Network asset management method and device, electronic equipment and storage medium

Abstract

The invention provides a network asset management method and device, electronic equipment and a storage medium, and the method comprises the steps: screening out a plurality of pieces of target network asset data from a plurality of pieces of obtained original network asset data, and determining webpage metadata of each piece of target network asset data; for each piece of target network asset data, performing multi-feature coding fusion processing according to the webpage metadata of the target network asset data, and determining a fusion feature vector of the target network asset data; performing clustering processing according to the fusion feature vectors of all the target network asset data, and determining an asset cluster identifier of each target network asset data; and for each piece of target network asset data meeting the requirement, generating an asset fingerprint of the target network asset data according to the webpage metadata and the asset cluster identifier of the target network asset data, and storing the asset fingerprint. According to the scheme, the workload of related tasks can be simplified, and the asset identification efficiency and accuracy are improved.

Description

Technical Field

[0001] The present application relates to the technical field of network assets, and in particular to a method, device, electronic device and storage medium for managing network assets. Background Art

[0002] In the field of network asset identification, although existing platforms have achieved efficient identification of various network assets by building and maintaining a large number of sample libraries, the effectiveness of these technologies depends on manually written rule libraries for device identification, which has caused some technical problems.

[0003] First, manually writing annotation rules is a complex and tedious task. Annotation rules require targeted domain knowledge to ensure that various network assets can be accurately described and identified. The writing of such rules usually requires in-depth technical understanding and experience, so the annotators must have strong domain knowledge. Secondly, when network security vendors detect network assets, they usually need to hire dedicated annotators to perform data annotation. This operation brings significant expenses, because a large number of assets need to be annotated, and each asset must go through strict verification and annotation steps. As network assets continue to grow and change, annotators need to continuously update and maintain the rule base, which further increases labor costs and management difficulties. In addition, the asset annotation process also involves a lot of time and resource expenditures. Annotators need to perform detailed retrieval, verification and annotation for each asset. This process is not only time-consuming, but also needs to be repeated, which increases time costs and may also cause fluctuations in annotation quality.

[0004] In summary, although existing platforms have made significant progress in asset identification technology, the complexity, inefficiency and high cost of manually written rules remain a problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, the purpose of this application is to provide a network asset management method, device, electronic device and storage medium. This solution transforms the problem of cyberspace asset identification into a problem of cyberspace asset classification, and automatically performs feature acquisition and asset fingerprint generation, thereby reducing the complexity of the network asset determination process, and can also improve efficiency and reduce labor costs.

[0006] The present invention provides a method for managing network assets, the method comprising:

[0007] Obtain multiple raw network asset data;

[0008] Filtering out a plurality of target network asset data from the plurality of original network asset data, and determining webpage metadata of each target network asset data;

[0009] For each target network asset data, multi-feature coding fusion processing is performed according to the webpage metadata of the target network asset data to determine the fusion feature vector of the target network asset data;

[0010] Perform clustering processing based on the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data;

[0011] For each target network asset data that meets the requirements, an asset fingerprint of the target network asset data is generated according to the webpage metadata and asset cluster identifier of the target network asset data, and stored.

[0012] Optionally, the webpage metadata includes HTTP response header information, and the filtering out multiple target network asset data from the multiple original network asset data and determining the webpage metadata of each target network asset data includes:

[0013] Determine a screening strategy according to the node type and node level of each node in a pre-built fingerprint tree model; wherein the nodes in the fingerprint tree model are determined according to a response header field;

[0014] Screening and dividing all original network asset data according to the screening strategy to determine at least one target data set;

[0015] determining the original network asset data in all target data sets as target network asset data;

[0016] For each target network asset data, the HTTP response header information of the target network asset data is determined according to all nodes in the fingerprint tree model corresponding to the target network asset data.

[0017] Optionally, the webpage metadata also includes webpage content data, and the webpage metadata of each target network asset data is determined by the following steps:

[0018] For each target network asset data, a web page information parsing tool is used to parse and process the target network asset data to determine the web page content data of the target network asset data.

[0019] Optionally, for each target network asset data, performing multi-feature coding fusion processing according to the webpage metadata of the target network asset data to determine the fusion feature vector of the target network asset data includes:

[0020] For each target network asset data, the webpage metadata of the target network asset data is input into the target word vector model for multi-feature encoding fusion processing to determine the fusion feature vector of the target network asset data.

[0021] Optionally, performing clustering processing according to the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data includes:

[0022] Inputting the fused feature vectors of all target network asset data into a target clustering algorithm for clustering processing to determine at least one asset cluster;

[0023] For each target network asset data, the asset cluster identifier of the target network asset data is determined according to the asset cluster to which the target network asset data belongs.

[0024] Optionally, determine the target network asset data that meets the requirements by following the steps below:

[0025] For each asset cluster, determine whether the asset cluster is a qualified asset cluster according to the target network asset data included in the asset cluster and the preset judgment conditions;

[0026] The target network asset data included in the qualified asset cluster is determined as target network asset data that meets the requirements.

[0027] Optionally, for each target network asset data meeting the requirements, generating an asset fingerprint of the target network asset data according to the webpage metadata and the asset cluster identifier of the target network asset data includes:

[0028] The webpage feature code and the asset cluster identification code of the target network asset data are fused to generate a unique asset fingerprint of the target network asset data.

[0029] The embodiment of the present application also provides a network asset management device, the management device comprising:

[0030] An acquisition module, used to acquire multiple original network asset data;

[0031] A screening module, used to screen out a plurality of target network asset data from the plurality of original network asset data, and determine webpage metadata of each target network asset data;

[0032] A fusion module is used to perform multi-feature coding fusion processing on each target network asset data according to the webpage metadata of the target network asset data to determine a fusion feature vector of the target network asset data;

[0033] A clustering module, used to perform clustering processing based on the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data;

[0034] The generation module is used to generate and store the asset fingerprint of each target network asset data that meets the requirements according to the webpage metadata and asset cluster identifier of the target network asset data.

[0035] Optionally, the webpage metadata includes HTTP response header information, and when the screening module is used to screen out multiple target network asset data from the multiple original network asset data and determine the webpage metadata of each target network asset data, the screening module is used to:

[0036] Determine a screening strategy according to the node type and node level of each node in a pre-built fingerprint tree model; wherein the nodes in the fingerprint tree model are determined according to a response header field;

[0037] Screening and dividing all original network asset data according to the screening strategy to determine at least one target data set;

[0038] determining the original network asset data in all target data sets as target network asset data;

[0039] For each target network asset data, the HTTP response header information of the target network asset data is determined according to all nodes in the fingerprint tree model corresponding to the target network asset data.

[0040] Optionally, the webpage metadata also includes webpage content data, and the screening module is further configured to determine the webpage metadata of each target network asset data through the following steps:

[0041] For each target network asset data, a web page information parsing tool is used to parse and process the target network asset data to determine the web page content data of the target network asset data.

[0042] Optionally, when the fusion module is used to perform multi-feature encoding fusion processing on each target network asset data according to the webpage metadata of the target network asset data to determine the fusion feature vector of the target network asset data, the fusion module is used to:

[0043] For each target network asset data, the webpage metadata of the target network asset data is input into the target word vector model for multi-feature encoding fusion processing to determine the fusion feature vector of the target network asset data.

[0044] Optionally, when the clustering module is used to perform clustering processing according to the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data, the clustering module is used to:

[0045] Inputting the fused feature vectors of all target network asset data into a target clustering algorithm for clustering processing to determine at least one asset cluster;

[0046] For each target network asset data, the asset cluster identifier of the target network asset data is determined according to the asset cluster to which the target network asset data belongs.

[0047] Optionally, the management device is further configured to determine target network asset data that meets the requirements through the following steps:

[0048] For each asset cluster, determine whether the asset cluster is a qualified asset cluster according to the target network asset data included in the asset cluster and the preset judgment conditions;

[0049] The target network asset data included in the qualified asset cluster is determined as target network asset data that meets the requirements.

[0050] Optionally, when the generation module is used to generate the asset fingerprint of the target network asset data according to the webpage metadata and asset cluster identifier of the target network asset data for each target network asset data that meets the requirements, the generation module is used to:

[0051] The webpage feature code and the asset cluster identification code of the target network asset data are fused to generate a unique asset fingerprint of the target network asset data.

[0052] An embodiment of the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the management method as described above are performed.

[0053] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the management method described above are executed.

[0054] The embodiments of the present application provide a network asset management method, device, electronic device and storage medium, the method comprising: obtaining a plurality of original network asset data; screening out a plurality of target network asset data from the plurality of original network asset data, and determining the webpage metadata of each target network asset data; for each target network asset data, performing multi-feature coding fusion processing according to the webpage metadata of the target network asset data, and determining the fusion feature vector of the target network asset data; performing clustering processing according to the fusion feature vectors of all target network asset data, and determining the asset cluster identifier of each target network asset data; for each target network asset data that meets the requirements, generating an asset fingerprint of the target network asset data according to the webpage metadata and the asset cluster identifier of the target network asset data, and storing the fingerprint.

[0055] In this way, compared with the traditional solution of identifying unknown assets by matching the artificial fingerprint library, the present invention proposes a network asset determination method based on the fingerprint tree model and multi-feature fusion clustering, which simplifies the workload and work procedures of related tasks and improves the efficiency and accuracy of network asset determination.

[0056] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flowchart of a method for managing network assets provided in an embodiment of the present application;

[0059] Figure 2 A schematic diagram of a process of data screening based on a fingerprint tree model provided in this application;

[0060] Figure 3 A schematic diagram of the structure of a network asset management device provided in an embodiment of the present application;

[0061] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0063] In the field of network asset identification, although existing platforms have achieved efficient identification of various network assets by building and maintaining a large number of sample libraries, the effectiveness of these technologies depends on manually written rule libraries for device identification, which has caused some technical problems.

[0064] First, manually writing annotation rules is a complex and tedious task. Annotation rules require targeted domain knowledge to ensure that various network assets can be accurately described and identified. The writing of such rules usually requires in-depth technical understanding and experience, so the annotators must have strong domain knowledge. Secondly, when network security vendors detect network assets, they usually need to hire dedicated annotators to perform data annotation. This operation brings significant expenses, because a large number of assets need to be annotated, and each asset must go through strict verification and annotation steps. As network assets continue to grow and change, annotators need to continuously update and maintain the rule base, which further increases labor costs and management difficulties. In addition, the asset annotation process also involves a lot of time and resource expenditures. Annotators need to perform detailed retrieval, verification and annotation for each asset. This process is not only time-consuming, but also needs to be repeated, which increases time costs and may also cause fluctuations in annotation quality.

[0065] In summary, although existing platforms have made significant progress in asset identification technology, the complexity, inefficiency and high cost of manually written rules remain a problem that needs to be solved urgently.

[0066] Based on this, an embodiment of the present application provides a method for managing network assets to reduce the complexity of the network asset determination process, as well as to improve efficiency and reduce labor costs.

[0067] See also Figure 1 , Figure 1 The following is a flow chart of a method for managing network assets provided by an embodiment of the present application. Figure 1 As shown in , the management method provided by the embodiment of the present application includes:

[0068] S101. Acquire multiple original network asset data.

[0069] S102: Filter out a plurality of target network asset data from the plurality of original network asset data, and determine webpage metadata of each target network asset data.

[0070] S103: For each target network asset data, perform multi-feature encoding fusion processing according to the webpage metadata of the target network asset data to determine a fusion feature vector of the target network asset data.

[0071] S104: Perform clustering processing according to the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data.

[0072] S105: For each target network asset data that meets the requirements, generate an asset fingerprint of the target network asset data according to the webpage metadata and asset cluster identifier of the target network asset data, and store the fingerprint.

[0073] The embodiment of the present application provides a method for managing network assets. First, by screening out target network asset data from multiple original network asset data and extracting web page metadata for each target network asset data, the most valuable data for network asset management can be screened out more accurately, thereby improving the accuracy of data processing. Then, by performing multi-feature encoding fusion processing on the target network asset data and determining the fusion feature vector, the impact of multiple features on network assets can be comprehensively considered, which is more comprehensive than single feature processing and helps to more accurately describe and identify the features of network assets. Then, clustering processing is performed based on the fusion feature vector, which can better group similar target network asset data, and each asset cluster has a clear asset cluster identifier, which can improve the classification and management efficiency of network assets. Finally, the asset fingerprint is determined based on the web page metadata and the asset cluster identifier, and is stored, which can provide a more accurate and reliable identification of network assets, thereby improving the accuracy of network asset identification and facilitating subsequent asset tracking and management.

[0074] Regarding step S101, here, the original network asset data can be obtained by at least one of the following methods: data crawling, log collection, interface call, database query and manual entry.

[0075] The original network asset data may include, but is not limited to, one or more of the following data: network device information, server data, web page and application data, network traffic data, and security information.

[0076] With respect to step S102, the web page metadata includes HTTP response header information and web page content data.

[0077] When obtaining HTTP response header information of each target network asset data, in one embodiment provided in the present application, the step of filtering out multiple target network asset data from the multiple original network asset data and determining webpage metadata of each target network asset data includes:

[0078] S1021. Determine a screening strategy according to the node type and node level of each node in the pre-built fingerprint tree model.

[0079] S1022: Filter and divide all original network asset data according to the filtering strategy to determine at least one target data set.

[0080] S1023. Determine the original network asset data in all target data sets as target network asset data.

[0081] S1024. For each target network asset data, determine the HTTP response header information of the target network asset data according to all nodes in the fingerprint tree model corresponding to the target network asset data.

[0082] For step S1021, the nodes in the fingerprint tree model are determined according to the response header field, and the response header field types corresponding to the nodes at the same level are the same. For example, the nodes at the first level in the fingerprint tree are set as server type nodes, which may specifically include Nginx nodes, Apache nodes, and Microsoft-IIS nodes. The setting methods of other levels are similar and will not be repeated here.

[0083] However, it should be noted that the setting of the second-level nodes must be based on the first-level nodes.

[0084] With respect to step S1022, the original network asset data included in all target data sets filtered out according to the filtering strategy may be all the network asset data or part of the network asset data.

[0085] With respect to step S1023, the original network asset data of all target data sets after being screened by all nodes in the fingerprint tree model are determined as target network asset data.

[0086] For step S1024, for each target network asset data, all corresponding nodes in the fingerprint tree model (including the first node, the second node and possible subsequent nodes) are used to determine its complete HTTP response header information, so that the HTTP response header information of each target network asset data is determined.

[0087] For examples, see Figure 2 , Figure 2A schematic diagram of a process of data screening based on a fingerprint tree model provided in this application. Figure 2 As shown, here, the process of determining the target network asset data is described using a two-level fingerprint tree model. The implementation process of determining the target network asset data and HTTP response header information using the fingerprint tree model includes:

[0088] S1. The original network asset data is processed and divided according to the server type (server type) to obtain three sub-datasets, namely, the sub-datasets of the servers being Nginx, Apache, and Microsoft-IIS (that is, three first data sets are obtained).

[0089] S2. Process the data with Nginx as the server, and calculate that when content-length is used as the splitting basis, the similarity within the total class is the highest. Then, content-length (response header field) is used as the splitting basis to obtain sub-data sets D1, D2, and D3 with content-length of 12, 13, and 14 respectively (that is, 3 second data sets are determined).

[0090] S3. Process the server as Apache, and calculate that when X-powered-by is used as the splitting basis, the similarity within the total class is the highest. Then, X-powered-by (response header field) is used as the splitting basis, and sub-datasets D4 and D5 with X-powered-by as php / 5.4.45 and php / 5.3.29 are obtained (that is, two second data sets are determined).

[0091] S4. Process the server as Microsoft-IIS, and calculate that when content-encoding is used as the splitting basis, the similarity within the total class is the highest. Then, content-encoding (response header field) is used as the splitting basis, and sub-datasets D6 and D7 with content-encoding of gzip and deflate are obtained respectively (that is, two second data sets are determined).

[0092] In this way, seven second data sets can be obtained, and the original network asset data included in the seven second data sets are all determined as target network asset data.

[0093] Among them, the HTTP response header information of the target network asset data in D1 includes Server (Nginx) and Content-Length, the HTTP response header information of the target network asset data in D4 includes Server (Apache) and X-powered-by, and the HTTP response header information of the target network asset data in D7 includes Server (Microsoft-IIS) and content-encoding.

[0094] It should be noted that, when the fingerprint tree model has more node levels, the HTTP response header information of the target network asset data includes more field information.

[0095] However, the data filtered by the fingerprint tree only includes HTTP response header information, which is not sufficient to realize asset identification. Therefore, the web page metadata also includes web page content data.

[0096] Continuing with step S102, when the web page metadata obtained is web page content data, in another embodiment provided in the present application, the web page metadata of each target network asset data is determined by the following steps: for each target network asset data, the target network asset data is parsed using a web page information parsing tool to determine the web page content data of the target network asset data.

[0097] For example, this step includes: for each target network asset data, using the BeautifulSoup parsing library to parse the target network asset data in Html, and extracting the title (webpage title), body (html webpage theme code), icon (webpage icon information) and other information from it, and determining the webpage content data of the target network asset data based on the extracted information.

[0098] Therefore, the webpage content data of the target network asset data at least includes: the title (webpage title), body (the theme part code of the HTML webpage), and icon (webpage icon information) information of the webpage.

[0099] Among them, BeautifulSoup is a Python library used to extract data from HTML or XML documents.

[0100] Regarding step S103, this step includes: for each target network asset data, performing feature encoding processing on each type of web page metadata of the target network asset data respectively, and fusing the encoded web page metadata to determine the fused feature vector of the target network asset data.

[0101] Continuing with step S103, in one embodiment provided in the present application, for each target network asset data, multi-feature coding fusion processing is performed based on the web page metadata of the target network asset data to determine the fused feature vector of the target network asset data, including: for each target network asset data, the web page metadata of the target network asset data is input into the target word vector model to perform multi-feature coding fusion processing to determine the fused feature vector of the target network asset data.

[0102] Here, the target word vector model example can be a Word2Vec model, so this step includes: for each target network asset data, the web page metadata of the target network asset data is input into the Word2Vec model, and the Word2Vec model performs multi-feature encoding fusion processing based on the input text information to determine the fused feature vector of the target network asset data.

[0103] It should be noted that word2vec has two models, namely cbow and skip-gram models. This solution can use the cbow model. The core idea of ​​​​cbow is to predict the central word by averaging the context words. During the training process, the model will try to maximize the conditional probability of the central word under the given context words, so as to learn the vector representation of each word. Since the contextual information around the word is taken into account, when learning the vector representation of the word, it will take into account the use of the word in different contexts, so as to better capture the semantics of the word.

[0104] With respect to step S104, in an implementation manner provided in the present application, clustering is performed based on the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data, including:

[0105] S1041. Input the fused feature vectors of all target network asset data into a target clustering algorithm for clustering processing to determine at least one asset cluster.

[0106] S1042: For each target network asset data, determine the asset cluster identifier of the target network asset data according to the asset cluster to which the target network asset data belongs.

[0107] With respect to step S1041, the fused feature vector is a feature vector generated by extracting and integrating multiple features (such as server type, response header field, etc.) from the target network asset data. These vectors represent the comprehensive attributes of each target network asset data.

[0108] The target clustering algorithm may include: K-means, DBSCAN, hierarchical clustering, etc.

[0109] The clustering process is that the clustering algorithm will classify the target network asset data with similar features into the same asset cluster according to the input fusion feature vector. Each asset cluster contains a group of data points that are close in the feature space, which means that they are similar to some extent.

[0110] For step S1042, each asset cluster is assigned a unique identifier (eg, cluster 1, cluster 2, cluster 3, etc.), which is called an asset cluster identifier. Each target network asset data obtains a corresponding asset cluster identifier according to the asset cluster to which it belongs.

[0111] For example, suppose there is a set of target network asset data, and the fusion features of each asset data include the following features: server type, content length (Content-Length), and encoding type (Content-Encoding). The combination of these features may be:

[0112] The fusion features of data 1: [Nginx, 12, gzip]; the fusion features of data 2: [Apache, 13, deflate]; the fusion features of data 3: [Nginx, 14, gzip]; the fusion features of data 4: [Microsoft-IIS, 13, gzip]; the fusion features of data 5: [Nginx, 12, deflate].

[0113] Then, for each data, the corresponding feature vector is determined according to the fusion features of the data, and these feature vectors are input into a DBSCAN clustering algorithm. After the algorithm runs, the following results may be obtained: Cluster 1: contains data 1 and data 5 (the two are similar in Nginx and similar Content-Length features); Cluster 2: contains data 2 and data 4 (neither of them belongs to Nginx and has different encoding types); Cluster 3: contains data 3 (its features are quite different from other data).

[0114] Data 1 and data 5 will be assigned to cluster 1, and their asset cluster identifiers are cluster 1. Data 2 and data 4 will be assigned to cluster 2, and their asset cluster identifiers are cluster 2. Data 3 will be assigned to cluster 3, and its asset cluster identifier will be cluster 3.

[0115] For step S105, in one embodiment provided in the present application, the target network asset data that meets the requirements is determined by the following steps: for each asset cluster, determine whether the asset cluster is a qualified asset cluster based on the target network asset data included in the asset cluster and preset judgment conditions; determine the target network asset data included in the qualified asset cluster as the target network asset data that meets the requirements.

[0116] Here, the preset judgment condition can be set in advance, or set in real time by relevant personnel according to actual conditions.

[0117] For an asset cluster that does not meet the requirements, all target network asset data in the asset cluster will not be used for subsequent asset fingerprint generation.

[0118] Continuing with step S105, in one embodiment provided in the present application, for each target network asset data that meets the requirements, an asset fingerprint of the target network asset data is generated based on the web page metadata and asset cluster identifier of the target network asset data, including: fusing the web page feature code and the asset cluster identifier code of the target network asset data to generate a unique asset fingerprint of the target network asset data.

[0119] Here, when fusion is performed, it can be achieved through simple feature concatenation, weighted fusion or other fusion techniques. For example:

[0120] Feature splicing: Splice text features, structural features, numerical features and asset cluster identifiers together.

[0121] Weighted fusion: Different types of features are weighted and then fused into a comprehensive feature vector.

[0122] In this way, the generated asset fingerprint is stored in the asset library for subsequent use.

[0123] Among them, exemplary subsequent application areas may include:

[0124] Asset Identification: By comparing asset fingerprints, similarities or duplications of network assets can be identified. For example, if two asset fingerprints are detected to be identical or similar, it can be inferred that they may be the same resource.

[0125] Security Detection: Leverage asset fingerprinting to identify potential security issues, such as detecting malware, identifying unauthorized assets, etc.

[0126] Asset management: Fingerprints can be used to more effectively manage and classify network assets, such as grouping and labeling.

[0127] In this way, compared with the traditional solution of identifying unknown assets by matching the artificial fingerprint library, the present invention proposes a network asset determination method based on the fingerprint tree model and multi-feature fusion clustering, which simplifies the workload and work procedures of related tasks and improves the efficiency and accuracy of network asset determination.

[0128] Based on the same inventive concept, a management device corresponding to the above-mentioned management method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned management method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0129] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of a network asset management device provided in an embodiment of the present application. Figure 3 As shown in , the management device 300 includes:

[0130] An acquisition module 310 is used to acquire a plurality of original network asset data;

[0131] A screening module 320, configured to screen out a plurality of target network asset data from the plurality of original network asset data, and determine webpage metadata of each target network asset data;

[0132] Fusion module 330, for performing multi-feature coding fusion processing on each target network asset data according to the webpage metadata of the target network asset data, and determining a fusion feature vector of the target network asset data;

[0133] A clustering module 340 is used to perform clustering processing based on the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data;

[0134] The generation module 350 is used to generate and store the asset fingerprint of each target network asset data that meets the requirements according to the webpage metadata and asset cluster identifier of the target network asset data.

[0135] Optionally, the webpage metadata includes HTTP response header information. When the screening module 320 is used to screen out a plurality of target network asset data from the plurality of original network asset data and determine the webpage metadata of each target network asset data, the screening module 320 is used to:

[0136] Determine a screening strategy according to the node type and node level of each node in a pre-built fingerprint tree model; wherein the nodes in the fingerprint tree model are determined according to a response header field;

[0137] Screening and dividing all original network asset data according to the screening strategy to determine at least one target data set;

[0138] determining the original network asset data in all target data sets as target network asset data;

[0139] For each target network asset data, the HTTP response header information of the target network asset data is determined according to all nodes in the fingerprint tree model corresponding to the target network asset data.

[0140] Optionally, the webpage metadata also includes webpage content data, and the screening module 320 is further configured to determine the webpage metadata of each target network asset data through the following steps:

[0141] For each target network asset data, a web page information parsing tool is used to parse and process the target network asset data to determine the web page content data of the target network asset data.

[0142] Optionally, when the fusion module 330 is used to perform multi-feature encoding fusion processing on each target network asset data according to the webpage metadata of the target network asset data to determine the fusion feature vector of the target network asset data, the fusion module 330 is used to:

[0143] For each target network asset data, the webpage metadata of the target network asset data is input into the target word vector model for multi-feature encoding fusion processing to determine the fusion feature vector of the target network asset data.

[0144] Optionally, when the clustering module 340 is used to perform clustering processing according to the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data, the clustering module 340 is used to:

[0145] Inputting the fused feature vectors of all target network asset data into a target clustering algorithm for clustering processing to determine at least one asset cluster;

[0146] For each target network asset data, the asset cluster identifier of the target network asset data is determined according to the asset cluster to which the target network asset data belongs.

[0147] Optionally, the management device 300 is further configured to determine target network asset data that meets the requirements through the following steps:

[0148] For each asset cluster, determine whether the asset cluster is a qualified asset cluster according to the target network asset data included in the asset cluster and the preset judgment conditions;

[0149] The target network asset data included in the qualified asset cluster is determined as target network asset data that meets the requirements.

[0150] Optionally, when the generation module 350 is used to generate the asset fingerprint of the target network asset data according to the webpage metadata and asset cluster identifier of the target network asset data for each target network asset data that meets the requirements, the generation module 350 is used to:

[0151] The webpage feature code and the asset cluster identification code of the target network asset data are fused to generate a unique asset fingerprint of the target network asset data.

[0152] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0153] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 as well as Figure 2 The specific implementation of the steps in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0154] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 as well as Figure 2 The specific implementation of the steps in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0155] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0156] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0157] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0159] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0160] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for managing network assets, characterized in that: The management method comprises: Obtain multiple raw network asset data; Filtering out a plurality of target network asset data from the plurality of original network asset data, and determining webpage metadata of each target network asset data; For each target network asset data, multi-feature coding fusion processing is performed according to the webpage metadata of the target network asset data to determine the fusion feature vector of the target network asset data; Perform clustering processing based on the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data; For each target network asset data that meets the requirements, an asset fingerprint of the target network asset data is generated according to the webpage metadata and asset cluster identifier of the target network asset data, and stored.

2. The management method according to claim 1, characterized in that: The webpage metadata includes HTTP response header information, and the steps of filtering out a plurality of target network asset data from the plurality of original network asset data and determining the webpage metadata of each target network asset data include: Determine a screening strategy according to the node type and node level of each node in a pre-built fingerprint tree model; wherein the nodes in the fingerprint tree model are determined according to a response header field; Screening and dividing all original network asset data according to the screening strategy to determine at least one target data set; determining the original network asset data in all target data sets as target network asset data; For each target network asset data, the HTTP response header information of the target network asset data is determined according to all nodes in the fingerprint tree model corresponding to the target network asset data.

3. The management method according to claim 1, characterized in that: The webpage metadata also includes webpage content data. The webpage metadata of each target network asset data is determined by the following steps: For each target network asset data, a web page information parsing tool is used to parse and process the target network asset data to determine the web page content data of the target network asset data.

4. The management method according to claim 1, characterized in that: The method of performing multi-feature coding fusion processing on each target network asset data according to the webpage metadata of the target network asset data to determine the fusion feature vector of the target network asset data includes: For each target network asset data, the webpage metadata of the target network asset data is input into the target word vector model for multi-feature encoding fusion processing to determine the fusion feature vector of the target network asset data.

5. The management method according to claim 1, characterized in that: The clustering process is performed according to the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data, including: Inputting the fused feature vectors of all target network asset data into a target clustering algorithm for clustering processing to determine at least one asset cluster; For each target network asset data, the asset cluster identifier of the target network asset data is determined according to the asset cluster to which the target network asset data belongs.

6. The management method according to claim 5, characterized in that: Use the following steps to determine target network asset data that meets the requirements: For each asset cluster, determine whether the asset cluster is a qualified asset cluster according to the target network asset data included in the asset cluster and the preset judgment conditions; The target network asset data included in the qualified asset cluster is determined as target network asset data that meets the requirements.

7. The management method according to claim 1, characterized in that: The step of generating an asset fingerprint of each target network asset data that meets the requirements according to the webpage metadata and the asset cluster identifier of the target network asset data includes: The webpage feature code and the asset cluster identification code of the target network asset data are fused to generate a unique asset fingerprint of the target network asset data.

8. A network asset management device, characterized in that: The management device comprises: An acquisition module, used to acquire multiple original network asset data; A screening module, used to screen out a plurality of target network asset data from the plurality of original network asset data, and determine webpage metadata of each target network asset data; A fusion module is used to perform multi-feature coding fusion processing on each target network asset data according to the webpage metadata of the target network asset data to determine a fusion feature vector of the target network asset data; A clustering module, used to perform clustering processing based on the fused feature vectors of all target network asset data to determine the asset cluster identifier of each target network asset data; The generation module is used to generate and store the asset fingerprint of each target network asset data that meets the requirements according to the webpage metadata and asset cluster identifier of the target network asset data.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and the machine-readable instructions are executed by the processor to execute the steps of the network asset management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the network asset management method according to any one of claims 1 to 7 are executed.

Images