Network space asset investigation method and system based on NMAP

Abstract

The invention provides a network space asset investigation method and system based on an NMAP, and the method comprises the steps: S1, generating a command line instruction according to scanning information submitted by a user at a browser end, calling the NMAP to execute an asset scanning task on a target network, and storing a scanning result in an xml file format; s2, after scanning is completed, reading the xml file, circularly traversing file content according to a matching rule, analyzing a target IP address, an operating system, a port and a service, associating the operating system, the port and the service with the IP address, and storing the associated operating system, the associated port and the associated service in a database; s3, associating the parsed IP addresses by using an asset topology generation algorithm to obtain a network topology structure, and storing the network topology structure in a database; and S4, the user modifies and supplements the scanning result at the browser end. According to the invention, the accuracy of asset investigation is ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security testing, and in particular to a method and system for investigating cyberspace assets based on NMAP. Background Art

[0002] With the continuous development and expansion of information networks, there are a large number of terminals, servers and network devices in the network. These computers and devices run various operating systems, software programs and services. Information security incidents such as network attacks and information leakage are increasing day by day. From a technical perspective, whether the attacker launches an attack from outside or inside the system, most of them rely on exploiting the open ports or system weaknesses of the system to launch attacks. In order to prevent the network from being attacked and invaded, it is necessary to conduct comprehensive and accurate detection of cyberspace assets, and conduct security tests based on this, so as to timely discover vulnerabilities and reduce threats.

[0003] NMAP is an open source port scanning tool for the network. It can detect whether the target host is online, the openness of the host port, the service type and version information running on the host, the operating system and device type, etc.

[0004] Directly using NMAP for asset surveys may have some defects, including false positives and omissions, missing service versions, and unclear results. NMAP will falsely report active hosts or services, and sometimes miss hidden or uncommon hosts or services, which leads to insufficient understanding of the network; NMAP sometimes cannot accurately determine the version information of the service, which affects the accuracy and credibility of security assessments and vulnerability detection; NMAP results lack topological relationships, and the hierarchical relationship of assets is not clear, which makes it difficult to understand and analyze network topology. Taking these defects into consideration, when using NMAP for asset surveys, it is necessary to combine other methods to obtain more comprehensive and accurate asset information. Summary of the invention

[0005] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for investigating cyberspace assets based on NMAP.

[0006] A network space asset investigation method based on NMAP provided by the present invention includes:

[0007] Step S1: Generate a command line instruction to call NMAP to perform asset scanning tasks on the target network according to the scanning information submitted by the user on the browser side, and save the scanning results in an XML file format;

[0008] Step S2: After the scan is completed, read the XML file, loop through the file content according to the matching rules, parse the target IP address, operating system, port and service, associate the operating system, port and service with the IP address and save them in the database;

[0009] Step S3: using the asset topology generation algorithm to associate the resolved IP addresses, obtain the network topology structure, and save it in the database;

[0010] Step S4: The user modifies and supplements the scanning results on the browser side.

[0011] Preferably, in step S1:

[0012] Receiving scanning information and executing scanning tasks specifically include:

[0013] Step S1.1: The scanning target submitted by the user on the browser side is a single IP address, multiple IP addresses, IP address range or network segment. The control side generates the command line instructions of the NMAP scan according to the template based on the scanning information:

[0014] nmap-T4-Av-oX filename.xml;

[0015] Among them, -T4 indicates the timing used in the scanning process, which has 6 levels in total. The higher the level, the faster the scanning speed; -A indicates the use of aggressive scanning; -v indicates the display of redundant information, which displays the scanning details during the scanning process; -oX indicates that the scanning results will be generated into an xml file. If it is interrupted, the results cannot be opened, and the file name is named according to the scanning target;

[0016] Step S1.2: The control end uses the Springboot framework to call NMAP to perform the scanning task through the exec() method command line instruction of the Runtime class, and saves the scanning results as an XML file.

[0017] Preferably, in step S2:

[0018] Parse and extract the XML file to obtain the target IP address, operating system, port and service, associate the operating system, port and service with the IP address, and save them to the database:

[0019] Step S2.1: parse the XML file by introducing the DOM4J dependency library, traverse the content of the file by using the regular matching method, use the host and address keywords to match to find all the target IP addresses, and save each IP address into the database as a server type;

[0020] Step S2.2: Under each IP address, use the ports, port, portid, state, service, and os keyword matching to find the port number, state, service, and operating system in the server corresponding to the IP address; save each port number in the database as the type of service, save the operating system in the database as the type of operating system, and associate the service and operating system with the corresponding server.

[0021] Preferably, in step S3:

[0022] After parsing the XML result file and saving it to the database, use the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it to the database:

[0023] Step S3.1: According to the IP addresses of the assets of server type in the database, count their IP network segments, and add a router record in the database for each network segment. If the server in the database involves two network segments, add two router records in the database;

[0024] Step S3.2: associate each router with all servers under the network segment corresponding to the router, and save the connection relationship in a database.

[0025] Preferably, in step S4:

[0026] Users can modify and supplement the scan results on the browser side, view asset information and topology information on the browser side, and edit assets, add assets, and edit topology based on actual conditions.

[0027] A network space asset investigation system based on NMAP provided by the present invention comprises:

[0028] Module M1: Generates command line instructions to call NMAP to perform asset scanning tasks on the target network based on the scanning information submitted by the user on the browser side, and saves the scanning results in XML file format;

[0029] Module M2: After the scan is completed, read the XML file, loop through the file content according to the matching rules, parse the target IP address, operating system, port and service, associate the operating system, port and service with the IP address and save them in the database;

[0030] Module M3: Use the asset topology generation algorithm to associate the resolved IP addresses, obtain the network topology structure, and save it in the database;

[0031] Module M4: The user modifies and supplements the scanning results on the browser side.

[0032] Preferably, in the module M1:

[0033] Receiving scanning information and executing scanning tasks specifically include:

[0034] Module M1.1: The scan target submitted by the user on the browser side is a single IP address, multiple IP addresses, IP address range or network segment. The control side generates NMAP scan command line instructions according to the template based on the scan information:

[0035] nmap-T4-Av-oX filename.xml;

[0036] Among them, -T4 indicates the timing used in the scanning process, which has 6 levels in total. The higher the level, the faster the scanning speed; -A indicates the use of aggressive scanning; -v indicates the display of redundant information, which displays the scanning details during the scanning process; -oX indicates that the scanning results will be generated into an xml file. If it is interrupted, the results cannot be opened, and the file name is named according to the scanning target;

[0037] Module M1.2: The control end uses the Springboot framework, calls NMAP to perform scanning tasks through the exec() method command line instruction of the Runtime class, and saves the scanning results as an XML file.

[0038] Preferably, in the module M2:

[0039] Parse and extract the XML file to obtain the target IP address, operating system, port and service, associate the operating system, port and service with the IP address, and save them to the database:

[0040] Module M2.1: Parse the XML file by introducing the DOM4J dependency library, traverse the contents of the file through the regular matching method, use the host and address keywords to match to find all target IP addresses, and save each IP address into the database as a server type;

[0041] Module M2.2: Under each IP address, use the ports, port, portid, state, service, and os keyword matching to find the port number, state, service, and operating system in the server corresponding to the IP address; save each port number in the database as the service type, save the operating system in the database as the operating system type, and associate the service and operating system with the corresponding server.

[0042] Preferably, in the module M3:

[0043] After parsing the XML result file and saving it to the database, use the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it to the database:

[0044] Module M3.1: According to the IP addresses of the assets in the database whose type is server, count their IP network segments, and add a new router record in the database for each network segment. If the server in the database involves two network segments, add two router records in the database;

[0045] Module M3.2: Associate each router with all servers under the network segment corresponding to the router, and save the connection relationship in the database.

[0046] Preferably, in the module M4:

[0047] Users can modify and supplement the scan results on the browser side, view asset information and topology information on the browser side, and edit assets, add assets, and edit topology based on actual conditions.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. The present invention utilizes a distributed high-speed network scanning service architecture consisting of a browser end, a control end, and a scanning server end to realize a network scanning service prototype, and can perform corrections and supplements on the scanning results at the browser end, thereby ensuring the accuracy of the asset investigation.

[0050] 2. The present invention utilizes an asset topology generation algorithm to process the scanning results and presents the asset survey results in a graphical and multi-level manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0052] Figure 1 This is a flowchart of the cyberspace asset investigation method based on Nmap. DETAILED DESCRIPTION

[0053] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0054] Embodiment 1:

[0055] The purpose of the present invention is to provide a cyberspace asset survey method based on NMAP, which is convenient for testers to obtain more comprehensive and accurate asset survey information and provide a basis for the formulation of the next test plan.

[0056] According to a network space asset investigation method based on NMAP provided by the present invention, Figure 1 As shown, including:

[0057] Step S1: Generate a command line instruction to call NMAP to perform asset scanning tasks on the target network according to the scanning information submitted by the user on the browser side, and save the scanning results in an XML file format;

[0058] Specifically, in step S1:

[0059] Receiving scanning information and executing scanning tasks specifically include:

[0060] Step S1.1: The scanning target submitted by the user on the browser side is a single IP address, multiple IP addresses, IP address range or network segment. The control side generates the command line instructions of the NMAP scan according to the template based on the scanning information:

[0061] nmap-T4-Av-oX filename.xml;

[0062] Among them, -T4 indicates the timing used in the scanning process, which has 6 levels in total. The higher the level, the faster the scanning speed; -A indicates the use of aggressive scanning; -v indicates the display of redundant information, which displays the scanning details during the scanning process; -oX indicates that the scanning results will be generated into an xml file. If it is interrupted, the results cannot be opened, and the file name is named according to the scanning target;

[0063] Step S1.2: The control end uses the Springboot framework to call NMAP to perform the scanning task through the exec() method command line instruction of the Runtime class, and saves the scanning results as an XML file.

[0064] Step S2: After the scan is completed, read the XML file, loop through the file content according to the matching rules, parse the target IP address, operating system, port and service, associate the operating system, port and service with the IP address and save them in the database;

[0065] Specifically, in step S2:

[0066] Parse and extract the XML file to obtain the target IP address, operating system, port and service, associate the operating system, port and service with the IP address, and save them to the database:

[0067] Step S2.1: parse the XML file by introducing the DOM4J dependency library, traverse the content of the file by using the regular matching method, use the host and address keywords to match to find all the target IP addresses, and save each IP address into the database as a server type;

[0068] Step S2.2: Under each IP address, use the ports, port, portid, state, service, and os keyword matching to find the port number, state, service, and operating system in the server corresponding to the IP address; save each port number in the database as the type of service, save the operating system in the database as the type of operating system, and associate the service and operating system with the corresponding server.

[0069] Step S3: using the asset topology generation algorithm to associate the resolved IP addresses, obtain the network topology structure, and save it in the database;

[0070] Specifically, in step S3:

[0071] After parsing the XML result file and saving it to the database, use the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it to the database:

[0072] Step S3.1: According to the IP addresses of the assets of server type in the database, count their IP network segments, and add a router record in the database for each network segment. If the server in the database involves two network segments, add two router records in the database;

[0073] Step S3.2: associate each router with all servers under the network segment corresponding to the router, and save the connection relationship in a database.

[0074] Step S4: The user modifies and supplements the scanning results on the browser side.

[0075] Specifically, in step S4:

[0076] Users can modify and supplement the scan results on the browser side, view asset information and topology information on the browser side, and edit assets, add assets, and edit topology based on actual conditions.

[0077] Embodiment 2:

[0078] Embodiment 2 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0079] The present invention also provides a network space asset survey system based on NMAP, and the network space asset survey system based on NMAP can be implemented by executing the process steps of the network space asset survey method based on NMAP, that is, those skilled in the art can understand the network space asset survey method based on NMAP as a preferred implementation of the network space asset survey system based on NMAP.

[0080] A network space asset investigation system based on NMAP provided by the present invention comprises:

[0081] Module M1: Generates command line instructions to call NMAP to perform asset scanning tasks on the target network based on the scanning information submitted by the user on the browser side, and saves the scanning results in XML file format;

[0082] Specifically, in the module M1:

[0083] Receiving scanning information and executing scanning tasks specifically include:

[0084] Module M1.1: The scan target submitted by the user on the browser side is a single IP address, multiple IP addresses, IP address range or network segment. The control side generates NMAP scan command line instructions according to the template based on the scan information:

[0085] nmap-T4-Av-oX filename.xml;

[0086] Among them, -T4 indicates the timing used in the scanning process, which has 6 levels in total. The higher the level, the faster the scanning speed; -A indicates the use of aggressive scanning; -v indicates the display of redundant information, which displays the scanning details during the scanning process; -oX indicates that the scanning results will be generated into an xml file. If it is interrupted, the results cannot be opened, and the file name is named according to the scanning target;

[0087] Module M1.2: The control end uses the Springboot framework, calls NMAP to perform scanning tasks through the exec() method command line instruction of the Runtime class, and saves the scanning results as an XML file.

[0088] Module M2: After the scan is completed, read the XML file, loop through the file content according to the matching rules, parse the target IP address, operating system, port and service, associate the operating system, port and service with the IP address and save them in the database;

[0089] Specifically, in the module M2:

[0090] Parse and extract the XML file to obtain the target IP address, operating system, port and service, associate the operating system, port and service with the IP address, and save them to the database:

[0091] Module M2.1: Parse the XML file by introducing the DOM4J dependency library, traverse the contents of the file through the regular matching method, use the host and address keywords to match to find all target IP addresses, and save each IP address into the database as a server type;

[0092] Module M2.2: Under each IP address, use the ports, port, portid, state, service, and os keyword matching to find the port number, state, service, and operating system in the server corresponding to the IP address; save each port number in the database as the service type, save the operating system in the database as the operating system type, and associate the service and operating system with the corresponding server.

[0093] Module M3: Use the asset topology generation algorithm to associate the resolved IP addresses, obtain the network topology structure, and save it in the database;

[0094] Specifically, in the module M3:

[0095] After parsing the XML result file and saving it to the database, use the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it to the database:

[0096] Module M3.1: According to the IP addresses of the assets in the database whose type is server, count their IP network segments, and add a new router record in the database for each network segment. If the server in the database involves two network segments, add two router records in the database;

[0097] Module M3.2: Associate each router with all servers under the network segment corresponding to the router, and save the connection relationship in the database.

[0098] Module M4: The user modifies and supplements the scanning results on the browser side.

[0099] Specifically, in the module M4:

[0100] Users can modify and supplement the scan results on the browser side, view asset information and topology information on the browser side, and edit assets, add assets, and edit topology based on actual conditions.

[0101] Embodiment 3:

[0102] Embodiment 3 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0103] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the present invention.

[0104] See also Figure 1 The present invention proposes a network space asset investigation method based on Nmap, the method comprising:

[0105] Step S100, based on the scanning information submitted by the user on the browser side, generates a command line instruction to call NMAP to perform an asset scanning task on the target network, and saves the scanning result in an XML file format. Step S100 includes:

[0106] In step S101, the scanning target submitted by the user on the browser side may be a single IP address (such as 192.168.1.100), multiple IP addresses (such as 192.168.1.100 192.168.2.100), an IP address range (such as 192.168.1.100-110) or a network segment (such as 192.168.1.1 / 24). The control side generates a command line instruction for NMAP scanning according to the template of "nmap-T4-Av-oX filename.xml [scan target IP address (or network segment)]" based on the scanning information. Among them, "-T4" indicates the timing used in the scanning process. There are 6 levels in total. The higher the level, the faster the scanning speed, but it is also easier to be detected and blocked by firewalls or IDS. It is recommended to use T4 when the network conditions are good; "-A" means to use offensive scanning; "-v" means to display redundant information and display the scanning details during the scanning process; "-oX" means to generate the scanning results into an xml file. If it is interrupted, the result cannot be opened. The file name is named according to the scan target.

[0107] Step S102, the control end uses the Springboot framework to call NMAP to execute the scanning task through the exec() method command line instruction of the Runtime class, and saves the scanning result as an XML file.

[0108] Among them, after step S100, step S200 reads the xml file after the scanning is completed, loops through the file content according to the matching rules, parses the target IP address, operating system, port and service, etc., and associates the operating system, port and service with the IP address and saves them in the database. Step S200 specifically includes:

[0109] Step S201, parse the XML file by introducing the DOM4J dependency library, traverse the content in the file by regular matching, and use the "host" and "address" keyword matching to find all target IP addresses. Save each IP address in the database as a server type. For example, if 3 IP addresses are parsed from the XML file, there will be 3 server records in the database.

[0110] Step S202, under each IP address, use the keyword matching such as "ports", "port", "portid", "state", "service", "os" to find the port number, state, service, and operating system in the server corresponding to the IP address. Then save each port number in the database as the type of service, save the operating system in the database as the type of operating system, and associate the service and operating system with the corresponding server.

[0111] After the XML result file is parsed and saved in the database in step S200, step S300 uses the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it in the database.

[0112] Step S300 specifically includes:

[0113] Step S301, according to the IP address of the asset type server in the database, count its IP network segment, and add a router record in the database for each network segment. For example, if the server in the database involves two network segments 192.168.1.1 / 24 and 192.168.2.1 / 24, then two router records need to be added in the database.

[0114] Step S302, associate each router with all servers in the network segment corresponding to the router, and save the connection relationship in a database.

[0115] After step S300, the user modifies and supplements the scan result on the browser side in step S400. Step S400 specifically includes: the user views asset information and topology information on the browser side, edits assets, adds new assets, and edits topology according to actual conditions.

[0116] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, the system and its various devices, modules, and units provided by the present invention can be completely realized in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps to realize the same functions. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0117] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A network space asset investigation method based on NMAP, characterized in that: include: Step S1: Generate a command line instruction to call NMAP to perform asset scanning tasks on the target network according to the scanning information submitted by the user on the browser side, and save the scanning results in an XML file format; Step S2: After the scan is completed, read the XML file, loop through the file content according to the matching rules, parse the target IP address, operating system, port and service, associate the operating system, port and service with the IP address and save them in the database; Step S3: using the asset topology generation algorithm to associate the resolved IP addresses, obtain the network topology structure, and save it in the database; Step S4: The user modifies and supplements the scanning results on the browser side.

2. The method for investigating cyberspace assets based on NMAP according to claim 1, characterized in that: In step S1: Receiving scanning information and executing scanning tasks specifically include: Step S1.1: The scanning target submitted by the user on the browser side is a single IP address, multiple IP addresses, IP address range or network segment. The control side generates the command line instructions of the NMAP scan according to the template based on the scanning information: nmap-T4-Av-oX filename.xml; Among them, -T4 indicates the timing used in the scanning process, which has 6 levels in total. The higher the level, the faster the scanning speed; -A indicates the use of aggressive scanning; -v indicates the display of redundant information, which displays the scanning details during the scanning process; -oX indicates that the scanning results will be generated into an xml file. If it is interrupted, the results cannot be opened, and the file name is named according to the scanning target; Step S1.2: The control end uses the Springboot framework to call NMAP to perform the scanning task through the exec() method command line instruction of the Runtime class, and saves the scanning results as an XML file.

3. The method for investigating cyberspace assets based on NMAP according to claim 1, characterized in that: In step S2: Parse and extract the XML file to obtain the target IP address, operating system, port and service, associate the operating system, port and service with the IP address, and save them to the database: Step S2.1: parse the XML file by introducing the DOM4J dependency library, traverse the content of the file by using the regular matching method, use the host and address keywords to match to find all the target IP addresses, and save each IP address into the database as a server type; Step S2.2: Under each IP address, use the ports, port, portid, state, service, and os keyword matching to find the port number, state, service, and operating system in the server corresponding to the IP address; save each port number in the database as the type of service, save the operating system in the database as the type of operating system, and associate the service and operating system with the corresponding server.

4. The method for investigating cyberspace assets based on NMAP according to claim 1, characterized in that: In step S3: After parsing the XML result file and saving it to the database, use the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it to the database: Step S3.1: According to the IP addresses of the assets of server type in the database, count their IP network segments, and add a router record in the database for each network segment. If the server in the database involves two network segments, add two router records in the database; Step S3.2: associate each router with all servers under the network segment corresponding to the router, and save the connection relationship in a database.

5. The method for investigating cyberspace assets based on NMAP according to claim 1, characterized in that: In step S4: Users can modify and supplement the scan results on the browser side, view asset information and topology information on the browser side, and edit assets, add assets, and edit topology based on actual conditions.

6. A cyberspace asset investigation system based on NMAP, characterized in that: include: Module M1: Generates command line instructions to call NMAP to perform asset scanning tasks on the target network based on the scanning information submitted by the user on the browser side, and saves the scanning results in XML file format; Module M2: After the scan is completed, read the XML file, loop through the file content according to the matching rules, parse the target IP address, operating system, port and service, associate the operating system, port and service with the IP address and save them in the database; Module M3: Use the asset topology generation algorithm to associate the resolved IP addresses, obtain the network topology structure, and save it in the database; Module M4: The user modifies and supplements the scanning results on the browser side.

7. The NMAP-based cyberspace asset investigation system according to claim 6 is characterized in that: In the module M1: Receiving scanning information and executing scanning tasks specifically include: Module M1.1: The scan target submitted by the user on the browser side is a single IP address, multiple IP addresses, IP address range or network segment. The control side generates NMAP scan command line instructions according to the template based on the scan information: nmap-T4-Av-oX filename.xml; Among them, -T4 indicates the timing used in the scanning process, which has 6 levels in total. The higher the level, the faster the scanning speed; -A indicates the use of aggressive scanning; -v indicates the display of redundant information, which displays the scanning details during the scanning process; -oX indicates that the scanning results will be generated into an xml file. If it is interrupted, the results cannot be opened, and the file name is named according to the scanning target; Module M1.2: The control end uses the Springboot framework, calls NMAP to perform scanning tasks through the exec() method command line instruction of the Runtime class, and saves the scanning results as an XML file.

8. The NMAP-based cyberspace asset investigation system according to claim 6 is characterized in that: In the module M2: Parse and extract the XML file to obtain the target IP address, operating system, port and service, associate the operating system, port and service with the IP address, and save them to the database: Module M2.1: Parse the XML file by introducing the DOM4J dependency library, traverse the contents of the file through the regular matching method, use the host and address keywords to match to find all target IP addresses, and save each IP address into the database as a server type; Module M2.2: Under each IP address, use the ports, port, portid, state, service, and os keyword matching to find the port number, state, service, and operating system in the server corresponding to the IP address; save each port number in the database as the service type, save the operating system in the database as the operating system type, and associate the service and operating system with the corresponding server.

9. The NMAP-based cyberspace asset investigation system according to claim 6, characterized in that: In the module M3: After parsing the XML result file and saving it to the database, use the asset topology generation algorithm to associate the parsed IP addresses to obtain the network topology structure and save it to the database: Module M3.1: According to the IP addresses of the assets in the database whose type is server, count their IP network segments, and add a new router record in the database for each network segment. If the server in the database involves two network segments, add two router records in the database; Module M3.2: Associate each router with all servers under the network segment corresponding to the router, and save the connection relationship in the database.

10. The NMAP-based cyberspace asset investigation system according to claim 6, characterized in that: In the module M4: Users can modify and supplement the scan results on the browser side, view asset information and topology information on the browser side, and edit assets, add assets, and edit topology based on actual conditions.

Images