Asset identification and troubleshooting method and device, equipment and storage medium

Abstract

The invention provides an asset identification and troubleshooting method, apparatus and device, and a storage medium. The method comprises the steps of obtaining network connection information of each asset; if the matching between the external IP address and the asset IP address base fails, taking the external IP address as the IP address of the unknown asset; querying asset IPs of other assets in network connection with the unknown asset based on the network connection information of each asset; based on the network card interface information of each asset, determining asset IPs of other assets which are in the same subnet with the unknown asset; and on the basis of the asset IPs of other assets and the associated asset attribute information, generating early warning information for an asset manager to perform troubleshooting. According to the invention, the unknown assets are identified and obtained based on the network connection information of the assets and the IP addresses of the asset IP address base; and furthermore, by utilizing the relevance of the unknown asset IP, the troubleshooting object range of the unknown asset IP is narrowed, and the asset identification and troubleshooting efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an asset identification and troubleshooting method, device, equipment and storage medium. Background Art

[0002] With the widespread application of Internet technology and cloud technology, enterprise informatization has entered a period of rapid development. The number of enterprise informatization systems is increasing, the network structure is becoming more and more complex, and the number of IT equipment assets is growing sharply, which greatly increases the difficulty of enterprise asset security management. With the passage of time and changes in enterprise personnel, a large number of ownerless assets and zombie assets are easily generated. These assets have been unmaintained for a long time, resulting in a large number of security vulnerabilities and configuration violations, which poses a great threat to enterprise network security and becomes the weak point of enterprise information security.

[0003] Currently, common unknown asset identification methods include: 1. Detection method based on traffic message analysis: parse the traffic message to obtain the attribute data of the asset to be identified, including: access end IP address, server IP address, server port number, and then analyze whether the IP address is within the enterprise's intranet address segment and whether it is in the managed intranet asset list, so as to identify the unknown asset.

[0004] 2. Detection method based on switch configuration analysis: The switch configuration information is collected multiple times, including the switch port list, ARP cache table, and LLDP neighbor relationship table, and then the IP address is analyzed to see if it is in the list of intranet assets managed by the enterprise, thereby identifying unknown assets.

[0005] 3. Analysis method based on remote network scanning: After performing a survival scan on the specified network segment and the specified port range, the surviving assets are obtained, and then the surviving assets are scanned and detected to obtain detailed information on the surviving assets and store them in the database. They are then compared with the managed assets to discover unknown assets.

[0006] However, the detection method based on traffic packet analysis has the following disadvantages: it relies on a preset list of managed asset IP addresses, and for unknown assets discovered, it is impossible to narrow the scope of asset responsible persons, making it difficult to claim unknown assets. The detection method based on switch configuration analysis has the following disadvantages: the switch is configured with a cache cycle, and existing IP addresses may not survive. At the same time, it is impossible to narrow the scope of asset responsible persons for discovered unknown assets, making it difficult to claim unknown assets. The analysis method based on network remote scanning has the following disadvantages: remote scanning relies on the prerequisite that the network is reachable. If the unknown asset does not have an open port or ping is prohibited, the unknown asset cannot be discovered. At the same time, it is impossible to narrow the scope of asset responsible persons for discovered unknown asset IP addresses, making it difficult to claim unknown assets. Summary of the invention

[0007] Based on this, it is necessary to provide an asset identification and troubleshooting method, device, equipment and storage medium to address the above technical issues, so as to solve at least one of the above technical issues.

[0008] The present invention provides an asset identification and troubleshooting method, comprising: Obtain network connection information for each asset, wherein the network connection information includes the asset IP and external IP address; If the external IP address fails to match each IP address in the asset IP address library, the external IP address is used as the IP address of an unknown asset, wherein the unknown asset refers to an asset whose IP address does not correspond to the asset IP address library; Based on the network connection information of each asset, query the asset IP of other assets that have network connection with the unknown asset; Based on the collected network card interface information of each asset, determine the asset IP of other assets in the same subnet as the unknown asset; Based on the asset IPs of other assets that have a network connection with the unknown asset and their associated asset attribute information, and the asset IPs of other assets in the same subnet as the unknown asset and their associated asset attribute information, an early warning information is generated for the asset manager to check, wherein the asset attribute information includes the asset manager information.

[0009] Optionally, according to an asset identification and troubleshooting method provided by the present invention, if the external IP address fails to match each IP address in the asset IP address library, before determining that the asset that fails to match belongs to an unknown asset, the method further includes: Obtain the IP addresses of each asset synchronized by the network security management platform and manually reported; The various IP addresses synchronized by the network security management platform and the manually reported IP addresses are stored in the asset IP address library as the network card IP addresses in the network card interface information of each asset.

[0010] Optionally, according to an asset identification and troubleshooting method provided by the present invention, if the external IP address fails to match each IP address in the asset IP address library, before determining that the asset that fails to match belongs to an unknown asset, the method further includes: Filter each of the external IP addresses according to the preset intranet IP rules; The filtered external IP address is matched with each IP address in the asset IP address library.

[0011] Optionally, according to an asset identification and troubleshooting method provided by the present invention, the network card interface information includes asset IP and subnet information of each asset; The determining of the asset IP addresses of other assets in the same subnet as the unknown asset based on the collected network card interface information of each asset includes: According to the IP address of the unknown asset and the subnet information corresponding to each asset, the asset IPs of other assets in the same subnet as the unknown asset are queried.

[0012] Optionally, according to an asset identification and troubleshooting method provided by the present invention, the network connection information further includes a local IP address; and the querying of the asset IP addresses of other assets having a network connection with the unknown asset based on the network connection information of each asset includes: Based on the local IP address and external IP address in the network connection information of each asset and the IP address of the unknown asset, the asset IPs of other assets that have a network connection with the unknown asset are queried and obtained.

[0013] Optionally, according to an asset identification and troubleshooting method provided by the present invention, the asset attribute information includes asset information, network connection information and process information of the asset; The asset information includes asset IP, device type, department, asset responsible person information, direct access information and Agent information; The process information includes asset IP, PID, PPID, startup user, startup command, running time and startup time.

[0014] Optionally, according to an asset identification and troubleshooting method provided by the present invention, the generating of early warning information for troubleshooting by the asset person in charge based on the asset IPs of other assets having a network connection with the unknown asset and their associated asset attribute information, and the asset IPs of other assets in the same subnet as the unknown asset and their associated asset attribute information, includes: Based on the asset IP of each of the other assets, query and obtain the associated asset information, network connection information and process information; Based on the asset information, network connection information and process information associated with any of the other assets, the warning information is generated and sent to the corresponding asset manager for investigation.

[0015] The present invention also provides an asset identification and troubleshooting device, comprising: An acquisition module, used to acquire network connection information of each asset, wherein the network connection information includes the asset IP and external IP address; A matching module, configured to use the external IP address as the IP address of an unknown asset if the external IP address fails to match each IP address in the asset IP address library, wherein the unknown asset refers to an asset whose IP address does not correspond to the asset IP address library; A query module, used to query the asset IP addresses of other assets that have network connections with the unknown asset based on the network connection information of each asset; A determination module, used to determine the asset IP addresses of other assets in the same subnet as the unknown asset based on the collected network card interface information of each asset; The early warning and investigation module is used to generate early warning information for investigation by the asset manager based on the asset IPs of other assets that have a network connection with the unknown asset and their associated asset attribute information, and the asset IPs of other assets in the same subnet as the unknown asset and their associated asset attribute information, wherein the asset attribute information includes the asset manager information.

[0016] The present invention also provides a computer device, comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor implements the above-mentioned asset identification and troubleshooting method when executing the computer-readable instructions.

[0017] The present invention also provides one or more readable storage media storing computer-readable instructions, which implement the above-mentioned asset identification and troubleshooting method when executed by a processor.

[0018] The above-mentioned asset identification and troubleshooting method, device, equipment and storage medium include: obtaining network connection information of each asset, wherein the network connection information includes asset IP and external IP address; if the external IP address fails to match each IP address in the asset IP address library, then the external IP address is used as the IP address of the unknown asset, wherein the unknown asset refers to an asset whose IP address is not in the asset IP address library; based on the network connection information of each asset, query the asset IP of other assets that have a network connection with the unknown asset; based on the collected network card interface information of each asset, determine the asset IP of other assets in the same subnet as the unknown asset; based on the asset IP of other assets that have a network connection with the unknown asset and their associated asset attribute information, and the asset IP of other assets in the same subnet as the unknown asset and their associated asset attribute information, generate early warning information for the asset person in charge to check, wherein the asset attribute information includes asset person in charge information. By comparing the IP address in the asset IP address library with the external IP address in the asset's network connection information, the unknown asset is identified. Then, based on the network connection information, the asset that has a network connection with the unknown asset IP is determined. And based on the network card interface information, the asset that is in the same subnet as the unknown asset IP is determined. This makes use of the relevance of the unknown asset IP (network connection and being in the same subnet), narrows the scope of the unknown asset IP screening, and then combines the asset attribute information associated with the asset to generate early warning information for the asset manager to conduct screening, thereby improving the efficiency of asset identification and screening. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0020] Figure 1 It is a flow chart of an asset identification and troubleshooting method in one embodiment of the present invention; Figure 2 It is a structural schematic diagram of an asset identification and troubleshooting device in one embodiment of the present invention; Figure 3 is a schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The terms used in one or more embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present invention. The singular forms of "a", "said" and "the" used in one or more embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of the present invention refers to and includes any or all possible combinations of one or more associated listed items.

[0023] In one embodiment, specifically, Figure 1 As shown, Figure 1 1 is a flow chart of an asset identification and troubleshooting method in an embodiment of the present invention. The present invention provides an asset identification and troubleshooting method, including the following steps: Step S11, obtaining network connection information of each asset; It should be noted that network connection information includes asset IP, protocol type, local IP address, external IP address, status, PID (Process ID), and application name. Among them, the local IP address refers to the IP address used by the asset that initiates the network connection. The external IP address refers to the IP address used by the asset that receives the network connection. The asset IP refers to the unique identifier of the asset in the network, usually a public IP address or a private IP address. The asset can be any network device, such as a server, a personal computer, a router, etc.

[0024] Step S12: if the external IP address fails to match each IP address in the asset IP address library, the external IP address is used as the IP address of the unknown asset; It should be noted that unknown assets refer to assets whose IP addresses are not in the asset IP address library. Specifically, filter the network connection information records of each asset, for example, filter out the "LISTEN" records (service listening records); further, extract the external IP addresses in the filtered network connection information, and filter each external IP address according to the preset intranet IP rules to analyze whether it is an intranet connection, and filter out the Internet connection. For example, preset intranet IP rules, such as 10.0.0.0~10.255.255.255, 172.16.0.0~172.31.255.255, 192.168.0.0~192.168.255.255, etc.

[0025] Furthermore, the filtered external IP address is matched with each IP address in the asset IP address library. If the match is successful, it proves that the external IP address is not an unknown asset, and the process ends. If the external IP address fails to match each IP address in the asset IP address library, the external IP address is regarded as the IP address of an unknown asset.

[0026] In one embodiment of the present invention, if the external IP address fails to match each IP address in the asset IP address library, before determining that the asset that fails to match belongs to an unknown asset, the method further includes: Obtain each IP address synchronized by the network security management platform and each IP address manually reported by the asset; store each IP address synchronized by the network security management platform and each IP address manually reported in the asset IP address library as the network card IP address in the network card interface information of each asset.

[0027] Specifically, obtain each IP address synchronized by the network security management platform (4A platform) and the IP address of each asset manually reported by the asset manager, and store each IP address synchronized by the network security management platform and the manually reported IP address in the asset IP address library. Since each IP address synchronized by the 4A platform does not include multiple IPs of managed assets, the accuracy of determining unknown assets may be reduced. In this embodiment, the asset IP address library is improved based on the collected network card interface information of each asset, wherein the network card interface information includes asset IP, network card name, network card IP address, MAC address, subnet information, and address valid range, etc. Considering the situation where a device has multiple IPs such as multiple network cards and IPv4 / IPv6 dual stacks, it can help improve the accuracy of unknown asset IP determination.

[0028] Step S13, based on the network connection information of each asset, query the asset IP of other assets that have a network connection with the unknown asset; Specifically, based on the local IP address and external IP address in the network connection information of each asset and the IP address of the unknown asset, the asset IPs of other assets that have a network connection with the unknown asset are queried, that is, it is determined which assets' IP addresses have a network connection with the IP address of an unknown asset.

[0029] Step S14, based on the collected network card interface information of each asset, determine the asset IP of other assets in the same subnet as the unknown asset; Specifically, based on the IP address of the unknown asset and the subnet information corresponding to each asset, the asset IPs of other assets in the same subnet as the unknown asset are queried and obtained.

[0030] Step S15, based on the asset IPs and their associated asset attribute information of other assets that have a network connection with the unknown asset, and the asset IPs and their associated asset attribute information of other assets in the same subnet as the unknown asset, generate early warning information for the asset manager to check.

[0031] It should be noted that asset attribute information includes asset information, network connection information and process information of the asset; asset information includes asset IP, device type, department, asset responsible person information (for example, name, email, phone number, etc.), binding command channel information (for example, command channel IP, command channel access master account, command channel access password, etc.), direct access information (for example, direct account, password) and Agent information. In more detail: for managed assets that have been connected to the 4A platform (network security management platform), the asset information of the 4A platform is synchronized to the asset security management platform. The asset information includes asset IP, device type, department, asset responsible person information (name, email, phone number), binding command channel information (command channel IP, command channel access master account, command channel access password, etc.) and direct access information (direct account, password) and other information. For managed assets that are not connected to the 4A platform, the asset manager shall enter the asset information on the asset security management platform. The asset information includes asset IP, device type, department, asset responsible person information (name, email, phone number), direct access information (direct account, password), Agent information (registration account, password), etc. Process information includes asset IP, PID (process ID), PPID (parent process ID of the process), startup user, startup command, running time and startup time.

[0032] It should be noted that for asset devices connected to the 4A platform, remote login or direct remote login through the 4A command channel is used to connect to the managed device and execute shell commands to collect information such as network card interface information, all process information, and network connection information on the relevant host; for host asset devices not connected to the 4A platform, information such as network card interface information, all process information, and network connection information on the host is obtained by sending collection instructions to the collection agent, or directly connecting to the managed device through remote login to execute shell commands to collect information such as network card interface information, all process information, and network connection information on the relevant host. Collection can be performed regularly according to actual needs, for example, regular collection on a daily, weekly, or monthly basis. For example, process information on the managed host can be obtained through commands such as ps; network connection information of the host device can be obtained through commands such as netstat and ss; network card interface information of the host device can be obtained through commands such as "ip address".

[0033] Specifically, based on the asset IPs of other assets that have a network connection with the unknown asset and are in the same subnet as the unknown asset, the asset information, network connection information, process information and other information associated with the asset IP are queried, and then based on the asset IPs of other assets that have a network connection with the unknown asset and their associated asset information, network connection information, process information and other information, as well as the asset IPs of other assets in the same subnet as the unknown asset and their associated asset information, network connection information, process information and other information, the warning information is generated, and the warning information is pushed to the asset person in charge corresponding to the asset information for investigation.

[0034] It should be noted that the asset responsible person corresponding to other assets that have a network connection with the unknown asset is selected as the cooperative investigation object because the asset responsible person's assets have a network connection with the unknown asset and may know the unknown asset IP; the asset responsible person of other assets in the same subnet as the unknown asset is selected as the cooperative investigation object because the asset responsible person's assets are in the same subnet as the unknown asset and may know the unknown asset IP. By specifying the unknown asset cooperative investigator in this way, the efficiency of unknown asset screening can be greatly improved.

[0035] In addition, the person responsible for investigating unknown assets needs to submit the assets to the 4A platform for management, or report the assets to the platform, and ensure that their assets can be included in the asset security management platform for collection, and finally complete the closed-loop disposal process of unknown assets.

[0036] It should be noted that the asset IP involved in the embodiment of the present invention refers to the IP address of the asset, and the asset information, network card interface information, network connection information and process information of any asset can be associated and queried through the asset IP of the asset.

[0037] The embodiment of the present invention, through the above scheme, includes: obtaining network connection information of each asset, wherein the network connection information includes an asset IP and an external IP address; if the external IP address fails to match each IP address in the asset IP address library, using the external IP address as the IP address of an unknown asset, wherein the unknown asset refers to an asset whose IP address is not in the asset IP address library; based on the network connection information of each asset, querying the asset IP of other assets that have a network connection with the unknown asset; based on the collected network card interface information of each asset, determining the asset IP of other assets in the same subnet as the unknown asset; based on the asset IP of other assets that have a network connection with the unknown asset and their associated asset attribute information, and the asset IP of other assets in the same subnet as the unknown asset and their associated asset attribute information, generating early warning information for the asset person in charge to check, wherein the asset attribute information includes the asset person in charge information. By comparing the IP address in the asset IP address library with the external IP address in the asset's network connection information, the unknown asset is identified. Then, based on the network connection information, the asset that has a network connection with the unknown asset IP is determined. And based on the network card interface information, the asset that is in the same subnet as the unknown asset IP is determined. This makes use of the relevance of the unknown asset IP (network connection and being in the same subnet), narrows the scope of the unknown asset IP screening, and then combines the asset attribute information associated with the asset to generate early warning information for the asset manager to conduct screening, thereby improving the efficiency of asset identification and screening.

[0038] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0039] In one embodiment, an asset identification and troubleshooting device is provided, and the asset identification and troubleshooting device corresponds one-to-one with the asset identification and troubleshooting method in the above embodiment. Figure 2 As shown, Figure 2 1 is a schematic diagram of a structure of an asset identification and troubleshooting device in one embodiment of the present invention, the asset identification and troubleshooting device comprises: An acquisition module 21 is used to acquire network connection information of each asset, wherein the network connection information includes an asset IP and an external IP address; A matching module 22, configured to use the external IP address as the IP address of an unknown asset if the external IP address fails to match each IP address in the asset IP address library, wherein the unknown asset refers to an asset whose IP address does not correspond to the asset IP address library; A query module 23, configured to query the asset IP addresses of other assets that have a network connection with the unknown asset based on the network connection information of each asset; A determination module 24, configured to determine the asset IP addresses of other assets in the same subnet as the unknown asset based on the collected network card interface information of each asset; The early warning and investigation module 25 is used to generate early warning information for investigation by the asset manager based on the asset IPs and their associated asset attribute information of other assets that have a network connection with the unknown asset, and the asset IPs and their associated asset attribute information of other assets in the same subnet as the unknown asset, wherein the asset attribute information includes the asset manager information.

[0040] The asset identification and troubleshooting device comprises: Obtain the IP addresses of each asset synchronized by the network security management platform and manually reported; The various IP addresses synchronized by the network security management platform and the manually reported IP addresses are stored in the asset IP address library as the network card IP addresses in the network card interface information of each asset.

[0041] The asset identification and troubleshooting device comprises: Filter each of the external IP addresses according to the preset intranet IP rules; The filtered external IP address is matched with each IP address in the asset IP address library.

[0042] The asset identification and troubleshooting device comprises: The network card interface information includes the asset IP and subnet information of each asset.

[0043] The determination module 24 is used to: According to the IP address of the unknown asset and the subnet information corresponding to each asset, the asset IPs of other assets in the same subnet as the unknown asset are queried.

[0044] The asset identification and troubleshooting device includes: the network connection information also includes a local IP address.

[0045] The query module 23 is used for: Based on the local IP address and external IP address in the network connection information of each asset and the IP address of the unknown asset, the asset IPs of other assets that have a network connection with the unknown asset are queried and obtained.

[0046] The asset identification and troubleshooting device comprises: The asset attribute information includes asset information, network connection information and process information of the asset; The asset information includes asset IP, device type, department, asset responsible person information, direct access information and Agent information; The process information includes asset IP, PID, PPID, startup user, startup command, running time and startup time.

[0047] The early warning and troubleshooting module 25 is also used for: Based on the asset IP of each of the other assets, query and obtain the associated asset information, network connection information and process information; Based on the asset information, network connection information and process information associated with any of the other assets, the warning information is generated and sent to the corresponding asset manager for investigation.

[0048] For the specific definition of the asset identification and troubleshooting device, please refer to the definition of the asset identification and troubleshooting method above, which will not be repeated here. Each module in the above-mentioned asset identification and troubleshooting device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0049] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, Figure 3 : is a schematic diagram of a computer device in an embodiment of the present invention. The computer device includes a processor, a memory, a network interface and a database connected by a device bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a readable storage medium and an internal memory. The readable storage medium stores an operating device, a computer-readable instruction and a database. The internal memory provides an environment for the operation of the operating device and the computer-readable instructions in the readable storage medium. The database of the computer device is used to store data involved in the asset identification and troubleshooting method. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer-readable instruction is executed by the processor, an asset identification and troubleshooting method is implemented. The readable storage medium provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0050] In one embodiment, a computer device is provided. The computer device may be a terminal device, and its internal structure diagram may be as follows: Figure 3As shown. The computer device includes a processor, a memory, and a network interface connected through a device bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a readable storage medium. The readable storage medium stores computer-readable instructions. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer-readable instructions are executed by the processor, an asset identification and troubleshooting method is implemented. The readable storage medium provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0051] In one embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, and when the processor executes the computer-readable instructions, the steps of the above-mentioned asset identification and troubleshooting method are implemented.

[0052] In one embodiment, a readable storage medium is provided, the readable storage medium stores computer-readable instructions, and the computer-readable instructions are executed by the processor to implement the steps of the asset identification and troubleshooting method as described above. A person of ordinary skill in the art can understand that the implementation of all or part of the process in the above-mentioned embodiment method can be completed by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When the computer-readable instructions are executed, they may include the process of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0053] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0054] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for asset identification and troubleshooting, characterized in that: include: Obtain network connection information of each asset, wherein the network connection information includes the asset IP and external IP address; If the external IP address fails to match each IP address in the asset IP address library, the external IP address is used as the IP address of an unknown asset, wherein the unknown asset refers to an asset whose IP address does not correspond to the asset IP address library; Based on the network connection information of each asset, query the asset IP of other assets that have network connection with the unknown asset; Based on the collected network card interface information of each asset, determine the asset IP of other assets in the same subnet as the unknown asset; Based on the asset IPs of other assets that have a network connection with the unknown asset and their associated asset attribute information, and the asset IPs of other assets in the same subnet as the unknown asset and their associated asset attribute information, an early warning information is generated for the asset manager to check, wherein the asset attribute information includes the asset manager information.

2. The asset identification and troubleshooting method according to claim 1, characterized in that: If the external IP address fails to match each IP address in the asset IP address library, before determining that the asset that fails to match is an unknown asset, the method further includes: Obtain the IP addresses of various assets synchronized by the network security management platform and manually reported; Each IP address synchronized by the network security management platform and the manually reported IP address are stored in the asset IP address library as the network card IP address in the network card interface information of each asset.

3. The asset identification and troubleshooting method according to claim 1, characterized in that: If the external IP address fails to match each IP address in the asset IP address library, before determining that the asset that fails to match is an unknown asset, the method further includes: Filter each of the external IP addresses according to the preset intranet IP rules; The filtered external IP address is matched with each IP address in the asset IP address library.

4. The asset identification and troubleshooting method according to claim 1, characterized in that: The network card interface information includes the asset IP and subnet information of each asset; The determining of the asset IP addresses of other assets in the same subnet as the unknown asset based on the collected network card interface information of each asset includes: According to the IP address of the unknown asset and the subnet information corresponding to each asset, the asset IPs of other assets in the same subnet as the unknown asset are queried.

5. The asset identification and troubleshooting method according to claim 1, characterized in that: The network connection information also includes a local IP address; the querying of the asset IP addresses of other assets that have a network connection with the unknown asset based on the network connection information of each asset includes: Based on the local IP address and external IP address in the network connection information of each asset and the IP address of the unknown asset, the asset IPs of other assets that have a network connection with the unknown asset are queried and obtained.

6. The asset identification and troubleshooting method according to claim 1, characterized in that: The asset attribute information includes asset information, network connection information and process information of the asset; The asset information includes asset IP, device type, department, asset responsible person information, direct access information and Agent information; The process information includes asset IP, PID, PPID, startup user, startup command, running time and startup time.

7. The asset identification and troubleshooting method according to claim 6, characterized in that: The generating of early warning information for investigation by the asset person in charge based on the asset IPs of other assets connected to the unknown asset and their associated asset attribute information, and the asset IPs of other assets in the same subnet as the unknown asset and their associated asset attribute information, includes: Based on the asset IP of each of the other assets, query and obtain the associated asset information, network connection information and process information; Based on the asset information, network connection information and process information associated with any of the other assets, the warning information is generated and sent to the corresponding asset manager for investigation.

8. An asset identification and troubleshooting device, characterized in that: include: An acquisition module, used to acquire network connection information of each asset, wherein the network connection information includes the asset IP and external IP address; A matching module, configured to use the external IP address as the IP address of an unknown asset if the external IP address fails to match each IP address in the asset IP address library, wherein the unknown asset refers to an asset whose IP address does not correspond to the asset IP address library; A query module, used to query the asset IP addresses of other assets that have network connections with the unknown asset based on the network connection information of each asset; A determination module, used to determine the asset IP addresses of other assets in the same subnet as the unknown asset based on the collected network card interface information of each asset; The early warning and investigation module is used to generate early warning information for investigation by the asset manager based on the asset IPs of other assets that have a network connection with the unknown asset and their associated asset attribute information, and the asset IPs of other assets in the same subnet as the unknown asset and their associated asset attribute information, wherein the asset attribute information includes the asset manager information.

9. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executed on the processor, characterized in that: When the processor executes the computer-readable instructions, the asset identification and troubleshooting method according to any one of claims 1 to 7 is implemented.

10. A readable storage medium having computer readable instructions stored thereon, characterized in that: When the computer-readable instructions are executed by a processor, the asset identification and troubleshooting method as described in any one of claims 1 to 7 is implemented.

Images