Network security protection method and device for exposed surface assets, equipment and medium

Abstract

The invention discloses a network security protection method and device for exposed surface assets, equipment and a medium. The network security protection method for the exposed surface assets comprises the following steps: acquiring domain name data, internal and external network mapping relation data and WAF inverse substitution relation data of a target business object; determining a first target mapping table according to the domain name data and the WAF inverse generation relation data, and determining a second target mapping table according to the internal and external network mapping relation data; and based on the first target mapping table and the second target mapping table, carrying out exposed surface asset network vulnerability scanning to obtain network risk identification data. According to the technical scheme of the embodiment of the invention, comprehensive exposed surface assets can be identified, and the network security protection effect of the exposed surface assets is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security protection method, device, equipment and medium for exposed surface assets. Background Art

[0002] With the continuous development of the Internet, the number of assets (such as domain names, servers, application programming interfaces, etc.) exposed by enterprises and organizations on the Internet has gradually increased. And with the complexity of the network environment and the continuous evolution of attack technologies, these exposed assets are facing more and more security threats. For any enterprise, it is crucial to understand and manage the current status of these exposed surfaces, because once these exposed surfaces are maliciously exploited, they may lead to data leakage, service interruption, or even more serious security incidents. In particular, when there are vulnerabilities in the assets in these exposed surfaces, attackers can gain unauthorized access through the vulnerabilities and then launch attacks.

[0003] Currently, these assets are usually managed and protected through various network components such as DNS, load balancers (such as F5, etc.), WAF (Web Application Firewall), etc. Some automated asset discovery tools usually use public DNS (Domain Name System) records, port scanning, SSL (Secure Socket Layer) / TLS (Transport Layer Security) certificate detection and other methods to discover assets. Although they can efficiently discover most assets exposed on the Internet, are easy to operate and deploy, they are limited to the discovery of surface assets and cannot go deep into the resources in the internal network that have been mapped to the outside. Web application firewalls can effectively detect and block attacks on exposed resources and provide real-time protection, but WAF can only analyze the traffic passing through it and cannot cover all exposed surfaces. Summary of the invention

[0004] The present invention provides a network security protection method, device, equipment and medium for exposed surface assets to solve the problem that current network security detection cannot cover all exposed surface assets and has poor network security protection effect.

[0005] According to one aspect of the present invention, a network security protection method for exposed surface assets is provided, comprising:

[0006] Obtain the domain name data of the target business object, the internal and external network mapping relationship data, and the website application-level intrusion prevention system WAF anti-generation relationship data;

[0007] Determine the first target mapping table based on the domain name data and the WAF anti-generation relationship data, and determine the second target mapping table based on the internal and external network mapping relationship data;

[0008] Based on the first target mapping table and the second target mapping table, a network vulnerability scan of exposed assets is performed to obtain network risk identification data.

[0009] According to another aspect of the present invention, a network security protection device for exposed surface assets is provided, comprising:

[0010] Data acquisition module, used to obtain domain name data of target business objects, internal and external network mapping relationship data, and website application-level intrusion prevention system WAF anti-generation relationship data;

[0011] A mapping table determination module is used to determine a first target mapping table according to domain name data and WAF anti-generation relationship data, and to determine a second target mapping table according to internal and external network mapping relationship data;

[0012] The vulnerability scanning module is used to perform network vulnerability scanning of exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security protection method for exposed surface assets described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network security protection method for exposed surface assets described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains the domain name data, internal and external network mapping relationship data and WAF anti-generation relationship data of the target business object, thereby determining the first target mapping table according to the domain name data and the WAF anti-generation relationship data, and determining the second target mapping table according to the internal and external network mapping relationship data, and then performing a network vulnerability scan of the exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data. In this solution, the domain name data, internal and external network mapping relationship data and WAF anti-generation relationship data of the target business object are integrated, and the comprehensiveness and accuracy of the exposed surface asset combing are guaranteed based on multi-source data, and the mapping relationship table generated based on multi-source data further helps to quickly locate assets hidden deep inside the network that may be exploited by attackers, solving the problem that the current network security detection cannot cover all exposed surface assets and has poor network security protection effect, and can identify comprehensive exposed surface assets and improve the network security protection effect of exposed surface assets.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A flowchart of a network security protection method for exposed surface assets provided in Embodiment 1 of the present invention;

[0022] Figure 2 A flowchart of a network security protection method for exposed surface assets provided in Embodiment 2 of the present invention;

[0023] Figure 3 A schematic diagram of the structure of a network security protection device for exposed surface assets provided in Embodiment 3 of the present invention;

[0024] Figure 4 A schematic diagram of the structure of an electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 This is a flow chart of a network security protection method for exposed surface assets provided in the first embodiment of the present invention. This embodiment is applicable to the case of comprehensive scanning of exposed surface assets. The method can be executed by a network security protection device for exposed surface assets. The network security protection device for exposed surface assets can be implemented in the form of hardware and / or software. The network security protection device for exposed surface assets can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] Step 110: Obtain domain name data, internal and external network mapping relationship data, and WAF anti-generation relationship data of the target business object.

[0030] The target business object may be the Internet traffic data of known assets of the enterprise. Domain name data is used to locate and identify the computer during data transmission. A domain name points to a certain IP (Internet Protocol) address. Intranet and extranet mapping relationship data may be data describing the intranet and extranet mapping relationship associated with the target business object. WAF anti-proxy relationship data may be relevant data describing the target business object before and after WAF anti-proxy.

[0031] In an embodiment of the present invention, known assets in the enterprise can be determined first, and then the Internet traffic data of the determined known assets, that is, the target business objects, can be collected, so as to further obtain domain name data, internal and external network mapping relationship data and WAF reverse generation relationship data associated with the target business objects.

[0032] Step 120: Determine a first target mapping table based on the domain name data and the WAF reverse proxy relationship data, and determine a second target mapping table based on the internal and external network mapping relationship data.

[0033] The first target mapping table may be a table obtained by associating domain name data with WAF reverse generation relationship data. The second target mapping table may be a table describing the mapping relationship between the internal and external networks. Exemplarily, the second target mapping table may be composed of an internal network IP and an external network IP, or may be composed of an internal network IP, an external network IP, an internal network port, and an external network port.

[0034] In an embodiment of the present invention, domain name data and WAF anti-generation relationship data can be parsed to determine the data mapping relationship between the domain name data and the WAF anti-generation relationship data. Based on the data mapping relationship between the domain name data and the key data in the WAF anti-generation relationship data, a first target mapping table is created, and the internal and external network mapping relationship data are parsed to obtain the data mapping relationship between the internal and external networks, so as to create a second target mapping table based on the data mapping relationship between the internal and external networks.

[0035] The data mapping relationship between domain name data and WAF reverse proxy data can be understood as the corresponding relationship between a domain name and multiple WAF related data, which can be used to determine the strongly related data before and after WAF reverse proxy corresponding to the domain name when the client of the enterprise's known assets accesses the web page. The data mapping relationship between the internal and external networks can be understood as the corresponding relationship between the internal and external network IPs (or the internal and external network IPs and ports).

[0036] Step 130: Based on the first target mapping table and the second target mapping table, perform a network vulnerability scan of exposed surface assets to obtain network risk identification data.

[0037] Among them, the network risk identification data can be data that describes whether the target business object has a risk of network attack.

[0038] In an embodiment of the present invention, the first target mapping table and the second target mapping table may be aggregated and fused in a form to obtain a final exposure surface mapping table, thereby performing a network vulnerability scan on the exposure surface assets based on the exposure surface mapping table to obtain network risk identification data.

[0039] Optionally, the exposed assets in this article are all resources that are publicly visible and potentially accessible on the Internet, including but not limited to web servers, APIs, domain names and subdomains registered by enterprises or organizations on the Internet, and cloud resources (such as storage buckets, virtual machines, and databases, etc.). Web servers are servers used to provide website or application services, and interact with users through specific domain names and IP addresses. APIs are program interfaces for external systems or applications to access, usually exposed on the public Internet, for data interaction or service calls.

[0040] The technical solution of the embodiment of the present invention obtains the domain name data, internal and external network mapping relationship data and WAF anti-generation relationship data of the target business object, thereby determining the first target mapping table according to the domain name data and the WAF anti-generation relationship data, and determining the second target mapping table according to the internal and external network mapping relationship data, and then performing a network vulnerability scan of the exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data. In this solution, the domain name data, internal and external network mapping relationship data and WAF anti-generation relationship data of the target business object are integrated, and the comprehensiveness and accuracy of the exposed surface asset combing are guaranteed based on multi-source data, and the mapping relationship table generated based on multi-source data further helps to quickly locate assets hidden deep inside the network that may be exploited by attackers, solving the problem that the current network security detection cannot cover all exposed surface assets and has poor network security protection effect, and can identify comprehensive exposed surface assets and improve the network security protection effect of exposed surface assets.

[0041] Embodiment 2

[0042] Figure 2 This is a flowchart of a network security protection method for exposed assets provided by the second embodiment of the present invention. This embodiment is specific based on the above embodiment and provides a specific optional implementation method for obtaining the domain name data, internal and external network mapping relationship data and WAF reverse generation relationship data of the target business object. Figure 2 As shown, the method includes:

[0043] Step 210: Acquire the domain name resolution data of the target business object and the global load balancing domain name data, and determine the domain name data according to the domain name resolution data and the global load balancing domain name data.

[0044] The domain name resolution data can be the domain name accessed by the target business object corresponding to the client, which is queried based on the domain name resolution service tool. The global load balancing domain name data can be the domain name accessed by the target business object corresponding to the client when the F5 global load balancer is configured before the DNS server.

[0045] In an embodiment of the present invention, domain name resolution data collected by a pre-selected domain name resolution service tool (such as DNSPod, etc.) can be obtained through API calls. Based on the F5 global load balancer interface, global load balancing domain name data when using the F5 global load balancer can be obtained, and then the domain name resolution data and the global load balancing domain name data can be preprocessed to obtain domain name data.

[0046] In an optional embodiment of the present invention, determining the domain name data based on the domain name resolution data and the global load balancing domain name data may include: removing the load balancing field from the domain name resolution data and the global load balancing domain name data to obtain the domain name data.

[0047] Among them, the load balancing field removal can be used to remove the F5 field in the domain name.

[0048] In the embodiment of the present invention, the domain name resolution data and the global load balancing domain name data may be merged, and the domain name field loaded by F5 may be removed, that is, the load balancing field may be removed to obtain the final domain name data.

[0049] Step 220: crawl the load balancing virtual service and network topology map page associated with the target business object, collect the internal and external network mapping relationship data, and obtain the WAF reverse generation relationship data through the target WAF interface.

[0050] The load balancing virtual service may be an F5 Virtual Server. The network topology map page may be a Network Map page. The target WAF interface may be a WAF interface associated with the target business object.

[0051] In an embodiment of the present invention, web crawler technology can be used to crawl the load balancing virtual service and network topology map page associated with the target business object, collect internal and external network mapping relationship data, and then determine the target WAF interface associated with the target business object, thereby obtaining WAF reverse generation relationship data through the target WAF interface.

[0052] In an optional embodiment of the present invention, crawling the load balancing virtual service and the network topology map page associated with the target business object and collecting the internal and external network mapping relationship data may include: crawling the load balancing virtual service associated with the target business object, determining the external network IP and the external network port, and crawling the network topology map page associated with the target business object, determining the internal network mapping IP and the internal network port; determining the internal and external network mapping relationship data based on the external network IP, the external network port, the internal network mapping IP and the internal network port.

[0053] The intranet mapped IP may be the intranet IP corresponding to the external network IP.

[0054] In an embodiment of the present invention, the load balancing virtual service associated with the target business object can be crawled to obtain the external network IP and external network port for Internet access by the enterprise's known assets. The network topology map page associated with the target business object can also be crawled to obtain the internal network mapping IP and internal network port of the external network mapped to the internal network for Internet access by the enterprise's known assets, and then the external network IP, external network port, internal network mapping IP and internal network port can be used as internal and external network mapping relationship data.

[0055] Step 230: Determine a first target mapping table based on the domain name data and the WAF anti-generation relationship data, and determine a second target mapping table based on the internal and external network mapping relationship data.

[0056] In an optional embodiment of the present invention, determining the first target mapping table based on domain name data and WAF anti-generation relationship data may include: determining server data to be associated, WAF data to be associated, virtual machine port data and external network IP according to the WAF anti-generation relationship data; creating the first target mapping table based on the domain name data, server data to be associated, WAF data to be associated, virtual machine port and external network IP.

[0057] The server data to be associated may be server-related data required to create the first target mapping table. The server data to be associated may include server port and server IP. The WAF data to be associated may be WAF-related data parsed from WAF reverse generation relationship data and required to create the first target mapping table. The WAF data to be associated may include WAF port and WAF IP. The virtual machine port data may be used to characterize the port of the virtual machine connected to the WAF.

[0058] In an embodiment of the present invention, WAF reverse proxy relationship data can be parsed to determine the DNS server used for network traffic data transmission before and after WAF reverse proxy, and the server data to be associated is obtained according to the DNS server, and then based on the WAF reverse proxy relationship data, the WAF data to be associated and the virtual machine port data are determined, thereby creating a first target mapping table using the domain name data, server data to be associated, WAF data to be associated, virtual machine port and external network IP.

[0059] Step 240: Based on the first target mapping table and the second target mapping table, perform a network vulnerability scan of exposed surface assets to obtain network risk identification data.

[0060] In an optional embodiment of the present invention, after performing a network vulnerability scan of exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data, it may also include: evaluating the risk level of exposed surface assets based on the network risk identification data; and generating exposed surface risk reporting data based on the network risk identification data and the risk level of exposed surface assets.

[0061] The exposed asset risk level may be the level of network risk faced by the exposed asset corresponding to the network risk identification data. The exposed risk reporting data may be data describing the exposed asset being subjected to network attacks.

[0062] In an embodiment of the present invention, a pre-set network risk level classification rule can be obtained, so as to determine the network risk level of the network risk identification data based on the network risk level classification rule, that is, obtain the exposed surface asset risk level, and thus generate exposed surface risk reporting data according to a preset template based on the network risk identification data and the exposed surface asset risk level, and notify the exposed surface risk reporting data based on the warning urgency corresponding to the exposed surface asset risk level.

[0063] In an optional embodiment of the present invention, after performing a network vulnerability scan of exposed assets based on the first target mapping table and the second target mapping table to obtain network risk identification data, it may also include: updating the network risk identification data based on a preset data update cycle, and querying the current network maintenance configuration data; generating a real-time risk report based on the updated network risk identification data and the current network maintenance configuration data.

[0064] The preset data update cycle may be a preset cycle for updating the network risk identification data. The current network maintenance configuration data may be the configuration data of the network maintenance when the network risk identification data is updated.

[0065] In an embodiment of the present invention, operation and maintenance personnel can set a preset data update cycle as needed, so as to automatically update the network risk identification data of exposed surface assets regularly based on the preset data update cycle, and query the current network maintenance configuration data when the network risk identification data is updated, and then use the updated network risk identification data and the current network maintenance configuration data to generate a real-time risk report.

[0066] Optionally, when an enterprise enables new services or changes network maintenance configuration data, this solution can be used to reflect data changes in real time and update exposure information, ensuring continuous security monitoring.

[0067] It has been verified that the network security protection method for exposed assets based on this solution collects domain name data, internal and external network mapping relationship data, and WAF reverse generation relationship data of target business objects, processes the aforementioned multi-dimensional data to generate a final exposure mapping table, and further completes risk analysis, output, and management based on the final exposure mapping table, successfully identifying all exposed assets of the enterprise, including some hidden assets that have not been identified by manual audits. It has significant effects in combing and real-time updating of Internet exposure surfaces, and can effectively improve the network security protection capabilities of enterprises. The mechanism of automatically generating and continuously updating information related to exposure surfaces can not only reduce manual intervention, but also dynamically adapt to changes in the Internet environment, maintain the real-time and accuracy of exposure information, and continuously track changes in Internet exposure surfaces to provide more timely security protection.

[0068] The technical solution of the embodiment of the present invention obtains the domain name resolution data and global load balancing domain name data of the target business object, and determines the domain name data according to the domain name resolution data and the global load balancing domain name data, and then crawls the load balancing virtual service and network topology map page of the target business object, collects the internal and external network mapping relationship data, and obtains the WAF reverse generation relationship data through the WAF interface of the target business object, and further determines the first target mapping table according to the domain name data and the WAF reverse generation relationship data, and determines the second target mapping table according to the internal and external network mapping relationship data, so as to perform network vulnerability scanning of the exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data. In this solution, the domain name data, the internal and external network mapping relationship data and the WAF reverse generation relationship data of the target business object are integrated, and the comprehensiveness and accuracy of the exposed surface asset combing are guaranteed based on multi-source data, and the mapping relationship table generated based on multi-source data further helps to quickly locate the assets hidden deep inside the network that may be exploited by attackers, solves the problem that the current network security detection cannot cover all exposed surface assets and has poor network security protection effect, can identify comprehensive exposed surface assets, and improve the network security protection effect of exposed surface assets.

[0069] Embodiment 3

[0070] Figure 3 This is a schematic diagram of the structure of a network security protection device for exposed surface assets provided by Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0071] Data acquisition module 310, used to acquire domain name data of target business objects, internal and external network mapping relationship data, and website application-level intrusion prevention system WAF anti-generation relationship data;

[0072] A mapping table determination module 320 is used to determine a first target mapping table according to the domain name data and the WAF reverse generation relationship data, and to determine a second target mapping table according to the internal and external network mapping relationship data;

[0073] The vulnerability scanning module 330 is used to perform network vulnerability scanning of exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data.

[0074] The technical solution of the embodiment of the present invention obtains the domain name data, internal and external network mapping relationship data and WAF anti-generation relationship data of the target business object, thereby determining the first target mapping table according to the domain name data and the WAF anti-generation relationship data, and determining the second target mapping table according to the internal and external network mapping relationship data, and then performing a network vulnerability scan of the exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data. In this solution, the domain name data, internal and external network mapping relationship data and WAF anti-generation relationship data of the target business object are integrated, and the comprehensiveness and accuracy of the exposed surface asset combing are guaranteed based on multi-source data, and the mapping relationship table generated based on multi-source data further helps to quickly locate assets hidden deep inside the network that may be exploited by attackers, solving the problem that the current network security detection cannot cover all exposed surface assets and has poor network security protection effect, and can identify comprehensive exposed surface assets and improve the network security protection effect of exposed surface assets.

[0075] Optionally, the data acquisition module 310 is specifically used to obtain the domain name resolution data and global load balancing domain name data of the target business object, and determine the domain name data based on the domain name resolution data and the global load balancing domain name data; crawl the load balancing virtual service and network topology map page associated with the target business object, collect the internal and external network mapping relationship data, and obtain the WAF reverse generation relationship data through the target WAF interface.

[0076] Optionally, the data acquisition module 310 is specifically used to remove the load balancing field from the domain name resolution data and the global load balancing domain name data to obtain the domain name data.

[0077] Optionally, the data acquisition module 310 is specifically used to crawl the load balancing virtual service associated with the target business object, determine the external Internet Protocol IP and the external network port, and crawl the network topology map page associated with the target business object to determine the intranet mapping IP and the intranet port; determine the internal and external network mapping relationship data based on the external network IP, the external network port, the internal network mapping IP and the intranet port.

[0078] Optionally, the mapping table determination module 320 is specifically used to determine the server data to be associated, the WAF data to be associated, the virtual machine port data and the external network IP according to the WAF anti-generation relationship data; and create the first target mapping table based on the domain name data, the server data to be associated, the WAF data to be associated, the virtual machine port and the external network IP.

[0079] Optionally, the network security protection device for exposed surface assets also includes a first data aggregation module, which is used to evaluate the risk level of the exposed surface assets based on the network risk identification data; and generate exposure surface risk reporting data according to the network risk identification data and the risk level of the exposed surface assets.

[0080] Optionally, the network security protection device for exposed surface assets also includes a second data aggregation module, which is used to update the network risk identification data based on a preset data update cycle and query the current network maintenance configuration data; and generate a real-time risk report based on the updated network risk identification data and the current network maintenance configuration data.

[0081] The network security protection device for exposed surface assets provided by the embodiment of the present invention can execute the network security protection method for exposed surface assets provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0082] Embodiment 4

[0083] Figure 4 A schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0084] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0085] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0086] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network security protection method for exposed surface assets.

[0087] In some embodiments, the network security protection method for exposed surface assets can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network security protection method for exposed surface assets described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the network security protection method for exposed surface assets in any other appropriate manner (for example, by means of firmware).

[0088] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0089] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0090] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0091] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0092] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0093] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of traditional physical hosts and VPS servers, which are difficult to manage and have weak business scalability.

[0094] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0095] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security protection method for exposed surface assets, characterized in that: include: Obtain the domain name data of the target business object, the internal and external network mapping relationship data, and the website application-level intrusion prevention system WAF anti-generation relationship data; Determine a first target mapping table according to the domain name data and the WAF anti-generation relationship data, and determine a second target mapping table according to the internal and external network mapping relationship data; Based on the first target mapping table and the second target mapping table, a network vulnerability scan of exposed surface assets is performed to obtain network risk identification data.

2. The method according to claim 1, characterized in that: Obtain the domain name data, internal and external network mapping relationship data, and WAF anti-generation relationship data of the target business object, including: Acquire the domain name resolution data and the global load balancing domain name data of the target business object, and determine the domain name data according to the domain name resolution data and the global load balancing domain name data; Crawl the load balancing virtual service and network topology map pages associated with the target business object, collect the internal and external network mapping relationship data, and obtain the WAF reverse generation relationship data through the target WAF interface.

3. The method according to claim 2, characterized in that Determining the domain name data according to the domain name resolution data and the global load balancing domain name data includes: The domain name resolution data and the global load balancing domain name data are subjected to load balancing field elimination to obtain the domain name data.

4. The method according to claim 2, characterized in that: Crawl the load balancing virtual service and network topology map pages associated with the target business object, and collect the internal and external network mapping relationship data, including: Crawl the load balancing virtual service associated with the target business object, determine the external Internet Protocol IP and external network port, and crawl the network topology map page associated with the target business object, determine the internal network mapping IP and internal network port; The internal and external network mapping relationship data is determined according to the external network IP, the external network port, the internal network mapping IP and the internal network port.

5. The method according to claim 4, characterized in that Determining a first target mapping table according to the domain name data and the WAF anti-generation relationship data includes: According to the WAF anti-generation relationship data, determine the server data to be associated, the WAF data to be associated, the virtual machine port data and the external network IP; The first target mapping table is created based on the domain name data, the server data to be associated, the WAF data to be associated, the virtual machine port and the external network IP.

6. The method according to claim 1, characterized in that After performing a network vulnerability scan of exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data, the method further includes: Based on the network risk identification data, assess the risk level of exposed assets; Generate exposure surface risk reporting data based on the network risk identification data and the exposure surface asset risk level.

7. The method according to claim 6, characterized in that After performing network vulnerability scanning of exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data, the method further includes: Based on a preset data update cycle, update the network risk identification data and query the current network maintenance configuration data; A real-time risk report is generated based on the updated network risk identification data and the current network maintenance configuration data.

8. A network security protection device for exposed surface assets, characterized in that: include: Data acquisition module, used to obtain domain name data of target business objects, internal and external network mapping relationship data, and website application-level intrusion prevention system WAF anti-generation relationship data; A mapping table determination module, used to determine a first target mapping table according to the domain name data and the WAF anti-generation relationship data, and to determine a second target mapping table according to the internal and external network mapping relationship data; The vulnerability scanning module is used to perform network vulnerability scanning of exposed surface assets based on the first target mapping table and the second target mapping table to obtain network risk identification data.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security protection method for exposed surface assets described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network security protection method for exposed surface assets described in any one of claims 1-7 when executed.

Images