is an open source vulnerability scanner and management system. Qualys can provide cloud-based vulnerability management and compliance solutions.

[0074] By scanning the asset target, application information, vulnerability information and risk level are obtained, where application information includes weblogic, nginx, etc. The risk level can be set based on demand, for example, it can be divided into severe, high risk, medium risk, low risk, etc.

[0075] Finally, the network attack surface can be constructed based on the asset targets, application information, vulnerability information and risk levels determined above.

[0076] The network attack surface discovery method provided in this embodiment can determine asset targets based on security group information and listening ports, and then build a network attack surface for the asset targets, which can ensure the comprehensiveness, timeliness and accuracy of the network attack surface.

[0077] In this embodiment, in the above step of obtaining the listening port bound to the public network IP, it can be achieved in the following way:

[0078] Determine the device type of the device to which the public IP is bound; when the device type is a cloud virtual machine type, determine the default port as the listening port; when the device type is a cloud load balancing device type, obtain the listening port through external monitoring conditions.

[0079] In this embodiment, the device types of the device bound to the public network IP include cloud virtual machines and cloud load balancing device types. Among them, cloud virtual machines are virtual computing resources in a cloud environment, allowing users to quickly deploy and run applications in a cloud environment. Users can choose different configurations according to their needs, such as CPU, memory, storage, and operating system. Flexible and scalable computing capabilities can be provided.

[0080] Cloud load balancing device type is a service that can distribute incoming network traffic to multiple backend servers, which can improve the access speed and availability of applications. At the same time, it can also eliminate single points of failure through load balancing to ensure business continuity and stability.

[0081] If the public IP is bound to a cloud virtual machine, the default port is used as the listening port, where the default port is the port with the listening IP of 0.0.0.0. If the public IP is bound to a cloud load balancing device, the external listening port can be determined based on relevant methods. For example, you can use system commands such as netstat and ss commands to view all listening ports and their status on the current system, or you can use network scanning tools to scan the ports developed by the public IP, or you can log in to the cloud service provider's console to view the security group or network ACL settings to determine the external listening port.

[0082] In this embodiment, by first determining the device type of the device bound to the public IP as described above, the externally exposed port can be directly determined when the device type is a cloud virtual machine, which can greatly reduce the workload in determining the externally exposed port and improve the efficiency of discovery.

[0083] On this basis, the externally exposed port is determined based on the listening port and the destination port in the security group information, and the asset target is determined based on the domain name information and the externally exposed port. Figure 3 In this embodiment, the step of determining the asset target can be achieved by:

[0084] S131, obtaining a first correspondence between a public network IP and an externally exposed port.

[0085] S132: Based on the domain name information and the public IP, obtain a second corresponding relationship between the domain name and the public IP.

[0086] S133: Based on the first correspondence and the second correspondence, obtain a third correspondence between the domain name and the externally exposed port.

[0087] S134: Determine an asset target based on the first corresponding relationship and the third corresponding relationship.

[0088] In this embodiment, an association between a public network IP and an externally exposed port may be established. For example, the association may be in the form of public network IP: externally exposed port, and the association may be saved in the form of a list.

[0089] Assuming that the public IP is 125.123.12.9 and the externally exposed port is 80, the first corresponding relationship is 125.123.12.9:80.

[0090] In addition, a second corresponding relationship between the domain name and the public network IP is obtained, wherein the domain name can be screened out in a variety of ways, including enabling resolution, cname record, A record and other screening methods.

[0091] The second correspondence between the domain name and the public IP address can be constructed in the form of www.example.com:125.123.12.9. The second correspondence between the domain name and the public IP address can also be saved in the form of a list.

[0092] Since the first correspondence between the public IP and the externally exposed port and the second correspondence between the domain name and the public IP are obtained, the third correspondence between the domain name and the externally exposed port can be obtained based on the public IP.

[0093] Since the number of correspondences between public IP addresses and externally exposed ports is generally greater than the number of correspondences between domain names and public IP addresses, after the above processing, the third correspondence between domain names and externally exposed ports can be obtained, and some first correspondences between public IP addresses and externally exposed ports remain.

[0094] In this embodiment, the third correspondence between the domain name and the externally exposed port and the first correspondence between the remaining public network IP and the externally exposed port are used as asset targets, and the asset targets are scanned to form a network attack surface. When scanning, a variety of different scanners can be used for scanning.

[0095] In this embodiment, the network attack surface includes asset targets, application information, vulnerability information and risk level. Figure 4 In order to avoid the risk of high-risk applications being vulnerable to attacks, the network attack surface discovery method provided in this embodiment may also include the following steps:

[0096] S21, detecting whether the risk level of each application corresponding to the application information is higher than a preset level.

[0097] S22: If there is an application whose risk level is higher than the preset level, the application is determined as a high-risk application and an alarm prompt message is generated.

[0098] In this embodiment, the preset level can be set based on demand, and by comparing the risk level of each application with the preset level, high-risk applications can be screened out, such as one or more of mysql, redis, mongodb, es, kibana, k8s api, docker api, rdp, ssh, and socks proxy. Then, alarms can be issued for these high-risk applications.

[0099] In this embodiment, the above-mentioned processes such as asset target discovery and application scanning will continue to be executed for a period of time. After the application information of the asset target corresponding to the externally exposed port is determined, the application information may change subsequently.

[0100] Based on this, the network attack surface discovery method provided in this embodiment may also include the following steps:

[0101] The asset target is monitored, and if it is detected that the application information of the asset target changes, an alarm notification message is generated.

[0102] In this embodiment, based on the determination of externally exposed ports, action release (including released ports), corresponding information of asset targets, etc., if a change in application information is detected, an alarm is issued to avoid the situation where the released ports are mapped to abnormal business applications.

[0103] In this embodiment, you can also use the cloud API interface to log in to the cloud service provider's console and view the audit security group change log. If you find that there are new additions, deletions, or modifications to the security group rules, an alarm notification message can be generated.

[0104] In addition, although the vulnerability information can be determined by scanning with a scanner, new vulnerabilities may exist in actual situations. Based on this consideration, please refer to Figure 5 The network attack surface discovery method provided in this embodiment may further include the following steps:

[0105] S31, obtaining new vulnerability intelligence information, and determining whether the new vulnerability intelligence information has an impact on the application corresponding to the application information.

[0106] S32: If it is determined that the application is affected, an alarm prompt message is generated.

[0107] In this embodiment, new vulnerability intelligence information can be obtained through the threat intelligence system. The threat intelligence system is a security solution that integrates multiple security technologies and analysis methods, mainly including data collection, data processing and analysis, intelligence production, intelligence sharing and distribution. During the data collection process, information can be collected from multiple sources, including public sources, commercial intelligence sources, social media, technical forums, dark web, etc., and real-time data is collected using tools such as sensors, honeypots, and network traffic analysis. During the data processing and analysis process, the collected data is cleaned, normalized, and relationship analyzed, and machine learning and artificial intelligence algorithms are applied to identify potential threat patterns. In the intelligence production process, the analysis results are converted into actionable intelligence reports, and they are classified and prioritized according to the severity and likelihood of the threats. In the intelligence sharing and distribution process, threat intelligence is shared with teams or other organizations, using standard formats such as STIX and TAXII to promote the exchange of intelligence.

[0108] When judging whether new vulnerability intelligence information has an impact on an application, it is mainly based on whether the new vulnerability intelligence information involves the corresponding application. For example, if the new vulnerability intelligence information indicates that a certain version of a certain application has a certain vulnerability, it is determined that the new vulnerability intelligence information has an impact on the application. In this case, an alarm prompt information is generated.

[0109] The network attack surface discovery method provided in this embodiment can use the public cloud API and private cloud API interface capabilities to regularly obtain asset information, and realize network attack surface discovery in combination with vulnerability scanning, thereby ensuring the timeliness, accuracy and comprehensiveness of the network attack surface.

[0110] In addition, it can regularly monitor changes in asset information, identify exposed high-risk application information, analyze it in conjunction with the threat intelligence system, and promptly alert relevant personnel for verification.

[0111] Based on the same inventive concept, please refer to Figure 6 , shows a schematic diagram of the functional modules of the network attack surface discovery device provided by an embodiment of the present invention. This embodiment can divide the functional modules of the network attack surface discovery device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules.

[0112] It should be noted that the division of modules in the embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. For example, in the case of dividing each functional module according to each function, Figure 6The network attack surface discovery device shown is only a schematic diagram of a device. The network attack surface discovery device may include an acquisition module, a determination module, a scanning module and a construction module. The functions of each functional module of the network attack surface discovery device are described in detail below.

[0113] An acquisition module is used to obtain the public IP, the security group information bound to the public IP, the domain name information and the listening port;

[0114] It can be understood that the acquisition module can be used to execute the above S11. The detailed implementation of the acquisition module can refer to the above content related to S11.

[0115] A determination module, used to determine the externally exposed port of the public IP based on the listening port and the security group information;

[0116] The determination module is further used to determine the asset target based on the domain name information and the externally exposed port;

[0117] It can be understood that the determination module can be used to execute the above S12 and S13. The detailed implementation of the determination module can refer to the above contents related to S12 and S13.

[0118] A scanning module, used to scan the asset target for application information to obtain application information, vulnerability information and risk level;

[0119] It can be understood that the scanning module can be used to execute the above S14. The detailed implementation of the scanning module can refer to the above content related to S14.

[0120] A building module is used to construct a network attack surface based on the asset target, application information, vulnerability information and risk level.

[0121] It can be understood that the building module can be used to execute the above S15. The detailed implementation of the building module can refer to the above content related to S15.

[0122] In a possible implementation, the security group information includes a destination port; the above-mentioned determination module may be used to determine the externally exposed port in the following manner:

[0123] Compare the listening port with the destination port in the security group information to determine a target listening port that is consistent with the destination port and exists in the listening port;

[0124] Determine that the target listening port is the externally exposed port of the public IP.

[0125] In a possible implementation, the above determination module may be used to determine the asset target in the following manner:

[0126] Get the first correspondence between the public network IP and the externally exposed port;

[0127] Based on the domain name information and the public IP, obtain a second correspondence between the domain name and the public IP;

[0128] Based on the first correspondence and the second correspondence, obtaining a third correspondence between the domain name and the externally exposed port;

[0129] An asset target is determined based on the first corresponding relationship and the third corresponding relationship.

[0130] In a possible implementation, the network attack surface discovery device further includes an alarm module, which can be used to:

[0131] The asset target is monitored, and if it is detected that the application information of the asset target changes, an alarm notification message is generated.

[0132] In a possible implementation, the alarm module may also be used for:

[0133] Obtain new vulnerability intelligence information, and determine whether the application corresponding to the application information is affected based on the new vulnerability intelligence information;

[0134] If it is determined that the application is affected, an alarm prompt message is generated.

[0135] In a possible implementation, the alarm module may also be used for:

[0136] Detecting whether the risk level of each application corresponding to the application information is higher than a preset level;

[0137] If there is an application whose risk level is higher than the preset level, the application is determined as a high-risk application and an alarm prompt information is generated.

[0138] In a possible implementation, the acquisition module may be used to acquire the listening port in the following manner:

[0139] Determine the device type of the device bound to the public IP;

[0140] When the device type is a cloud virtual machine type, determining the default port as a listening port;

[0141] When the device type is a cloud load balancing device type, the monitoring port is obtained through external monitoring conditions.

[0142] See also Figure 7, is a block diagram of an electronic device provided in an embodiment of the present invention, the electronic device may be a computer device, a server, etc., and the electronic device includes a memory, a processor, and a communication module. The memory, the processor, and the communication module are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses or signal lines.

[0143] The memory is used to store programs or data. The memory may be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0144] The processor is used to read / write data or programs stored in the memory and execute the network attack surface discovery method provided by any embodiment of the present invention.

[0145] The communication module is used to establish a communication connection between the electronic device and other communication terminals through the network, and is used to send and receive data through the network.

[0146] It should be understood that Figure 7 The structure shown is only a schematic diagram of the structure of the electronic device. The electronic device may also include Figure 7 More or fewer components as shown, or with Figure 7 Different configurations shown.

[0147] Furthermore, an embodiment of the present invention also provides a computer-readable storage medium, which stores machine-executable instructions. When the machine-executable instructions are executed, the network attack surface discovery method provided in the above embodiment is implemented.

[0148] Specifically, the computer-readable storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the computer-readable storage medium is executed, the above-mentioned network attack surface discovery method can be executed. Regarding the process involved when the computer-readable storage medium and its executable instructions are executed, reference can be made to the relevant description in the above-mentioned method embodiment, which will not be described in detail here.

[0149] In summary, the network attack surface discovery method, device, electronic device and readable storage medium provided by the embodiments of the present invention obtain the public IP, the security group information, domain name information and listening port bound to the public IP, and determine the externally exposed port of the public IP based on the listening port and security group information. The asset target is determined based on the domain name information and the externally exposed port, and the application information of the asset target is scanned to obtain the application information, vulnerability information and risk level. The network attack surface is constructed based on the asset target, application information, vulnerability information and risk level. In this solution, the asset target is determined based on the security group information and the listening port, and then the network attack surface is constructed for the asset target, which can ensure the comprehensiveness, timeliness and accuracy of the network attack surface.

[0150] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A network attack surface discovery method, characterized in that: The method comprises: Obtain the public IP, security group information, domain name information and listening port bound to the public IP; Determine the externally exposed port of the public IP based on the listening port and the security group information; Determine an asset target based on the domain name information and the externally exposed port; Perform application information scanning on the asset target to obtain application information, vulnerability information and risk level; A network attack surface is formed based on the asset targets, application information, vulnerability information and risk levels.

2. The network attack surface discovery method according to claim 1, characterized in that: The security group information includes a destination port; The step of determining the externally exposed port of the public IP based on the listening port and the security group information includes: Compare the listening port with the destination port in the security group information to determine a target listening port that is consistent with the destination port and exists in the listening port; Determine that the target listening port is the externally exposed port of the public IP.

3. The network attack surface discovery method according to claim 1, characterized in that: The step of determining the asset target based on the domain name information and the externally exposed port includes: Get the first correspondence between the public network IP and the externally exposed port; Based on the domain name information and the public IP, obtain a second correspondence between the domain name and the public IP; Based on the first correspondence and the second correspondence, obtaining a third correspondence between the domain name and the externally exposed port; An asset target is determined based on the first corresponding relationship and the third corresponding relationship.

4. The network attack surface discovery method according to claim 1, characterized in that: The method further comprises: The asset target is monitored, and if it is detected that the application information of the asset target changes, an alarm notification message is generated.

5. The network attack surface discovery method according to claim 1, characterized in that: The method further comprises: Obtain new vulnerability intelligence information, and determine whether the application corresponding to the application information is affected based on the new vulnerability intelligence information; If it is determined that the application is affected, an alarm prompt message is generated.

6. The network attack surface discovery method according to claim 1, characterized in that: The method further comprises: Detecting whether the risk level of each application corresponding to the application information is higher than a preset level; If there is an application whose risk level is higher than the preset level, the application is determined as a high-risk application and an alarm prompt information is generated.

7. The network attack surface discovery method according to claim 1, characterized in that: The step of obtaining the listening port includes: Determine the device type of the device bound to the public IP; When the device type is a cloud virtual machine type, determining the default port as a listening port; When the device type is a cloud load balancing device type, the monitoring port is obtained through external monitoring conditions.

8. A network attack surface discovery device, characterized in that: The device comprises: An acquisition module is used to obtain the public IP, the security group information bound to the public IP, the domain name information and the listening port; A determination module, used to determine the externally exposed port of the public IP based on the listening port and the security group information; The determination module is further used to determine the asset target based on the domain name information and the externally exposed port; A scanning module, used to scan the asset target for application information to obtain application information, vulnerability information and risk level; A building module is used to construct a network attack surface based on the asset target, application information, vulnerability information and risk level.

9. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to implement the network attack surface discovery method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the network attack surface discovery method according to any one of claims 1 to 7 is implemented.

Images