IP address checking method and device based on port state data

Abstract

The invention discloses an IP address checking method and device based on port state data, and relates to the field of network communication. The method comprises the following steps: constructing a port set according to all network equipment ports in a current network, obtaining initial port state data of each network equipment port in the port set, and establishing a mapping table of the network equipment ports and IP addresses according to the initial port state data; acquiring a set of IP addresses in the current network, and constructing an IP address resource pool according to the set; obtaining current port state data of each network equipment port in the port set every preset time, and determining IP address data according to the current port state data and the mapping table; and comparing the IP address data with the IP address resource pool, determining an idle IP address and an abnormal IP address, marking the abnormal IP address, releasing the idle IP address, and updating the IP address resource pool. By implementing the technical scheme provided by the invention, the effect of optimizing IP address management is achieved, and the utilization rate and security of network resources are improved.

Description

Technical Field

[0001] The present application relates to the technical field of network communications, and in particular to a method and device for verifying an IP address based on port status data. Background Art

[0002] In modern network communications, network device management and maintenance are crucial. The orderly management of IP (Internet Protocol) addresses, the unique identifiers of network devices, directly impacts network stability and security. With the rapid development of information technology and the rapid expansion of enterprise networks, traditional manual IP address management methods have gradually exposed numerous shortcomings.

[0003] Currently, in order to effectively manage IP addresses, the industry generally adopts two common methods: static configuration and dynamic allocation. Static configuration mainly relies on manual registration and monitoring of the allocation and usage of IP addresses, while dynamic allocation automatically manages the allocation and recycling of IP addresses through the DHCP protocol. However, the above management methods make it difficult to monitor changes in the status of network device ports and the usage of IP addresses in real time. In particular, for scenarios in large-scale network environments where device ports frequently change and IP addresses are automatically allocated, existing technologies are unable to accurately and promptly verify the actual usage of IP addresses, resulting in the accumulation of invalid or idle IP addresses and the inability to detect abnormal usage in a timely manner, thus affecting the effective management and utilization efficiency of network resources.

[0004] Therefore, there is a need for an IP address verification method that can monitor the use of IP addresses in the network in real time and identify illegal occupation and potential risks. Summary of the Invention

[0005] The present application provides an IP address verification method and device based on port status data, which can effectively identify and release idle IP addresses, and mark abnormal IP addresses, thereby achieving the effect of optimizing IP address management and improving network resource utilization and security.

[0006] In a first aspect of the present application, a method for verifying an IP address based on port status data is provided, which is applied to an IP address verification platform. The method comprises: Building a port set based on all network device ports in the current network, obtaining initial port status data of each network device port in the port set, the initial port status data including a port open / close timestamp, a MAC address, and an IP address, and establishing a mapping table between network device ports and IP addresses based on the initial port status data; Obtain a set of IP addresses in the current network and construct an IP address resource pool based on the set; Obtaining current port status data of each network device port in the port set at predetermined intervals, the current port status data including traffic data and IP address activity status, and determining IP address data based on the current port status data and the mapping table; The IP address data is compared with the IP address resource pool to determine idle IP addresses and abnormal IP addresses, the abnormal IP addresses are marked, the idle IP addresses are released, and the IP address resource pool is updated.

[0007] Optionally, establishing a mapping table between network device ports and IP addresses according to the initial port status data includes: Identifying and removing duplicate data in the initial port state data by combining the MAC address and the IP address to obtain first intermediate data; Comparing the first intermediate data of the first network device port with the first intermediate data of other network device ports participating in the cross-validation, the comparison content including the allocation of IP addresses, the uniqueness of MAC addresses, and the synchronization of port states, the first network device port being any port in the port set, and the other network device ports being ports in the port set other than the first network device port; When the comparison result meets the preset requirements, a hash table or a database is used to store the mapping relationship between the first network device port and the IP address.

[0008] Optionally, obtaining a set of IP addresses in the current network and constructing an IP address resource pool according to the set includes: Scan all subnets in the current network and collect the IP addresses within each subnet; Verify the collected IP addresses to eliminate invalid IP addresses caused by configuration errors or equipment failures and obtain valid IP addresses; Classifying the valid IP addresses to obtain allocated IP addresses and unallocated IP addresses, wherein the allocated IP addresses include IP addresses in use and reserved IP addresses; An IP address resource pool is constructed according to the classification result, the unallocated IP addresses are stored as available resources, and allocation status and usage information are added to the allocated IP addresses.

[0009] Optionally, comparing the IP address data with the IP address resource pool to determine idle IP addresses and abnormal IP addresses includes: Determining the activity of the IP address corresponding to the port of the second network device based on the frequency of port opening / closing and the duration of time the port is open; Collecting and analyzing traffic data for each IP address and determining a traffic pattern for each IP address based on the traffic data, the traffic data including the amount of data sent and received, the number of packets, and the time distribution of traffic occurrence; Determining a current state of the IP address based on a preset activity threshold and a preset traffic pattern threshold, wherein the current state includes active and idle; The current state is compared with the recorded state of the corresponding IP address in the IP address resource pool, and an IP address whose current state is inconsistent with the recorded state is determined as an abnormal IP address.

[0010] Optionally, the method further includes: Analyze traffic characteristics of the abnormal IP address and determine a traffic anomaly score based on the traffic characteristics, including the source IP address, destination IP address, protocol type used, and specific data patterns in the traffic; Analyzing the behavior patterns of abnormal IP addresses and determining a behavior anomaly score based on the behavior patterns, including the frequency of sending data packets and the number of attempts to access unauthorized resources; A weighted sum of the traffic anomaly score and the behavior anomaly score is performed to obtain a total anomaly score, and whether the abnormal IP address is a potential threat is determined based on the total anomaly score.

[0011] Optionally, the method further includes: Extract target features from historical port status data and traffic information to build a training dataset; Selecting a supervised learning algorithm to train an initial model based on the training data set to obtain a prediction model to identify normal behavior patterns and abnormal behavior characteristics; The prediction model is used to evaluate the current port status data in real time to predict whether the behavior is abnormal, and the preset activity threshold and the preset traffic pattern threshold are adjusted according to the prediction results.

[0012] Optionally, comparing the IP address data with the IP address resource pool includes: Divide the comparison task into multiple subtasks, each of which is responsible for processing network device port data within a preset range; Use message queues to manage data flow and synchronization between subtasks, and implement load balancing strategies to evenly distribute subtasks to each node in the cluster; When a node failure is detected, subtasks are reallocated to adjacent nodes.

[0013] In a second aspect of the present application, an IP address verification system based on port status data is provided, comprising a port module, an address module, a collection module, and a verification module, wherein: a port module configured to construct a port set based on all network device ports in the current network, obtain initial port state data of each network device port in the port set, the initial port state data including a port open / close timestamp, a MAC address, and an IP address, and establish a mapping table between network device ports and IP addresses based on the initial port state data; An address module configured to obtain a set of IP addresses in the current network and construct an IP address resource pool based on the set; a collection module configured to obtain current port status data of each network device port in the port set at predetermined intervals, the current port status data including traffic data and IP address activity status, and determine IP address data based on the current port status data and the mapping table; The verification module is configured to compare the IP address data with the IP address resource pool, determine idle IP addresses and abnormal IP addresses, mark the abnormal IP addresses and release the idle IP addresses, and update the IP address resource pool.

[0014] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device performs any of the methods described above.

[0015] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions. When the instructions are executed, any one of the methods described above is executed.

[0016] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. By building a mapping table between network device ports and IP addresses, the corresponding relationship between each network device port and IP address can be clearly displayed. This helps network administrators quickly locate and manage IP addresses, improving IP address management efficiency. At the same time, regularly obtaining port status data and updating the mapping table can ensure data accuracy and real-time performance. 2. By acquiring port status data at preset intervals, including traffic data and IP address activity status, it can accurately identify idle and abnormal IP addresses. Idle IP addresses refer to IP addresses that have not been used for a long time. These addresses can be released and reallocated to other devices that need to use them, thereby improving IP address utilization. Abnormal IP addresses may involve security issues or configuration errors. By marking these addresses, network administrators can take timely measures to deal with them and ensure network security and stability. 3. By comparing IP address data with the IP address resource pool, the status of the IP address resource pool can be updated in real time, including releasing idle IP addresses and updating the marks of abnormal IP addresses. This helps network administrators better understand the distribution of IP address resources and make reasonable resource allocation and planning. At the same time, it can also provide strong support for future network expansion and upgrades. 4. By flagging anomalous IP addresses, potential network security issues can be promptly identified and addressed. For example, anomalous IP addresses may indicate unauthorized access, malicious attacks, or virus transmission. By promptly flagging and addressing these addresses, network administrators can take appropriate security measures, such as isolating infected devices, restricting access rights, or initiating security response mechanisms, effectively improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 1 is a flow chart of an IP address verification method based on port status data disclosed in an embodiment of the present application; Figure 2 This is a module diagram of an IP address verification system based on port status data disclosed in an embodiment of the present application; Figure 3 This is a structural diagram of an electronic device disclosed in an embodiment of the present application.

[0018] Explanation of the reference numerals: 201, port module; 202, address module; 203, acquisition module; 204, verification module; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0020] In the description of the embodiments of this application, words such as "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "for example" or "for instance" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "for example" or "for instance" is intended to present the relevant concepts in a concrete manner.

[0021] In the description of the embodiments of the present application, the term "multiple" means two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0022] This embodiment discloses an IP address verification method based on port status data, which is applied to an IP address verification platform. Figure 1 Schematic diagram of the flow of the IP address verification method based on port status data disclosed in the embodiment of the present application, such as Figure 1 As shown, the method includes the following steps: S110. Build a port set based on all network device ports in the current network, obtain initial port state data for each network device port in the port set, the initial port state data including a port open / close timestamp, a MAC address, and an IP address, and establish a mapping table between network device ports and IP addresses based on the initial port state data; Identify and collect port information for all network devices on the current network to build a comprehensive port set. Specific steps: Use network scanning tools (such as SNMP, Nmap, etc.) or network device management software to discover all devices on the network. For each discovered device, further collect information on all its ports, including the port's physical or logical identifier (such as interface number), type (such as Ethernet, fiber, etc.), and possible other attributes. Integrate all collected port information into a data structure to form a complete port set. This set includes all ports of all devices on the network.

[0023] For each port in the port set, its initial status data must be obtained, including the port's open / close timestamp, MAC (Media Access Control) address, and IP address. When the port is first detected as active (such as sending or receiving a data packet), the current time is recorded as the open timestamp. If no activity is detected on the port for a period of time, it is considered closed, and the current time is recorded as the close timestamp. The MAC address of the connected device is obtained from the MAC address table learned by the port or directly from the port. If the port is directly configured with an IP address (such as a VLAN interface on a switch or a physical interface on a router), the IP address is obtained directly. If a terminal device (such as a computer or printer) is connected to the port, it may be necessary to resolve the IP address associated with the port through ARP (Address Resolution Protocol) or other network protocols.

[0024] Based on the collected initial port status data, establish a mapping table to record the relationship between each network device port and its associated IP address. Specific operations: Organize the collected information such as the open / close timestamp, MAC address, and IP address of each port. Use a data structure (such as a hash table, database table, etc.) to store the mapping relationship. The key of the mapping table can be a port identifier (such as device ID + port number), and the value can be a list of IP addresses associated with the port (because sometimes a port may be associated with multiple IP addresses through VLAN or other technologies). You can also consider adding other fields, such as MAC address, port status (open / closed), last activity time, etc., to provide richer information.

[0025] Optionally, establishing a mapping table between network device ports and IP addresses according to the initial port status data includes: Identifying and removing duplicate data in the initial port state data by combining the MAC address and the IP address to obtain first intermediate data; Comparing the first intermediate data of the first network device port with the first intermediate data of other network device ports participating in the cross-validation, the comparison content including the allocation of IP addresses, the uniqueness of MAC addresses, and the synchronization of port states, the first network device port being any port in the port set, and the other network device ports being ports in the port set other than the first network device port; When the comparison result meets the preset requirements, a hash table or a database is used to store the mapping relationship between the first network device port and the IP address.

[0026] Collect the initial status data of the network device port. This data usually includes information such as port number, MAC address (media access control address, used to uniquely identify each physical interface on the network device), IP address (logical address of the network device), port status (such as enabled, disabled, error, etc.). Due to the possible redundant data or duplicate records in the network, the system first needs to identify and remove these duplicate data through the combination of MAC address and IP address. The combination of MAC address and IP address is unique in the network, so it can be used as the basis for deduplication. The processed data is called the first intermediate data. Next, the system will cross-validate the first intermediate data to ensure the accuracy and consistency of the data. This usually involves comparing the first intermediate data of a network device port (called the first network device port) with the first intermediate data of other network device ports. The comparison includes: IP address allocation: Check whether multiple ports are assigned the same IP address. This is usually illegal unless it involves special network configurations (such as virtual IP, NAT, etc.).

[0027] MAC address uniqueness: Ensure that each MAC address is assigned to only one port in the entire network, unless there is a specific network configuration that allows MAC address cloning or bridging.

[0028] Port status synchronization: Verify that the status information between different devices or ports is consistent. For example, if two ports are connected through a physical or logical connection, their status should be synchronized (such as both enabled or both disabled).

[0029] When the comparison results meet the preset requirements, that is, the data has passed cross-validation, the system believes that the data is accurate and reliable, and then it can establish a mapping relationship between the network device port and the IP address. This mapping relationship can be stored using a hash table or database for fast query and update. Hash table: Suitable for scenarios that require fast search. It can map key-value pairs (such as port numbers and IP addresses) to specific locations in memory through hash functions, thereby achieving efficient access. Database: Suitable for scenarios that require persistent storage and complex queries. It can store more information (such as port status, MAC addresses, etc.) and support complex queries and operations.

[0030] Using a combination of MAC and IP addresses, duplicate data is identified and removed from the initial port status data. This step effectively avoids data redundancy and ensures data accuracy and consistency in subsequent processing. Duplicate MAC-IP pairs can lead to network management confusion, so this step is essential for establishing an effective mapping table. Data from the first network device port is compared with data from other network device ports, covering IP address assignment, MAC address uniqueness, and port status synchronization. This cross-validation mechanism can detect potential configuration errors or security threats, such as IP address conflicts and MAC address forgery, thereby enhancing network security and stability. The mapping relationship between network device ports and IP addresses is stored using a hash table or a database. Both data structures provide efficient data access and query capabilities. Hash tables enable fast key-value pair lookups, while databases offer richer data management and query capabilities. This storage method not only improves data processing efficiency but also facilitates subsequent network management and maintenance. The entire process is automated, reducing manual intervention and improving the efficiency and accuracy of network management. At the same time, through preset comparison requirements and storage mechanisms, intelligent management of network device port status is achieved, providing network administrators with a more convenient and reliable management tool.

[0031] S120, obtaining a set of IP addresses in the current network, and constructing an IP address resource pool according to the set; Scan and obtain IP addresses from the current network. Organize the obtained IP address information to remove duplicates and invalid addresses. Group the organized IP addresses by subnet or specific classification. Use a database (such as MySQL, PostgreSQL, etc.) or text files (such as CSV, Excel, etc.) to store IP address pool data. Database storage provides better data query and management capabilities, while text files are more suitable for simple data storage and sharing. Add relevant metadata to each IP address, such as the device name, MAC address, subnet to which it belongs, allocation status (allocated / unallocated), and lease period (if applicable). This metadata helps to better manage and track the addresses in the IP address pool. Implement access control on the IP address pool to ensure that only authorized users or systems can access and modify the data. This can be achieved by setting database user permissions, using encryption technology, or implementing network access control.

[0032] Optionally, obtaining a set of IP addresses in the current network and constructing an IP address resource pool according to the set includes: Scan all subnets in the current network and collect the IP addresses within each subnet; Verify the collected IP addresses to eliminate invalid IP addresses caused by configuration errors or equipment failures and obtain valid IP addresses; Classifying the valid IP addresses to obtain allocated IP addresses and unallocated IP addresses, wherein the allocated IP addresses include IP addresses in use and reserved IP addresses; An IP address resource pool is constructed according to the classification result, the unallocated IP addresses are stored as available resources, and allocation status and usage information are added to the allocated IP addresses.

[0033] Determine the network range to scan, which typically includes one or more subnets. You can obtain this information from your network administrator or review the network configuration documentation. Use a network scanning tool (such as Nmap, Advanced IPScanner, or SolarWinds IP Address Manager) to scan the identified network range. These tools send ICMP echo requests (pings) or other types of network requests to detect active devices on the network and collect their IP addresses. Record the scanned IP addresses, which can be stored in a text file, a database, or a dedicated network management system. Verify that the IP addresses are formatted correctly. A valid IPv4 address consists of four numbers between 0 and 255, separated by periods (.). IPv6 addresses use delimited hexadecimal notation. Use ping or another network testing tool to send packets to each IP address to check if it responds. Unresponsive IP addresses may be invalid or the device may be offline. For responsive IP addresses, further check their associated MAC addresses. An ARP (Address Resolution Protocol) request can be used to obtain the MAC address corresponding to an IP address. If the MAC address is invalid or does not exist, the IP address may be misconfigured. Based on network configuration or historical data, exclude known invalid or reserved addresses (such as network addresses and broadcast addresses). If the network uses DHCP (Dynamic Host Configuration Protocol) to assign IP addresses, check the DHCP server's logs or client list to determine which IP addresses have been assigned. By querying a DNS (Domain Name System) server, you can obtain the host name or domain name associated with the IP address. For IP addresses whose allocation status cannot be determined automatically, manual verification may be required. This can be done by logging into the device, checking network configuration files, or using other network management tools. Store assigned and unassigned IP addresses separately. Assigned IP addresses can be accompanied by allocation status (such as active, reserved, etc.) and usage information (such as device name, MAC address, lease duration, etc.). Design the structure of the IP address resource pool based on the organization's needs. This can include different subnets, IP address ranges, and allocation policies. Use a database, configuration files, or a dedicated network management system to store IP address resource pool data. Ensure data security and accessibility.

[0034] By scanning all subnets in the current network, we ensure that IP addresses within all subnets are effectively collected. This step forms the foundation for building a resource pool and ensures data integrity and accuracy. Verifying the collected IP addresses eliminates invalid IP addresses caused by configuration errors or device failures. This not only improves the validity of the addresses in the resource pool but also prevents resource waste and management confusion caused by invalid addresses. Classifying valid IP addresses into allocated and unallocated categories clearly demonstrates network resource utilization. Allocated addresses include both in-use and reserved addresses, providing administrators with intuitive information on network usage. Unallocated addresses are stored as available resources, facilitating future address allocation. The IP address resource pool constructed based on these classifications enables centralized management and efficient utilization of IP address resources. Address information in the resource pool, including allocation status and usage information, facilitates administrators in address allocation, reclaiming, and monitoring operations, thereby improving the efficiency and accuracy of network management.

[0035] S130. Obtain current port status data of each network device port in the port set at a preset time interval, the current port status data including traffic data and IP address activity status, and determine IP address data based on the current port status data and the mapping table; You can set a preset interval, which can range from minutes to hours to days, depending on the network size, number of devices, and management requirements. At each preset interval, the system or network monitoring tool automatically begins collecting network device port status data. This data typically includes traffic data and IP address activity. Traffic data reflects the data transmission status of a network device port over a period of time, including the amount of data sent and received, the number of packets, and error rates. This data is crucial for evaluating network performance and identifying potential network bottlenecks or faults. IP address activity indicates whether the IP address associated with the port is actively in use on the network. This is typically determined by detecting network communication activity associated with the IP address. If no communication activity is detected for a period of time, the IP address may be considered inactive. After collecting current port status data, the system reviews a previously established mapping table. This mapping table records the correspondence between network device ports and IP addresses. The system matches the IP address in the current port status data with the IP address in the mapping table. By comparing current port status data (such as traffic data and IP address activity) with historical data in the mapping table, the system can verify the accuracy and validity of the IP address.

[0036] S140: Compare the IP address data with the IP address resource pool to determine idle IP addresses and abnormal IP addresses, mark the abnormal IP addresses, release the idle IP addresses, and update the IP address resource pool.

[0037] Compare the collected IP address data with data in the resource pool. The primary purpose of this comparison is to identify IP addresses that are recorded in the resource pool but not in the current data (i.e., idle IP addresses), as well as IP addresses that appear in the current data but have a status that is inconsistent with that in the resource pool (i.e., anomalous IP addresses). An idle IP address is one that is marked as allocated or reserved in the resource pool, but has no activity or traffic detected in the most recently collected data, and has not experienced activity for a period of time (based on a time threshold set by network management policies). An anomalous IP address is one whose status in the resource pool is inconsistent with that observed in the current data. For example, an IP address in the resource pool might be marked as unallocated, but traffic or activity is detected in the current data; or an IP address in the resource pool might be assigned to a specific device, but traffic from a different device is detected in the current data. When anomalous IP addresses are identified, the system or tool will tag them so that administrators can easily identify and address them. This tagging can be done by modifying the record in the resource pool, adding a specific tag or annotation, or including the anomalous address in a separate report or log. For idle IP addresses, the system or tool releases them from the resource pool, updating their status to unallocated or available. This is done to reclaim unused network resources so they can be reallocated to other devices or services in need. After completing the above steps, the system or tool updates the IP address resource pool to reflect the latest IP address status information. This includes deleting records of released idle IP addresses, updating the status information of abnormal IP addresses, and adding any newly discovered IP addresses (if applicable).

[0038] Optionally, comparing the IP address data with the IP address resource pool to determine idle IP addresses and abnormal IP addresses includes: Determining the activity of the IP address corresponding to the port of the second network device based on the frequency of port opening / closing and the duration of time the port is open; Collecting and analyzing traffic data for each IP address and determining a traffic pattern for each IP address based on the traffic data, the traffic data including the amount of data sent and received, the number of packets, and the time distribution of traffic occurrence; Determining a current state of the IP address based on a preset activity threshold and a preset traffic pattern threshold, wherein the current state includes active and idle; The current state is compared with the record state of the corresponding IP address in the IP address resource pool, and an IP address whose current state is inconsistent with the record state is determined as an abnormal IP address.

[0039] By monitoring the frequency of port openings and closings on network devices and the duration of port openings, the activity of the IP address associated with the port can be assessed. A port that is frequently opened and opened for a long time often indicates that the associated IP address is more active. An activity index can be calculated based on the monitored data, reflecting the port's activity over a period of time. This index can be a time-based sum of the number of times a port is opened, the total duration of the opening, or a composite index that combines these factors. Traffic data includes the amount of data sent and received, the number of packets, and the time distribution of traffic. This data can be collected using network monitoring tools or traffic analyzers. By analyzing traffic data, the traffic pattern of each IP address can be identified. A traffic pattern refers to the pattern of data traffic changes at an IP address over a period of time, including peak values, average values, and fluctuations. To determine the current status of an IP address, two thresholds are set: a preset activity threshold and a preset traffic pattern threshold. These thresholds can be determined based on factors such as network scale, device type, and service requirements. The calculated activity index is compared with the preset activity threshold, and the traffic pattern is analyzed to determine whether it meets the preset traffic pattern threshold. Based on the comparison results, the IP address status is determined to be active or idle. The current status of the IP address is compared with the recorded status of the corresponding IP address in the IP address resource pool. The recorded status in the resource pool may include allocated, reserved, unallocated, etc. If the current status is inconsistent with the recorded status, for example, an IP address recorded as allocated in the resource pool is currently idle, or an IP address recorded as unallocated in the resource pool is currently active, then these IP addresses are identified as abnormal IP addresses.

[0040] By analyzing the frequency of port opening and closing, as well as the duration of port opening, the activity level of the IP address corresponding to the second network device port can be more accurately assessed. This assessment method considers not only the port's current status but also its historical behavior, thereby improving the accuracy of activity assessment. Collecting and analyzing traffic data for each IP address, including the amount of data sent and received, the number of packets, and the temporal distribution of traffic occurrences, provides a deeper understanding of each IP address's traffic patterns. This understanding is crucial for identifying abnormal traffic behavior, predicting network load, and optimizing network performance. Determining the current status (active or idle) of an IP address based on preset activity and traffic pattern thresholds makes status determination more objective and consistent. This determination method reduces the subjectivity of human judgment and improves the efficiency and accuracy of network management. Comparing the current status with the recorded status of the corresponding IP address in the IP address resource pool can promptly identify IP addresses with inconsistent status, known as abnormal IP addresses. This comparison method helps quickly locate and resolve potential network issues, such as IP address conflicts and unauthorized access. By identifying idle and abnormal IP addresses and taking corresponding management measures (such as releasing idle IP addresses and marking and handling abnormal IP addresses), you can optimize the utilization of network resources and reduce resource waste.

[0041] Optionally, comparing the IP address data with the IP address resource pool includes: Divide the comparison task into multiple subtasks, each of which is responsible for processing network device port data within a preset range; Use message queues to manage data flow and synchronization between subtasks, and implement load balancing strategies to evenly distribute subtasks to each node in the cluster; When a node failure is detected, subtasks are reallocated to adjacent nodes.

[0042] Before starting the comparison, the system divides the entire comparison task into multiple subtasks. Each subtask is responsible for processing data from network device ports within a preset range. This range can be determined based on factors such as the network device's geographic location, IP address range, or port type. To manage the data flow and synchronization between these subtasks, the system introduces message queues. A message queue is a mechanism for passing messages between different components or services. Here, a message queue is used to pass data, status, and progress information between subtasks, ensuring that they work in a coordinated and consistent manner. Using message queues, subtasks can receive and process data asynchronously. When a subtask completes processing the data within its scope, it places the results and the next data to be processed into the message queue for subsequent processing by other subtasks. The message queue also provides a synchronization mechanism, ensuring that subtasks avoid data processing conflicts or duplication. Using locks, semaphores, or other synchronization primitives, the system ensures that only one subtask is processing a specific data item at a time. To improve processing efficiency, the system implements a load balancing strategy, which evenly distributes subtasks across nodes in the cluster. In this way, each node will take on a portion of the processing tasks, fully utilizing the cluster's computing resources. Load balancing strategies can be implemented using a variety of methods, such as round-robin, random assignment, and hash assignment. These methods aim to ensure that subtasks are evenly distributed across nodes, preventing situations where one node is overloaded while others are idle. The system regularly monitors the status of each node in the cluster. If a node failure (such as a shutdown or network outage) is detected, the system immediately triggers a failure recovery mechanism. Upon detecting a node failure, the system reassigns unfinished subtasks on that node to a neighboring node. This neighboring node can be physically adjacent or logically adjacent (such as a replacement node determined by an algorithm). By redistributing subtasks, the system ensures that tasks on the failed node are not lost and that processing progress can be resumed as quickly as possible.

[0043] Dividing the comparison task into multiple subtasks fully utilizes multi-core processors and distributed computing resources, enabling parallel processing. This significantly improves data processing efficiency and shortens comparison task completion time. By implementing a load balancing strategy, subtasks are evenly distributed across the cluster nodes, ensuring that each node receives an appropriate workload. This prevents overloading of some nodes while leaving others idle, improving overall system resource utilization and throughput. When a node failure is detected, the system quickly reassigns subtasks to adjacent nodes, ensuring that the comparison task is not interrupted by a single node failure. This fault detection and recovery mechanism enhances the system's fault tolerance and reliability. Using message queues to manage data flow and synchronization between subtasks ensures data consistency during transmission and processing between nodes. This prevents data loss, duplication, and inconsistency, improving data processing accuracy. The load balancing strategy dynamically adjusts subtask allocation based on the real-time load of each node in the cluster. This ensures that the system fully utilizes available resources, avoiding resource waste and bottlenecks. By dividing the comparison task into subtasks and managing them using message queues, the system can easily add or remove nodes to adapt to changing workloads and data processing requirements. This scalability allows the system to flexibly cope with future growth and changes.

[0044] Optionally, the method further includes: Analyze traffic characteristics of the abnormal IP address and determine a traffic anomaly score based on the traffic characteristics, including the source IP address, destination IP address, protocol type used, and specific data patterns in the traffic; Analyzing the behavior patterns of abnormal IP addresses and determining a behavior anomaly score based on the behavior patterns, including the frequency of sending data packets and the number of attempts to access unauthorized resources; A weighted sum of the traffic anomaly score and the behavior anomaly score is performed to obtain a total anomaly score, and whether the abnormal IP address is a potential threat is determined based on the total anomaly score.

[0045] Collect traffic data from abnormal IP addresses, including source IP addresses, destination IP addresses, protocol types used, and specific data patterns in the traffic. This data can be obtained using network monitoring tools or traffic analysis tools. Extract key features from the collected traffic data. These features can reflect the traffic behavior of the abnormal IP addresses. For example, whether the source IP addresses change frequently, whether the destination IP addresses are concentrated in a specific range, whether the protocol types used are abnormal (such as unauthorized protocols), and whether specific data patterns exist in the traffic (such as malware signatures). Based on the extracted traffic features, calculate a traffic anomaly score using a pre-set algorithm or model. This score reflects the degree of abnormality in the traffic behavior of the abnormal IP address. The score calculation may involve the weighted sum of multiple features or the prediction results of a machine learning model. The system needs to continuously monitor the behavioral data of abnormal IP addresses, including the frequency of packet transmission and the number of attempts to access unauthorized resources. This data can be obtained using network behavior analysis tools or security log collection tools. Extract key behavioral patterns from the monitored behavioral data. These patterns can indicate potential malicious behavior of the abnormal IP addresses. For example, whether the frequency of packet transmission is abnormally high or whether there are frequent attempts to access unauthorized resources or perform unauthorized operations. Based on the extracted behavioral patterns, a pre-set algorithm or model is used to calculate a behavioral anomaly score. This score reflects the degree of abnormality in the abnormal IP address's behavioral pattern. Similarly, the score calculation may involve the weighted sum of multiple features, the prediction results of a machine learning model, and so on. The traffic anomaly score and the behavioral anomaly score are weighted and summed to obtain a total anomaly score. This total score comprehensively reflects the overall degree of abnormality of the abnormal IP address. A threshold for the total anomaly score is set based on network management needs and security policy requirements. This threshold is used to determine whether the abnormal IP address poses a potential threat. If the total anomaly score exceeds the set threshold, the abnormal IP address is considered a potential threat and further security measures are required. These measures may include isolating the abnormal IP address, notifying the security team for investigation, and logging and reporting the abnormal behavior.

[0046] By analyzing the traffic characteristics (such as source IP address, destination IP address, protocol type used, and specific data patterns in the traffic) and behavioral patterns (such as the frequency of packet transmission and the number of attempts to access unauthorized resources) of abnormal IP addresses, a comprehensive assessment of the IP address's anomaly level can be made from multiple dimensions. This multi-dimensional analysis more accurately identifies potential network threats and reduces false positives and negatives. By calculating a traffic anomaly score and a behavioral anomaly score and weighting them together to create an overall anomaly score, the degree of anomaly is quantified into a specific numerical value. This quantitative assessment allows administrators to more intuitively understand the severity of an IP address's anomaly and take appropriate action accordingly. Real-time analysis of IP address traffic and behavioral data enables timely identification of potential network threats. This helps administrators take preventative measures to protect network systems before threats cause actual damage.

[0047] Optionally, the method further includes: Extract target features from historical port status data and traffic information to build a training dataset; Selecting a supervised learning algorithm to train an initial model based on the training data set to obtain a prediction model to identify normal behavior patterns and abnormal behavior characteristics; The prediction model is used to evaluate the current port status data in real time to predict whether the behavior is abnormal, and the preset activity threshold and the preset traffic pattern threshold are adjusted according to the prediction results.

[0048] Collect data from historical port status data and traffic information. This data may include port open / close status, traffic volume, number of packets, and time distribution of traffic occurrences. Target features are extracted from the collected data. These features should reflect both normal and abnormal behavior patterns of network ports. For example, port activity, traffic patterns (such as periodicity or burstiness), and protocol types can be extracted. Combine the extracted features with the target (normal or abnormal) to construct a training dataset. This dataset will be used to train the machine learning model. Select a supervised learning algorithm suitable for classification problems, such as decision trees, random forests, support vector machines, or neural networks. These algorithms can learn patterns of normal and abnormal behavior from training data. Use the training dataset to train the initial model. During training, the algorithm continuously adjusts model parameters to improve the accuracy of identifying normal and abnormal behavior. After training, a predictive model is generated that can identify both normal and abnormal behavior patterns. Use the predictive model to evaluate current port status data in real time. This involves inputting current data into the model and obtaining the model's output prediction (normal or abnormal). Based on the prediction, determine whether the current port behavior is abnormal. If the prediction result is abnormal, it may indicate a potential security threat or fault in the network. Based on the comparison between the prediction model output and actual conditions, the preset activity threshold and traffic pattern threshold are dynamically adjusted. These thresholds are used to determine the current status of the IP address (active or idle) in the previous step. By adjusting these thresholds, the model can be made more accurate and sensitive in identifying normal and abnormal behavior.

[0049] The target features extracted from historical data can comprehensively reflect the normal and abnormal behavior patterns of network ports. These features include, but are not limited to, patterns of port status changes and statistical characteristics of traffic data, helping the model more accurately identify abnormal behavior. Selecting an appropriate supervised learning algorithm (such as a support vector machine, decision tree, or neural network) for model training can fully utilize the labeled information in the training dataset. By learning normal and abnormal behavior patterns, the model can more accurately identify abnormal behavior in current port status data. The training dataset contains a wealth of historical port status data and traffic information, covering a wide range of normal and abnormal behavior patterns. This allows the model to learn more knowledge and patterns during training, thereby improving its generalization capabilities. Using a predictive model to evaluate current port status data in real time enables timely detection of abnormal behavior and early warning. Adjusting preset activity thresholds and traffic pattern thresholds based on prediction results can further optimize the model's recognition performance and enable it to better adapt to changes in the network environment. Automated predictive modeling for behavioral pattern recognition can significantly reduce the workload of network administrators, allowing administrators to focus more on handling abnormal events and formulating network management policies, thereby improving network management efficiency. The predictive model evaluates current port status data in real time and issues timely warnings when abnormal behavior is detected. This helps administrators take prompt action when an abnormal event occurs, preventing further spread and damage. Real-time evaluation by the predictive model enables early detection of potential network security threats. This helps administrators take preventative measures to protect network systems before threats cause actual damage. Dynamically adjusting preset activity and traffic pattern thresholds based on prediction results allows the model to better adapt to changes in the network environment. This helps improve the model's recognition accuracy and adaptability, further enhancing network security.

[0050] This embodiment also discloses an IP address verification system based on port status data. Figure 2 This is a module diagram of the IP address verification system based on port status data disclosed in the embodiment of the present application. Figure 2 As shown, the system includes a port module 201, an address module 202, a collection module 203, and a verification module 204, wherein: The port module 201 is configured to construct a port set based on all network device ports in the current network, obtain initial port state data of each network device port in the port set, the initial port state data including a port open / close timestamp, a MAC address, and an IP address, and establish a mapping table between network device ports and IP addresses based on the initial port state data; The address module 202 is configured to obtain a set of IP addresses in the current network and construct an IP address resource pool based on the set; The acquisition module 203 is configured to obtain current port status data of each network device port in the port set at a preset time interval, the current port status data including traffic data and IP address activity status, and determine IP address data based on the current port status data and the mapping table; The verification module 204 is configured to compare the IP address data with the IP address resource pool, determine idle IP addresses and abnormal IP addresses, mark the abnormal IP addresses, release the idle IP addresses, and update the IP address resource pool.

[0051] Optionally, the port module 201 is configured to: Identifying and removing duplicate data in the initial port state data by combining the MAC address and the IP address to obtain first intermediate data; Comparing the first intermediate data of the first network device port with the first intermediate data of other network device ports participating in the cross-validation, the comparison content including the allocation of IP addresses, the uniqueness of MAC addresses, and the synchronization of port states, the first network device port being any port in the port set, and the other network device ports being ports in the port set other than the first network device port; When the comparison result meets the preset requirements, a hash table or a database is used to store the mapping relationship between the first network device port and the IP address.

[0052] Optionally, the address module 202 is configured to: Scan all subnets in the current network and collect the IP addresses within each subnet; Verify the collected IP addresses to eliminate invalid IP addresses caused by configuration errors or equipment failures and obtain valid IP addresses; Classifying the valid IP addresses to obtain allocated IP addresses and unallocated IP addresses, wherein the allocated IP addresses include IP addresses in use and reserved IP addresses; An IP address resource pool is constructed according to the classification result, the unallocated IP addresses are stored as available resources, and allocation status and usage information are added to the allocated IP addresses.

[0053] Optionally, the verification module 204 is configured to: Determining the activity of the IP address corresponding to the port of the second network device based on the frequency of port opening / closing and the duration of time the port is open; Collecting and analyzing traffic data for each IP address and determining a traffic pattern for each IP address based on the traffic data, the traffic data including the amount of data sent and received, the number of packets, and the time distribution of traffic occurrence; Determining a current state of the IP address based on a preset activity threshold and a preset traffic pattern threshold, wherein the current state includes active and idle; The current state is compared with the recorded state of the corresponding IP address in the IP address resource pool, and an IP address whose current state is inconsistent with the recorded state is determined as an abnormal IP address.

[0054] Optionally, the system further includes an analysis module, wherein the analysis module is configured to: Analyze traffic characteristics of the abnormal IP address and determine a traffic anomaly score based on the traffic characteristics, including the source IP address, destination IP address, protocol type used, and specific data patterns in the traffic; Analyzing the behavior patterns of abnormal IP addresses and determining a behavior anomaly score based on the behavior patterns, including the frequency of sending data packets and the number of attempts to access unauthorized resources; A weighted sum of the traffic anomaly score and the behavior anomaly score is performed to obtain a total anomaly score, and whether the abnormal IP address is a potential threat is determined based on the total anomaly score.

[0055] Optionally, the system further includes an evaluation module, configured to: Extract target features from historical port status data and traffic information to build a training dataset; Selecting a supervised learning algorithm to train an initial model based on the training data set to obtain a prediction model to identify normal behavior patterns and abnormal behavior characteristics; The prediction model is used to evaluate the current port status data in real time to predict whether the behavior is abnormal, and the preset activity threshold and the preset traffic pattern threshold are adjusted according to the prediction results.

[0056] Optionally, the verification module 204 is configured to: Divide the comparison task into multiple subtasks, each of which is responsible for processing network device port data within a preset range; Use message queues to manage data flow and synchronization between subtasks, and implement load balancing strategies to evenly distribute subtasks to each node in the cluster; When a node failure is detected, subtasks are reallocated to adjacent nodes.

[0057] It should be noted that the above embodiments provide devices that implement their functions using only the division of the above functional modules as examples. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0058] This embodiment also discloses an electronic device, referring to Figure 3 The electronic device may include: at least one processor 301 , at least one communication bus 302 , a user interface 303 , a network interface 304 , and at least one memory 305 .

[0059] The communication bus 302 is used to implement the connection and communication between these components.

[0060] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0061] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0062] The processor 301 may include one or more processing cores. Using various interfaces and circuits, the processor 301 connects to various components within the server. It executes instructions, programs, code sets, or instruction sets stored in the memory 305, as well as accesses data stored in the memory 305, to perform various server functions and process data. Optionally, the processor 301 may be implemented using at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 301 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing content displayed on the display screen; and the modem handles wireless communications. It is understood that the modem may not be integrated into the processor 301 but implemented as a separate chip.

[0063] Among them, the memory 305 may include a random access memory (RAM) or a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may also be optionally at least one storage device located away from the aforementioned processor 301. As Figure 3 As shown, the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program of an IP address verification method based on port status data.

[0064] exist Figure 3 In the electronic device shown, the user interface 303 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 301 can be used to call the application program of the IP address verification method based on port status data stored in the memory 305. When executed by one or more processors 301, the electronic device executes one or more methods as in the above embodiments.

[0065] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for this application.

[0066] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0067] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are merely schematic, such as the division of units, which is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interface, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0068] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0069] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0070] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of this application, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory 305 and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of this application. The aforementioned memory 305 includes various media that can store program code, such as a USB flash drive, a mobile hard drive, a magnetic disk, or an optical disk.

[0071] The above is only an exemplary embodiment of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification, those skilled in the art will easily think of other embodiments of the present disclosure. This application is intended to cover any variations, uses or adaptive changes of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the technical field that are not recorded in the present disclosure. The description and examples are to be regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A method for checking an IP address based on port status data, characterized in that: Applied to an IP address verification platform, the method includes: Building a port set according to all network device ports in the current network, obtaining initial port status data of each network device port in the port set, wherein the initial port status data includes a port opening / closing timestamp, a MAC address, and an IP address, and establishing a mapping table between network device ports and IP addresses according to the initial port status data; Obtain a set of IP addresses in the current network, and construct an IP address resource pool based on the set; Acquire current port status data of each network device port in the port set at preset intervals, the current port status data including flow data and IP address activity status, and determine IP address data according to the current port status data and the mapping table; The IP address data is compared with the IP address resource pool to determine idle IP addresses and abnormal IP addresses, the abnormal IP addresses are marked and the idle IP addresses are released, and the IP address resource pool is updated.

2. The IP address verification method based on port status data according to claim 1, characterized in that: The step of establishing a mapping table between network device ports and IP addresses according to the initial port status data comprises: Identify and remove duplicate data in the initial port state data by combining the MAC address and the IP address to obtain first intermediate data; Compare the first intermediate data of the first network device port with the first intermediate data of other network device ports participating in the cross-validation, the comparison content including the allocation of IP addresses, the uniqueness of MAC addresses and the synchronization of port states, the first network device port is any port in the port set, and the other network device ports are ports in the port set other than the first network device port; When the comparison result meets the preset requirements, a hash table or a database is used to store the mapping relationship between the first network device port and the IP address.

3. The IP address verification method based on port status data according to claim 1, characterized in that: The step of obtaining a set of IP addresses in the current network and constructing an IP address resource pool according to the set includes: Scan all subnets in the current network and collect the IP addresses in each subnet; Verify the collected IP addresses to exclude invalid IP addresses caused by configuration errors or equipment failures and obtain valid IP addresses; Classifying the valid IP addresses to obtain allocated IP addresses and unallocated IP addresses, wherein the allocated IP addresses include IP addresses in use and reserved IP addresses; An IP address resource pool is constructed according to the classification result, the unallocated IP addresses are stored as available resources, and allocation status and usage information are added to the allocated IP addresses.

4. The IP address verification method based on port status data according to claim 1, characterized in that: The comparing the IP address data with the IP address resource pool to determine idle IP addresses and abnormal IP addresses includes: Determine the activity of the IP address corresponding to the port of the second network device according to the frequency of opening / closing the port and the duration of the port opening; Collect and analyze traffic data for each IP address, and determine the traffic pattern of each IP address based on the traffic data, the traffic data including the amount of data sent and received, the number of data packets, and the time distribution of traffic occurrence; Determine a current state of the IP address according to a preset activity threshold and a preset traffic pattern threshold, wherein the current state includes active and idle; The current state is compared with the record state of the corresponding IP address in the IP address resource pool, and an IP address whose current state is inconsistent with the record state is determined as an abnormal IP address.

5. The IP address verification method based on port status data according to claim 4 is characterized in that: The method further comprises: Analyze traffic characteristics of abnormal IP addresses and determine traffic anomaly scores based on the traffic characteristics, wherein the traffic characteristics include source IP addresses, destination IP addresses, used protocol types, and specific data patterns in the traffic; Analyze the behavior pattern of the abnormal IP address and determine the behavior anomaly score according to the behavior pattern, wherein the behavior pattern includes the frequency of sending data packets and the number of attempts to access unauthorized resources; The traffic anomaly score and the behavior anomaly score are weighted and summed to obtain a total anomaly score, and whether the abnormal IP address is a potential threat is determined according to the total anomaly score.

6. The IP address verification method based on port status data according to claim 1, characterized in that: The method further comprises: Extract target features from historical port status data and traffic information to build a training data set; Selecting a supervised learning algorithm to train an initial model based on the training data set to obtain a prediction model to identify normal behavior patterns and abnormal behavior characteristics; The prediction model is used to evaluate the current port status data in real time, predict whether the behavior is abnormal, and adjust the preset activity threshold and the preset traffic mode threshold according to the prediction result.

7. The IP address verification method based on port status data according to claim 1, characterized in that: The comparing the IP address data with the IP address resource pool comprises: Divide the comparison task into multiple subtasks, each of which is responsible for processing network device port data within a preset range; Use message queues to manage data flow and synchronization between subtasks, and implement load balancing strategies to evenly distribute subtasks to each node in the cluster; When a node failure is detected, subtasks are reallocated to adjacent nodes.

8. An IP address verification system based on port status data, characterized in that: It includes port module, address module, collection module and verification module, among which: A port module is configured to construct a port set according to all network device ports in the current network, obtain initial port status data of each network device port in the port set, the initial port status data including a port opening / closing timestamp, a MAC address and an IP address, and establish a mapping table between network device ports and IP addresses according to the initial port status data; An address module configured to obtain a set of IP addresses in the current network and construct an IP address resource pool according to the set; A collection module configured to obtain current port status data of each network device port in the port set at a preset time interval, wherein the current port status data includes flow data and IP address activity status, and determine IP address data according to the current port status data and the mapping table; The checking module is configured to compare the IP address data with the IP address resource pool, determine idle IP addresses and abnormal IP addresses, mark the abnormal IP addresses and release the idle IP addresses, and update the IP address resource pool.

9. An electronic device, characterized in that: It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is performed.

Images