Method and device for determining information to which network assets belong, and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a method and device for determining information to which network assets belong and electronic equipment, and the method comprises the steps: determining to-be-extracted information associated with any one network asset based on a network address corresponding to the any one network asset for the any one network asset; based on the obtained information name of the to-be-extracted information, determining the information category of the to-be-extracted information; based on the information category of the to-be-extracted information, determining an affiliated information extraction mode corresponding to the to-be-extracted information; and using the affiliated information extraction mode to extract affiliated information corresponding to any network asset from the to-be-extracted information. According to the method, the accurate responsibility subject can be identified in a short time, so that the efficiency and the effect of network asset management are ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and electronic device for determining information belonging to a network asset. Background Art

[0002] Network assets include cloud computing, databases, websites, security devices, IoT devices, etc. Due to a series of reasons such as poor management, configuration errors, and vulnerabilities, many assets are exposed to the public network and become targets of attackers, which may lead to serious security incidents such as data leakage and service interruption. Through asset identification and vulnerability detection, exposed assets and risky assets can be found, but due to the lack of social domain information such as asset owners and organizations, it becomes very difficult to govern and repair such problems, so it is very important to identify the responsible parties of network assets in a timely manner.

[0003] At present, the existing asset mapping technology solutions mainly focus on asset discovery and vulnerability detection, and there is still a lack of effective methods for identifying the responsible parties of network assets. It is difficult to quickly locate and contact the relevant responsible parties of network assets, which affects the efficiency and effectiveness of asset governance. Summary of the invention

[0004] The embodiments of the present application provide a method, device and electronic device for determining the information of network assets, which can quickly obtain the information of the person responsible for the network assets, thereby ensuring the efficiency and effectiveness of network asset management.

[0005] In a first aspect, an embodiment of the present application provides a method for determining information about network assets, the method comprising:

[0006] For any network asset, based on the network address corresponding to the any network asset, determine the information to be extracted associated with the any network asset, the information to be extracted includes the ICP filing information of the network content service provider of the domain name associated with the any network asset, the web page associated with the domain name, and part or all of the target content associated with the any network asset;

[0007] Determining the information category of the information to be extracted based on the obtained information name of the information to be extracted;

[0008] Based on the information category of the information to be extracted, determining the information extraction method corresponding to the information to be extracted;

[0009] The belonging information extraction method is used to extract the belonging information corresponding to any one of the network assets from the information to be extracted.

[0010] In a possible implementation manner, the information to be extracted includes ICP filing information of a domain name associated with any one of the network assets;

[0011] The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes:

[0012] Using a pre-built field recognition model to identify a target field from the ICP filing information, the field recognition model is trained using sample ICP filing information as input and a position of the target field in the sample ICP filing information as output;

[0013] The content corresponding to the target field is used as the belonging information corresponding to any one of the network assets.

[0014] In a possible implementation, the information to be extracted includes a web page associated with the domain name;

[0015] The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes:

[0016] The content at the target location of the webpage is used as the belonging information corresponding to any one of the network assets.

[0017] In a possible implementation, the information to be extracted includes a web page associated with the domain name;

[0018] Before extracting the belonging information corresponding to any one of the network assets from the information to be extracted, the method further includes:

[0019] If a webpage link is obtained through the search engine based on the domain name, a webpage associated with the domain name carried in the link is obtained through a Hypertext Transfer Protocol HTTP request.

[0020] In a possible implementation manner, the information to be extracted includes target content associated with any one of the network assets, and the target content includes the web service content or leakage information generated when any one of the network assets is leaked;

[0021] The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes:

[0022] Parsing the target content to obtain a plurality of to-be-selected belonging information, counting the frequency of occurrence of each to-be-selected belonging information in the target content, and determining a probability value corresponding to each to-be-selected belonging information, wherein the probability value represents the possibility that the to-be-selected belonging information is the belonging information corresponding to any one of the network assets;

[0023] Filtering target candidate information with a probability greater than a preset probability from the plurality of candidate information;

[0024] Based on the target candidate belonging information, the belonging information corresponding to the any one network asset is determined.

[0025] In a possible implementation manner, determining the belonging information corresponding to the any one network asset based on the target candidate belonging information includes:

[0026] If the target selected belonging information includes multiple ones, determining the belonging information corresponding to any one network asset based on the frequencies of occurrence of different target selected belonging information in the target content;

[0027] If the target to-be-selected belonging information includes one, the target to-be-selected belonging information is used as the belonging information corresponding to any one network asset.

[0028] In a possible implementation manner, extracting the belonging information corresponding to the any one network asset from the information to be extracted includes:

[0029] Extracting belonging information from the ICP filing information, the webpage associated with the domain name, the web service content, and the leaked information respectively to obtain a plurality of belonging information;

[0030] If all the belonging information obtained are different, the belonging information corresponding to the information to be extracted with the largest corresponding weight is used as the belonging information corresponding to any one of the network assets, and the weight represents the accuracy of the belonging information extracted from the information to be extracted;

[0031] If there is the same belonging information among the multiple belonging information, the belonging information corresponding to the any one network asset is determined based on the frequency of occurrence of each belonging information in the information set constructed by the multiple belonging information.

[0032] In a possible implementation, the ICP filing information is obtained in the following manner:

[0033] Determine the domain name associated with the network address of any one of the network assets by means of a reverse domain name system query;

[0034] Use the pre-built query tool to query the ICP filing information corresponding to the domain name locally.

[0035] In a second aspect, an embodiment of the present application provides a device for determining information about network assets, the device comprising:

[0036] A module for determining information to be extracted, for determining information to be extracted associated with any one network asset based on a network address corresponding to the any one network asset, wherein the information to be extracted includes ICP filing information of a network content service provider of a domain name associated with the any one network asset, a web page associated with the domain name, and part or all of target content associated with the any one network asset;

[0037] An information category determination module, used to determine the information category of the information to be extracted based on the information name of the information to be extracted;

[0038] An extraction method determination module is used to determine the information extraction method corresponding to the information to be extracted based on the information category of the information to be extracted;

[0039] The extraction module is used to extract the belonging information corresponding to any one of the network assets from the information to be extracted by using the belonging information extraction method.

[0040] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising:

[0041] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method in the first aspect above.

[0042] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method of the first aspect above.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method of the first aspect when the computer program is executed by a processor.

[0044] The embodiments of the present application provide a method, device and electronic device for determining the information belonging to network assets, which use ICP registration information, web pages, web service information, and leakage information in multiple dimensions to identify the responsible party of network assets, and can obtain accurate responsible parties; in addition, the embodiments of the present application also use an entity recognition algorithm to automatically extract responsible party information from web page content, thereby realizing the automated extraction of responsible parties and ensuring the efficiency and accuracy of extracting responsible parties. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A schematic diagram of an application scenario of a method for determining information about network assets according to an exemplary embodiment of the present invention;

[0046] Figure 2 A schematic diagram of a method for determining network asset ownership information according to an exemplary embodiment of the present invention;

[0047] Figure 3 A schematic diagram of a first process of extracting belonging information according to an exemplary embodiment of the present invention;

[0048] Figure 4 A schematic diagram of a second process of extracting belonging information according to an exemplary embodiment of the present invention;

[0049] Figure 5 A schematic diagram of a third process of extracting belonging information according to an exemplary embodiment of the present invention;

[0050] Figure 6 A schematic diagram of a specific process of a method for determining information about network assets according to an exemplary embodiment of the present invention;

[0051] Figure 7 A schematic diagram of a device for determining information about network assets according to an exemplary embodiment of the present invention;

[0052] Figure 8 The figure is a schematic diagram of an electronic device according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0053] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present application, and are not intended to limit the scope of the present application in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0054] Those skilled in the art know that the embodiments of the present application can be implemented as a system, device, method or computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0055] It should be understood herein that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction rather than having any limiting meaning.

[0056] The following is an introduction to some concepts involved in the embodiments of the present application.

[0057] Network assets: may also be referred to as network space assets, which may be websites, Internet Protocol (IP) addresses, and are not specifically limited in the embodiments of the present application.

[0058] Target content: may include web service content associated with a network asset and / or leaked information generated when a network asset is leaked.

[0059] Ownership information: In the embodiment of the present application, the ownership information of the network asset is the person responsible for the network asset (also referred to as the responsible subject). For example, the responsible subject may be XX organization or XX institution.

[0060] Information to be extracted: The information to be extracted includes the responsible party of the network assets. In the embodiment of the present application, the information to be extracted can be the Internet Content Provider (ICP) registration information of the domain name associated with any one of the network assets, the web page associated with the domain name, the web service content associated with any one of the network assets, and part or all of the leakage information generated when the network assets are leaked.

[0061] A method for determining network asset information in an embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0062] like Figure 1 The figure shows an application scenario of a method for determining network asset information provided by an embodiment of the present application. The application scenario includes a server 101 and a network address of at least one network asset (eg, Figure 1 The network address 102_1 of the network asset, the network address 102_2 of the network asset, ..., the network address 102_N of the network asset are shown, wherein the server 101 is used to obtain relevant information to be extracted according to the network address, and extract the responsible subject of the network asset from the information to be extracted.

[0063] Among them, server 101 can be an independently deployed physical server or a server cluster or distributed system composed of multiple physical servers, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms, etc., which are not specifically limited in the embodiments of the present application.

[0064] In view of the problem in the prior art that the efficiency and effect of asset management are affected by the inability to obtain the responsible party of network assets, the embodiment of the present application provides a method for determining the information of network assets, such as Figure 2As shown, the method includes:

[0065] S201: For any network asset, based on a network address corresponding to the any network asset, determine information to be extracted that is associated with the any network asset.

[0066] In an embodiment of the present application, the information to be extracted may include the ICP registration information of the domain name associated with any network asset, the web page associated with the domain name, and part or all of the target content associated with any network asset, wherein the target content may be web service content associated with any of the network assets, and leakage information generated when the network asset is leaked. The embodiment of the present application does not specifically limit the category of the information to be extracted.

[0067] The methods for obtaining the information to be extracted of different information categories are different, as shown in the following implementation methods.

[0068] (1)ICP registration information.

[0069] At present, most companies or individuals will record the domain names they use, including the record subject information, website information, access service provider information, etc. Among them, the domain name record subject information is an important basis for determining the responsible party of network assets (the responsible party can also be called the ownership information). By querying the ICP record information of the domain name, you can obtain key information such as the registrant and registration agency associated with the domain name.

[0070] In a possible implementation, the ICP filing information may be obtained in the following manner:

[0071] The domain name associated with the network address of any network asset is determined by reverse domain name system query; and the ICP filing information corresponding to the domain name is locally queried using a pre-built query tool.

[0072] First, for the network address of a given network asset, the reverse domain name system query technology is used to resolve the domain name associated with the network address. This process uses the public suffix library to resolve the top-level domain and valid second-level domain name of the domain name to ensure that the domain name to be queried can be accurately located. After that, the WHOIS query tool is used to obtain the ICP filing information of the domain name, including the registrant name, registration agency, registration time, and expiration time.

[0073] (2)Web page.

[0074] In some cases, the domain name may not be registered with ICP or the responsible party cannot be clearly identified through the ICP registration information. In order to solve this problem, the embodiment of the present application provides a method for locating the responsible party based on a web page obtained by a search engine.

[0075] Specifically, the webpage content associated with the domain name can be queried through a search engine. The search engine is accessed through an automated tool, and the domain name to be queried is submitted as a search keyword. In order to ensure the validity of the search results, a multiple-attempt mechanism is set up to cope with network fluctuations or search engine response delays.

[0076] In a possible implementation, a search engine searches for a domain name and may directly obtain a web page or a web page link. In order to obtain the web page content, it is necessary to further request the web page content associated with the domain name carried in the web page link through HyperText Transfer Protocol (HTTP). After obtaining the web page content, relevant information of the responsible entity can be obtained from it, such as the web page title, company introduction, about information, technical support, etc. Generally speaking, the first search result returned by the search engine is usually the most relevant web page or link.

[0077] (3)Web service content.

[0078] Many organizations and companies deploy their own web services on their servers, obtain web service content, and use entity recognition methods in natural language processing technology to extract responsible party information from them.

[0079] Web port scanning is performed on the network address of network assets to detect running web services. Common web ports include 80 (HTTP) and 443 (HTTPS). After confirming that the web service is running, HTTP requests are used to obtain the homepage content of the service. The obtained web page content usually contains the name, logo and other important information related to the organization or company, which provides basic data for subsequent identification of the responsible party.

[0080] (4) Information leakage.

[0081] Web assets may expose services such as source code repositories or other data services. These services may contain detailed project information, such as project descriptions, README files, and commit histories, which record the names of project owners, maintainers, or related organizations.

[0082] Taking the source code repository service as an example, when a network asset is detected to be exposed, the system will automatically obtain the project description and other public information in the repository. By analyzing this information, clues about the responsible party can be extracted. In addition, other types of exposed data services (such as database backups, configuration files, etc.) may also contain valuable responsible party information. This information is extracted through automated means and used together with other web content for subsequent responsible party identification.

[0083] S202: Determine the information category of the information to be extracted based on the obtained information name of the information to be extracted.

[0084] Since the method of extracting the responsible party is different for different information to be extracted, it is necessary to first determine the category of the information to be extracted.

[0085] Based on the above S201, the information to be extracted may include the above four categories. The information names of different categories of information to be extracted are different. For example, the information name of ICP filing information may include a filing number, the information name of web page content searched by domain name may include domain name, the information name of web service content may include the name of web port, and the information name of leaked information may include the name of leaked network assets, such as database name. Moreover, the information format of different information to be extracted may also be different. Therefore, the information to be extracted can also be distinguished according to the information format. The embodiment of the present application does not limit the specific method of distinguishing the categories of information to be extracted.

[0086] S203: Determine a belonging information extraction method corresponding to the information to be extracted based on the information category of the information to be extracted, and extract belonging information corresponding to any one network asset from the information to be extracted using the belonging information extraction method.

[0087] After determining the category of the acquired information to be extracted, the method of extracting the information to be extracted can be determined, as shown in the following implementation method.

[0088] (1)ICP registration information.

[0089] For ICP filing information, first, a pre-built field recognition model is used to identify the target field from the ICP filing information, and then the content corresponding to the target field is used as the belonging information corresponding to any one of the network assets. The field recognition model is trained with sample ICP filing information as input and the position of the target field in the sample ICP filing information as output.

[0090] For example, the ICP filing information is as follows:

[0091] #whois.cnnic.cn

[0092] Domain Name: isoftoo.cn

[0093] ROID: 20210802s20001s39121012-cn

[0094] Domain Status:ok

[0095] Registrant: XXX Co., Ltd.

[0096] Registrant Cotact Email:XXX @ XX . cn

[0097] SponSoring Registrar: XXX Company

[0098] NAme Server: dns21.com

[0099] NAme Server: dns22.com

[0100] Registration Time: 2021-08-02 01:56:55

[0101] Expiration Time:2027-08-02 01:56:55

[0102] DNSSEC: unsigned

[0103] First, the field recognition model is used to identify the "SponSoring Registrar" field from the ICP filing information, and then the content after the "SponSoring Registrar" field is taken as the responsible entity.

[0104] In a possible implementation, the content corresponding to "SponSoring Registrar" may be empty, which indicates that the responsible party has not been identified, and an indication message "the responsible party has not been identified using the ICP filing information" is returned to the relevant personnel.

[0105] (2)Web page.

[0106] In a possible implementation, the content at the target location of the webpage is used as the belonging information corresponding to any one of the network assets.

[0107] like Figure 3 The figure shows the specific process of extracting relevant information from a web page.

[0108] S301: The search engine searches for the domain name.

[0109] S302: Get the first searched web page, and then execute S304.

[0110] S303: Get the first searched web page link, and then execute S305.

[0111] S304: Extract the title of the web page as the belonging information (i.e., the responsible party). The web page title is generally located in the upper left corner of the web page. The web page title can be located by an artificial intelligence algorithm. The embodiment of the present application does not specifically limit the method for locating the network title. In addition, company introduction, about information, technical support and other content can also be extracted to obtain the responsible party.

[0112] S305: Obtain the content corresponding to the webpage link through a hypertext transfer protocol Http request;

[0113] S306: Determine whether there is Chinese information in the content, if so, execute S308, otherwise execute S307.

[0114] S307: The ownership information is not identified, that is, the responsible party is not identified.

[0115] S308: Extract the footer / copyright statement as the ownership information (ie, the responsible entity).

[0116] Combined with the parsing results of the search results title and web page content, if valid responsible party information can be extracted, the information is determined to be the responsible party of the network asset. If clear responsible party information cannot be extracted, an indication message of "no responsible party identified" is returned to the relevant personnel.

[0117] Through the above steps, when the domain name is not registered or the registration information is incomplete, an effective method for identifying the responsible party is provided, which greatly improves the accuracy and efficiency of cyberspace asset management.

[0118] (3)Web service content.

[0119] In a possible implementation, extracting the belonging information from the web service content may be implemented as follows:

[0120] Parse the web service content to obtain multiple pieces of to-be-selected belonging information, count the frequency of occurrence of each piece of to-be-selected belonging information in the web service content, and determine a probability value corresponding to each piece of to-be-selected belonging information, wherein the probability value represents the possibility that the to-be-selected belonging information is the belonging information corresponding to any one of the network assets; filter out target to-be-selected belonging information with a probability greater than a preset probability from the multiple pieces of to-be-selected belonging information; if the target to-be-selected belonging information includes multiple pieces of to-be-selected belonging information, determine the belonging information corresponding to any one of the network assets based on the frequency of occurrence of different target to-be-selected belonging information in the web service content; if the target to-be-selected belonging information includes one piece of to-be-selected belonging information, use the target to-be-selected belonging information as the belonging information corresponding to any one of the network assets.

[0121] In the embodiment of the present application, the web service content includes port 80 service content and port 443 service content.

[0122] Take the service content of port 80 as an example. Figure 4 As shown, the obtained web service content is first preprocessed, including removing irrelevant HTML tags, text segmentation processing, etc., and extracting Chinese content.

[0123] In an embodiment of the present application, a deep learning-based candidate information recognition model is pre-trained to analyze and annotate the preprocessed text. The candidate information recognition model annotates pre-defined entity categories, that is, candidate information (such as organizations, companies, institutions, governments, enterprises, etc.), and sets a probability value for each category of entity to indicate the relevance of the entity as a responsible party.

[0124] During the use of the candidate belonging information identification model, the preprocessed web service content is input into the candidate belonging information identification model to obtain the candidate belonging information in the web service content and the number of times each candidate belonging information appears in the web service content.

[0125] When the name of the identified candidate belonging information is pure Chinese characters and its probability value reaches the preset threshold (such as 0.4 or above), it may be the responsible party and is saved in the entity list, that is, it is used as the target candidate belonging information, and then the target candidate belonging information with the highest frequency is selected as the belonging information associated with the network asset. If the probability values ​​of all identified candidate belonging information are less than the preset threshold, it is determined that the responsible party has not been obtained.

[0126] For example, if multiple candidate information is obtained from the service content of port 80, such as XX company, XX institution and XX organization, the frequency of XX company, XX institution and XX organization appearing in the service content of port 80 is determined respectively, for example, XX company appears 4 times, with a probability value of 0.5; XX institution appears 2 times, with a probability value of 0.45; XX organization appears 1 time, with a probability value of 0.2.

[0127] Since the probability value of XX organization is 0.2, the candidate ownership information is XX company and XX organization, and XX company appears the most times, so XX company is taken as the responsible entity of any network asset. If only the probability value of XX company is greater than the preset probability, XX company is directly taken as the ownership information of the network asset.

[0128] (4) Information leakage.

[0129] Similar to the extraction process of the above-mentioned web service content, the leaked information is parsed to obtain multiple candidate belonging information, and the frequency of each candidate belonging information appearing in the leaked information is counted, and the probability value corresponding to each candidate belonging information is determined, and the probability value represents the possibility that the candidate belonging information is the belonging information corresponding to any one of the network assets; the target candidate belonging information with a probability greater than a preset probability is screened out from the multiple candidate belonging information; if the target candidate belonging information includes multiple ones, the belonging information corresponding to any one of the network assets is determined based on the frequency of different target candidate belonging information appearing in the leaked information; if the target candidate belonging information includes one, the target candidate belonging information is used as the belonging information corresponding to any one of the network assets.

[0130] like Figure 5 As shown, first, the obtained leaked information is preprocessed, including removing irrelevant HTML tags, text segmentation, etc., and extracting Chinese content.

[0131] Afterwards, the pre-processed leaked information is input into the candidate-selected belonging information identification model to obtain the candidate-selected belonging information in the leaked information and the number of times each candidate-selected belonging information appears in the leaked information.

[0132] When the name of the identified candidate belonging information is pure Chinese characters and its probability value reaches the preset threshold (such as 0.4 or above), it may be the responsible party and is saved in the entity list, that is, it is used as the target candidate belonging information, and then the target candidate belonging information with the highest frequency is selected as the belonging information associated with the network asset. If the probability values ​​of all identified candidate belonging information are less than the preset threshold, it is determined that the responsible party has not been obtained.

[0133] For example, if multiple candidate information is obtained from the leaked information, such as XX company, XX institution and XX organization, the frequency of XX company, XX institution and XX organization appearing in the service content of port 80 is determined respectively. For example, XX company appears 4 times with a probability value of 0.5; XX institution appears 2 times with a probability value of 0.45; XX organization appears 1 time with a probability value of 0.2.

[0134] Since the probability value of XX organization is 0.2, the candidate ownership information is XX company and XX organization, and XX company appears the most times, so XX company is taken as the responsible entity of any network asset. If only the probability value of XX company is greater than the preset probability, XX company is directly taken as the ownership information of the network asset.

[0135] The information to be extracted provided in the embodiment of the present application includes four types. The belonging information obtained from different information to be extracted may be different or the same. If the obtained belonging information are different, the belonging information corresponding to the information to be extracted with the largest corresponding weight is used as the belonging information corresponding to any one of the network assets, and the weight represents the accuracy of the belonging information extracted from the information to be extracted; if there is the same belonging information among the multiple belonging information, the belonging information corresponding to the any one of the network assets is determined based on the frequency of occurrence of each belonging information in the information set constructed based on the multiple belonging information.

[0136] In an embodiment of the present application, the weight ranking of the information to be extracted can be ICP filing information>web page>web service content>leaked information. Therefore, when the various belonging information obtained are different, the belonging information corresponding to the ICP filing information is used as the belonging information corresponding to any network asset. If the same belonging information exists in the multiple belonging information obtained, for example, the belonging information corresponding to the ICP filing information is XX company, the belonging information corresponding to the web page is XX company, the belonging information corresponding to the web service content is XX organization, and the belonging information corresponding to the leaked information is XX organization, XX company appears twice, and the rest appear once. At this time, XX company is used as the belonging information of any network asset.

[0137] The following is based on Figure 6 A method for determining network asset ownership information provided in an embodiment of the present application is described in detail.

[0138] S601: Determine the network address of the network asset;

[0139] S602: Determine whether the ICP filing information is obtained, if so, execute S606, otherwise execute S603;

[0140] S603: Determine whether the webpage associated with the domain name is obtained, if so, execute S606, otherwise execute S604;

[0141] S604: Determine whether the web service content is obtained, if so, execute S606, otherwise execute S605;

[0142] S605: Determine whether the leaked information is obtained, if so, execute S606, otherwise execute S607;

[0143] S606: Determine whether the responsible party is extracted, if so, execute S608, otherwise execute S607.

[0144] S607: The responsible party is not found, and the instruction information "the responsible party is not found" is fed back to the relevant personnel;

[0145] S608: Obtain the responsible party and feedback the extracted responsible party to relevant personnel, such as XX Company.

[0146] The embodiment of the present application provides a method for determining the information to which network assets belong, which uses ICP filing information, web pages, web service information, and leaked information for identification, and the identification results are expanded on the basis of traditional methods. In addition, the embodiment of the present application also uses an entity recognition algorithm to automatically extract the responsible party information from the web page content. Compared with the prior art, the embodiment of the present application can not only identify the responsible party in the absence of domain name filing information, but also improve the accuracy and efficiency of identification through entity recognition, greatly improving the coverage of responsible party identification.

[0147] Based on the same inventive concept, the embodiment of the present application provides a device for determining information about network assets, such as Figure 7 As shown, the device comprises:

[0148] The module 701 for determining information to be extracted is used to determine information to be extracted associated with any network asset based on the network address corresponding to the any network asset, wherein the information to be extracted includes ICP filing information of a network content service provider of a domain name associated with the any network asset, a web page associated with the domain name, and part or all of target content associated with the any network asset;

[0149] An information category determination module 702 is used to determine the information category of the information to be extracted based on the information name of the information to be extracted;

[0150] An extraction method determination module 703 is used to determine the information extraction method corresponding to the information to be extracted based on the information category of the information to be extracted;

[0151] The extraction module 704 is used to extract the belonging information corresponding to the any one network asset from the information to be extracted by using the belonging information extraction method.

[0152] In a possible manner, the information to be extracted includes ICP filing information of a domain name associated with any one of the network assets; the extraction module 704 is used to:

[0153] Using a pre-built field recognition model to identify a target field from the ICP filing information, the field recognition model is trained using sample ICP filing information as input and a position of the target field in the sample ICP filing information as output;

[0154] The content corresponding to the target field is used as the belonging information corresponding to any one of the network assets.

[0155] In a possible implementation, the information to be extracted includes a web page associated with the domain name;

[0156] The extraction module 704 is used to use the content at the target position of the webpage as the belonging information corresponding to any one of the network assets.

[0157] In a possible implementation, the information to be extracted includes a web page associated with the domain name; the extraction module 704 is used to:

[0158] When a webpage link is obtained through the search engine based on the domain name, a webpage associated with the domain name carried in the link is obtained through a hypertext transfer protocol HTTP request.

[0159] In a possible implementation, the information to be extracted includes target content associated with any one of the network assets, and the target content includes the web service content or leakage information generated when any one of the network assets is leaked; the extraction module 704 is used to:

[0160] Parsing the target content to obtain a plurality of to-be-selected belonging information, counting the frequency of occurrence of each to-be-selected belonging information in the target content, and determining a probability value corresponding to each to-be-selected belonging information, wherein the probability value represents the possibility that the to-be-selected belonging information is the belonging information corresponding to any one of the network assets;

[0161] Filtering target candidate information with a probability greater than a preset probability from the plurality of candidate information;

[0162] Based on the target candidate belonging information, the belonging information corresponding to the any one network asset is determined.

[0163] In a possible implementation, the extraction module 704 is used to:

[0164] When it is determined that the target to-be-selected belonging information includes multiple items, determining the belonging information corresponding to any one of the network assets based on the frequencies of occurrence of different target to-be-selected belonging information in the target content;

[0165] When it is determined that the target to-be-selected belonging information includes one, the target to-be-selected belonging information is used as the belonging information corresponding to any one network asset.

[0166] In a possible implementation, the extraction module 704 is used to:

[0167] Extracting belonging information from the ICP filing information, the webpage associated with the domain name, the web service content, and the leaked information respectively to obtain a plurality of belonging information;

[0168] If all the belonging information obtained are different, the belonging information corresponding to the information to be extracted with the largest corresponding weight is used as the belonging information corresponding to any one of the network assets, and the weight represents the accuracy of the belonging information extracted from the information to be extracted;

[0169] If there is the same belonging information among the multiple belonging information, the belonging information corresponding to the any one network asset is determined based on the frequency of occurrence of each belonging information in the information set constructed by the multiple belonging information.

[0170] In a possible implementation, the module 701 for determining information to be extracted is used to:

[0171] Determine the domain name associated with the network address of any one of the network assets by means of a reverse domain name system query;

[0172] Use the pre-built query tool to query the ICP filing information corresponding to the domain name locally.

[0173] Based on the same inventive concept, an embodiment of the present application provides an electronic device, the device comprising:

[0174] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any method for determining information on network asset ownership provided in the embodiments of the present application.

[0175] Refer to the following Figure 8 The electronic device 80 according to this embodiment of the present application is described. Figure 8 The electronic device 80 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0176] like Figure 8 As shown, the electronic device 80 is in the form of a general electronic device. The components of the electronic device 80 may include but are not limited to: at least one processor 81, at least one memory 82, and a bus 83 connecting different system components (including the memory 82 and the processor 81).

[0177] The processor 81 is used to read and execute instructions in the memory 82, so that the at least one processor can execute a method for determining network asset information provided in the above embodiment.

[0178] Bus 83 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0179] The memory 82 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 821 and / or a cache memory 822 , and may further include a read-only memory (ROM) 823 .

[0180] The memory 82 may also include a program / utility 825 having a set (at least one) of program modules 824, such program modules 824 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0181] The electronic device 80 may also communicate with one or more external devices 84 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 80, and / or may communicate with any device that enables the electronic device 80 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 85. Furthermore, the electronic device 80 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 86. As shown, the network adapter 86 communicates with other modules for the electronic device 80 via a bus 83. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 80, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0182] In some possible implementations, various aspects of a method for determining network asset ownership information provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a method for determining network asset ownership information according to various exemplary implementations of the present application described above in this specification.

[0183] In addition, the present application also provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program is used to enable a computer to execute any of the methods described in the above embodiments.

[0184] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0186] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0187] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for determining network asset ownership information, characterized in that: The method comprises: For any network asset, based on the network address corresponding to the any network asset, determine the information to be extracted associated with the any network asset, the information to be extracted includes the ICP filing information of the network content service provider of the domain name associated with the any network asset, the web page associated with the domain name, and part or all of the target content associated with the any network asset; Determining the information category of the information to be extracted based on the obtained information name of the information to be extracted; Based on the information category of the information to be extracted, determining the information extraction method corresponding to the information to be extracted; The belonging information extraction method is used to extract the belonging information corresponding to any one of the network assets from the information to be extracted.

2. The method according to claim 1, characterized in that The information to be extracted includes ICP filing information of a domain name associated with any one of the network assets; The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes: Using a pre-built field recognition model to identify a target field from the ICP filing information, the field recognition model is trained using sample ICP filing information as input and a position of the target field in the sample ICP filing information as output; The content corresponding to the target field is used as the belonging information corresponding to any one of the network assets.

3. The method according to claim 1, characterized in that The information to be extracted includes a web page associated with the domain name; The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes: The content at the target location of the webpage is used as the belonging information corresponding to any one of the network assets.

4. The method according to claim 1, characterized in that: The information to be extracted includes a web page associated with the domain name; Before extracting the belonging information corresponding to any one of the network assets from the information to be extracted, the method further includes: If a webpage link is obtained through the search engine based on the domain name, a webpage associated with the domain name carried in the link is obtained through a Hypertext Transfer Protocol HTTP request.

5. The method according to claim 1, characterized in that The information to be extracted includes target content associated with any one of the network assets, and the target content includes the web service content or leakage information generated when any one of the network assets is leaked; The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes: Parsing the target content to obtain a plurality of to-be-selected belonging information, counting the frequency of occurrence of each to-be-selected belonging information in the target content, and determining a probability value corresponding to each to-be-selected belonging information, wherein the probability value represents the possibility that the to-be-selected belonging information is the belonging information corresponding to any one of the network assets; Filtering target candidate information with a probability greater than a preset probability from the plurality of candidate information; Based on the target candidate belonging information, the belonging information corresponding to the any one network asset is determined.

6. The method according to claim 5, characterized in that The determining, based on the target candidate belonging information, the belonging information corresponding to the any one network asset includes: If the target selected belonging information includes multiple ones, determining the belonging information corresponding to any one network asset based on the frequencies of occurrence of different target selected belonging information in the target content; If the target to-be-selected belonging information includes one, the target to-be-selected belonging information is used as the belonging information corresponding to any one network asset.

7. The method according to claim 1, characterized in that The extracting the belonging information corresponding to the any one network asset from the information to be extracted includes: Extracting belonging information from the ICP filing information, the webpage associated with the domain name, the web service content, and the leaked information respectively to obtain a plurality of belonging information; If all the belonging information obtained are different, the belonging information corresponding to the information to be extracted with the largest corresponding weight is used as the belonging information corresponding to any one of the network assets, and the weight represents the accuracy of the belonging information extracted from the information to be extracted; If there is the same belonging information among the multiple belonging information, the belonging information corresponding to the any one network asset is determined based on the frequency of occurrence of each belonging information in the information set constructed by the multiple belonging information.

8. The method according to claim 1, characterized in that Obtain the ICP filing information in the following ways: Determine the domain name associated with the network address of any one of the network assets by means of a reverse domain name system query; Use the pre-built query tool to query the ICP filing information corresponding to the domain name locally.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor executes a method as claimed in any one of claims 1 to 8.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images