Local area network subnet vulnerability processing method, storage medium and system

Abstract

The invention provides a local area network subnet vulnerability processing method, storage medium and system, and the method comprises the following steps: judging whether a hidden subnet exists in a local area network or not according to the feature difference of different protocols in network traffic; if the hidden subnet exists in the local area network, identifying the hidden subnet by adopting a flow analysis method; according to the identified network address information of the hidden subnet, implanting an agent program of a vulnerability scanner into the hidden subnet; the vulnerability scanner performs vulnerability scanning on assets in the hidden subnet according to the asset information to obtain vulnerability information existing in the hidden subnet; according to the vulnerability information, judging whether a vulnerability exists in the hidden subnet or not; and counting and classifying all vulnerabilities in the hidden subnet, and if the security risk level of the vulnerabilities meets a triggering condition, triggering a preset security policy, and processing the vulnerabilities existing in the hidden subnet. According to the method, the service continuity can be ensured, and meanwhile, comprehensive discovery, evaluation and security reinforcement of the hidden subnet can be realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a local area network subnet vulnerability processing method, storage medium and system. Background Art

[0002] The existence of hidden subnets poses a huge challenge to network security management. These subnets are usually not displayed in the regular network topology and are difficult to be discovered and managed by traditional security tools. Due to the lack of visibility, hidden subnets become potential security blind spots, and there may be unknown vulnerabilities and threats. In this case, how to effectively identify and manage hidden subnets becomes a key issue. Even if the hidden subnet is successfully discovered, how to conduct a comprehensive vulnerability scan and assessment on it without affecting normal business is also a technical challenge. Considering that the hidden subnet may carry important or sensitive business functions, rash scanning may cause unexpected interruptions. In addition, once a vulnerability is found in a hidden subnet, how to quickly and accurately implement repair or isolation measures while minimizing the impact on the business is also an urgent problem to be solved. These challenges are interrelated and together constitute a complex technical problem: how to achieve comprehensive discovery, assessment and security reinforcement of hidden subnets while ensuring business continuity. This problem involves multiple technical fields such as network detection, vulnerability scanning, risk assessment and automated repair, and requires a balance between security and availability. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is how to achieve comprehensive discovery, evaluation and security reinforcement of hidden subnets while ensuring business continuity.

[0005] (II) Technical solution

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] The present invention provides a method for processing a local area network subnet vulnerability, comprising the following steps:

[0008] Collecting network traffic in the local area network through a traffic mirroring device, and judging whether there is a hidden subnet in the local area network according to the feature differences of different protocols in the network traffic;

[0009] If there is a hidden subnet in the local area network, identifying the hidden subnet by using a traffic analysis method according to the network traffic of the hidden subnet;

[0010] Implanting a vulnerability scanner agent program into the hidden subnet according to the identified network address information of the hidden subnet;

[0011] Acquire asset information in the hidden subnet through the agent program, and send the asset information to the vulnerability scanner;

[0012] According to the asset information, the vulnerability scanner is used to perform a vulnerability scan on the assets in the hidden subnet to obtain vulnerability information existing in the hidden subnet;

[0013] According to the vulnerability information, determining whether there is a vulnerability in the hidden subnet;

[0014] Counting and classifying all vulnerabilities in the hidden subnet to confirm the security risk level of the vulnerabilities in the hidden subnet;

[0015] If the security risk level meets the triggering condition, the preset security policy is triggered to process the vulnerability existing in the hidden subnet.

[0016] Preferably, the method further comprises the following steps:

[0017] Collect all network traffic data in the local area network and all hidden subnets through the traffic mirroring device;

[0018] Performing deep packet inspection on all the collected network traffic data, parsing each data packet, extracting key fields and payload content, and forming a structured traffic feature data set;

[0019] Adopting an autoencoder model in an unsupervised learning algorithm and using the structured traffic feature dataset to train a normal traffic baseline model;

[0020] Collect network traffic data in real time, and obtain real-time traffic feature vectors through deep packet inspection.

[0021] The real-time traffic feature vector is input into the trained autoencoder model to calculate the reconstruction error. If the reconstruction error exceeds a preset threshold, it is determined to be abnormal traffic;

[0022] For the detected abnormal traffic, we analyze its behavior pattern in combination with the pre-built expert rule base to determine whether it is an unknown vulnerability attack. The expert rule base contains rules such as known attack patterns, network protocol anomalies, and data packet content anomalies.

[0023] Extract key features from the traffic of the determined unknown vulnerability attack, add them to the anomaly detection model feature set, and regularly retrain and update the autoencoder model through the anomaly detection model feature set.

[0024] Preferably, judging whether there is a hidden subnet in the local area network according to the feature differences of different protocols in the network traffic specifically includes the following steps:

[0025] Extracting protocol data from the network traffic by protocol parsing software;

[0026] According to the protocol data, it is determined whether there is a non-standard protocol or a custom protocol in the network traffic data. If so, it indicates that there is a hidden subnet in the local area network.

[0027] Preferably, the method of identifying the hidden subnet by using a traffic analysis method according to the network traffic of the hidden subnet specifically includes the following steps:

[0028] According to the network traffic of the hidden subnet, its traffic characteristics are further analyzed to identify the topological structure and host information of the hidden subnet, wherein the traffic characteristics include data packet size, communication frequency and communication duration.

[0029] Preferably, further analyzing the traffic characteristics of the hidden subnet to identify the topology and host information of the hidden subnet specifically includes the following steps:

[0030] According to the network address information of the hidden subnet, the hidden subnet is detected by using a network scanning technology to obtain the active host information in the hidden subnet;

[0031] Analyze the IP addresses and MAC addresses of the detected active hosts, determine the connection relationship between the hosts, and obtain the preliminary topological structure of the hidden subnet;

[0032] According to the preliminary topology structure, the communication traffic between the hosts in the hidden subnet is captured and analyzed by using traffic analysis technology to obtain the communication protocol and port information between the hosts;

[0033] The communication protocol and port information are analyzed to determine the dependency and service relationship between hosts, improve the topology of the hidden subnet, form a topology diagram and determine key host nodes.

[0034] Preferably, the step of implanting a vulnerability scanner agent program into the hidden subnet according to the identified network address information of the hidden subnet specifically comprises the following steps:

[0035] Using a graph theory algorithm, the topological structure diagram of the hidden subnet is analyzed to obtain the connectivity and centrality of each host node in the hidden subnet;

[0036] Determining candidate locations for implanting an agent program of a vulnerability scanner into the hidden subnet based on connectivity and centrality of host nodes in the hidden subnet;

[0037] Evaluate the availability and stability of the hosts at the candidate locations to select the best candidate locations;

[0038] If the availability and stability of the host at the optimal candidate location meet the requirements, the optimal candidate location is determined as a key host node;

[0039] According to the key host node, the configuration information of the vulnerability scanning agent is generated, and the configuration information of the vulnerability scanning agent is sent to the key host node to complete the implantation of the agent program of the vulnerability scanner.

[0040] Preferably, the process of counting and classifying all the vulnerabilities in the hidden subnet to confirm the risk level of the vulnerabilities in the hidden subnet, and triggering a preset security policy to process the vulnerabilities in the hidden subnet if the risk level meets the triggering condition, specifically includes the following steps:

[0041] Sending the scanned device vulnerability information in the hidden subnet to the vulnerability management platform through a network transmission protocol and storing it in a vulnerability database;

[0042] Read the vulnerability information of the devices in the hidden subnet from the vulnerability database through the vulnerability management platform, and classify and statistically analyze the vulnerability information;

[0043] According to the classification and statistical analysis results of the device vulnerability information in the hidden subnet, the type and number of vulnerabilities existing in the hidden subnet are determined through the vulnerability management platform;

[0044] According to the types and numbers of vulnerabilities existing in the hidden subnet, the security risk level faced by the devices in the hidden subnet is determined through the vulnerability management platform;

[0045] If the security risk level faced by the devices in the hidden subnet exceeds a preset threshold, the preset security policy is triggered through the vulnerability management platform to process the vulnerabilities existing in the hidden subnet.

[0046] Preferably, the security strategy includes: isolating assets with vulnerabilities, repairing the vulnerabilities, and sending alarm information to an administrator.

[0047] In a second aspect, the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for handling LAN subnet vulnerabilities as described in any one of the above technical solutions is implemented.

[0048] In a third aspect, the present invention also provides a system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for handling LAN subnet vulnerabilities as described in any one of the above technical solutions is implemented.

[0049] (III) Beneficial effects

[0050] The above technical solution of the present invention has at least the following advantages:

[0051] 1. The present invention identifies hidden subnets by analyzing the network traffic characteristics in the local area network, and implants an agent program in them to obtain asset information. Then, a vulnerability scanner is used to scan the assets in the hidden subnet to find existing vulnerabilities. For the detected vulnerabilities, the present invention will trigger a preset security policy for processing, such as isolating assets with vulnerabilities, repairing vulnerabilities, or sending alarm information to the administrator. This method can effectively discover and handle security risks in hidden subnets, and improve network security protection capabilities.

[0052] 2. The present invention collects network traffic in the local area network by deploying traffic mirroring equipment. The collection of network traffic will not interfere with the normal operation of the business. While ensuring business continuity, it can achieve comprehensive discovery, evaluation and security reinforcement of hidden subnets, thus protecting the network security of enterprises. The present invention realizes automatic detection and vulnerability processing of hidden subnets, and enhances the initiative and comprehensiveness of network security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 It is a flow chart of a method for handling a LAN subnet vulnerability provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0056] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0057] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0058] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0059] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0060] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0061] like Figure 1 As shown, an embodiment of the present invention provides a method for handling a LAN subnet vulnerability, comprising the following steps:

[0062] Traffic mirroring equipment is used to collect network traffic in the LAN. Based on the characteristic differences of different protocols in the network traffic, it is determined whether there is a hidden subnet in the LAN. Traffic mirroring (Mirroring / traffic-shadow), also known as shadow traffic, refers to copying a copy of the real online traffic to the mirroring service through certain configurations. We use traffic mirroring to forward traffic to achieve the purpose of conducting specific analysis on traffic or request content without affecting online services. Its design concept is to only forward without receiving responses (fire and forget).

[0063] If there is a hidden subnet in the LAN, the hidden subnet is identified based on the network traffic of the hidden subnet using traffic analysis methods; the network address range and topology of the hidden subnet are obtained by clustering the traffic of non-standard protocols or custom protocols.

[0064] According to the network address information of the identified hidden subnet, an agent program of the vulnerability scanner is implanted into the hidden subnet;

[0065] The agent program obtains asset information in the hidden subnet and sends the asset information to the vulnerability scanner;

[0066] According to the asset information, a vulnerability scanner is used to perform a vulnerability scan on the assets in the hidden subnet to obtain vulnerability information existing in the hidden subnet;

[0067] According to the vulnerability information, determine whether there is a vulnerability in the hidden subnet;

[0068] All vulnerabilities in the hidden subnet are counted and classified to confirm the security risk level of the vulnerabilities in the hidden subnet. If the security risk level meets the triggering conditions, the preset security policy is triggered to deal with the vulnerabilities in the hidden subnet.

[0069] Preferably, the method further comprises the following steps:

[0070] By deploying traffic mirroring equipment to collect all network traffic data within the LAN and all hidden subnets, complete original traffic information can be obtained;

[0071] Perform deep packet inspection on all collected network traffic data, parse each data packet, extract key fields and payload content, and form a structured traffic feature data set; DPI (Deep Packet Inspection) deep packet inspection technology adds application protocol identification, data packet content detection and deep decoding of application layer data on top of traditional IP data packet inspection technology (detection and analysis of data packet elements contained between OSI L2-L4).

[0072] The autoencoder model in the unsupervised learning algorithm is used to train the normal traffic baseline model using the structured traffic feature dataset;

[0073] Collect network traffic data in real time, and obtain real-time traffic feature vectors through deep packet inspection.

[0074] The real-time traffic feature vector is input into the trained autoencoder model to calculate the reconstruction error. If the reconstruction error exceeds the preset threshold, it is determined to be abnormal traffic.

[0075] For the detected abnormal traffic, we analyze its behavior pattern in combination with the pre-built expert rule base to determine whether it is an unknown vulnerability attack. The expert rule base contains rules such as known attack patterns, network protocol anomalies, and data packet content anomalies.

[0076] Extract key features from the traffic of the determined unknown vulnerability attacks and add them to the feature set of the anomaly detection model. Regularly retrain and update the autoencoder model through the feature set of the anomaly detection model.

[0077] Preferably, judging whether there is a hidden subnet in the local area network according to the characteristic differences of different protocols in the network traffic specifically includes the following steps:

[0078] Extract protocol data from network traffic using protocol parsing software;

[0079] Based on the protocol data, determine whether there are non-standard protocols or custom protocols in the network traffic data. If so, it indicates that there is a hidden subnet in the LAN.

[0080] Preferably, according to the network traffic of the hidden subnet, a traffic analysis method is used to identify the hidden subnet, which specifically includes the following steps:

[0081] According to the network traffic of the hidden subnet, its traffic characteristics are further analyzed to identify the topological structure and host information of the hidden subnet. The traffic characteristics include data packet size, communication frequency and communication duration.

[0082] Preferably, according to the network traffic of the hidden subnet, further analyzing its traffic characteristics to identify the topological structure and host information of the hidden subnet specifically includes the following steps:

[0083] According to the network address information of the hidden subnet, the network scanning technology is used to detect the hidden subnet and obtain the active host information in the hidden subnet;

[0084] By analyzing the IP addresses and MAC addresses of the detected active hosts, the connection relationship between the hosts is determined, and the preliminary topological structure of the hidden subnet is obtained;

[0085] According to the preliminary topology structure, the traffic analysis technology is used to capture and analyze the communication traffic between hosts in the hidden subnet to obtain the communication protocol and port information between hosts;

[0086] By analyzing the communication protocol and port information, the dependency and service relationship between hosts are determined, the topology of the hidden subnet is improved, a topology diagram is formed and key host nodes are identified.

[0087] Preferably, according to the network address information of the identified hidden subnet, an agent program of a vulnerability scanner is implanted into the hidden subnet, which specifically includes the following steps:

[0088] Using graph theory algorithms, the topological structure diagram of the hidden subnet is analyzed to obtain the connectivity and centrality of each host node in the hidden subnet;

[0089] Determine candidate locations for implanting a vulnerability scanner agent into the hidden subnet based on the connectivity and centrality of host nodes in the hidden subnet;

[0090] Evaluate the availability and stability of the hosts at the candidate locations and select the best candidate locations;

[0091] If the availability and stability of the host at the optimal candidate location meet the requirements, the optimal candidate location is determined as the key host node;

[0092] According to the determined key host nodes, the configuration information of the vulnerability scanning agent is generated, and the generated configuration information of the vulnerability scanning agent is sent to the selected key host nodes to complete the implantation of the agent program of the vulnerability scanner.

[0093] Preferably, all vulnerabilities in the hidden subnet are counted and classified to confirm the risk level of the vulnerabilities in the hidden subnet. If the risk level meets the triggering condition, the preset security policy is triggered to process the vulnerabilities in the hidden subnet, which specifically includes the following steps:

[0094] The vulnerability scanning agent sends the scanned device vulnerability information in the hidden subnet to the vulnerability management platform through the network transmission protocol;

[0095] Receive the device vulnerability information in the hidden subnet transmitted by the vulnerability scanning agent through the vulnerability management platform and store it in the vulnerability database;

[0096] The vulnerability management platform reads the vulnerability information of the devices in the hidden subnet from the vulnerability database, and classifies and statistically analyzes the vulnerability information;

[0097] Based on the classification and statistical analysis results of the device vulnerability information in the hidden subnet, the vulnerability management platform is used to determine the type and number of vulnerabilities in the hidden subnet;

[0098] The vulnerability management platform determines the security risk level faced by the devices in the hidden subnet based on the type and number of vulnerabilities in the hidden subnet.

[0099] If the security risk level faced by the devices in the hidden subnet exceeds the preset threshold, the preset security policy will be triggered through the vulnerability management platform to deal with the vulnerabilities in the hidden subnet.

[0100] Preferably, the security policy includes: isolating assets with vulnerabilities, repairing the vulnerabilities, and sending alarm information to an administrator.

[0101] The following are specific embodiments provided by the present invention:

[0102] According to the network topology of the LAN, a network traffic collection device is deployed at the exit of the LAN to collect network traffic data in the LAN. The collected network traffic data is parsed to extract protocol data in the network communication process, including TCP / IP protocol, HTTP protocol, FTP protocol, etc. According to the extracted protocol data, it is determined whether there is a non-standard protocol or a custom protocol in the network traffic data. If so, it indicates that there may be a hidden subnet in the LAN. By clustering the traffic of the non-standard protocol or the custom protocol, the network address range and topology of the hidden subnet are obtained. According to the network address range of the hidden subnet, the agent program of the vulnerability scanner is deployed in the hidden subnet, and a communication connection is established with an external vulnerability scanner. Through the agent program, the host information and open port information in the hidden subnet are sent to the external vulnerability scanner. The vulnerability scanner performs vulnerability scans on the hosts in the hidden subnet based on the acquired host information and port information, and identifies the existing vulnerability information. The scanned vulnerability information is sent to the security management system in the hidden subnet through the agent program, and the security management system takes corresponding protective measures based on the vulnerability information. Continuously monitor network traffic data within the LAN. If new non-standard or custom protocols are discovered, perform vulnerability scans and protection on the newly discovered hidden subnets in the above steps.

[0103] Specifically, deploy network traffic collection equipment at the exit of the LAN, such as using tools such as Wireshark to collect network traffic data. Use the protocol parsing function of Wireshark to extract TCP / IP, HTTP, FTP and other protocol data in network communication. If non-standard ports such as 6667 or custom protocols are found, it means that there is a hidden subnet. Use clustering algorithms such as K-Means to cluster and analyze non-standard protocol traffic to obtain the network address range of the hidden subnet, such as 192.168.2.0 / 24. Deploy a vulnerability scanner agent in the hidden subnet and establish communication with an external vulnerability scanner such as Nessus. The agent sends the host and port information in the hidden subnet to Nessus. Nessus performs vulnerability scans on the hosts in the hidden subnet and identifies existing vulnerabilities such as MS17-010 and other high-risk vulnerabilities. The scan results are sent to the security management system in the hidden subnet through the agent, and corresponding protection measures are taken, such as installing patches and closing ports. Continuously monitor network traffic, and repeat the above vulnerability scanning and protection process if there are new non-standard protocols. Through a series of processes such as traffic monitoring, protocol analysis, cluster analysis, and vulnerability scanning, security risks in hidden subnets can be fully identified and protected.

[0104] Collect network traffic data and obtain the data packet information of each communication connection. Parse the data packet information and extract the protocol characteristic parameters such as the protocol type, port number, and data length corresponding to each communication connection. According to the extracted protocol characteristic parameters, determine the type of communication protocol used by each communication connection. If the communication protocol type is a common protocol, such as TCP, UDP, HTTP, etc., the communication connection is classified as a known network; if the communication protocol type is an uncommon protocol, the communication connection is classified as a hidden subnet. For the communication connection classified as a hidden subnet, further analyze its traffic characteristics, such as data packet size, communication frequency, communication duration, etc., to determine the topological structure and host information of the hidden subnet. According to the topological structure and host information of the hidden subnet, select a suitable host in the hidden subnet and implant the agent program of the vulnerability scanner. Through the agent program, perform port scans on the hosts in the hidden subnet to identify open service ports and applications. According to the identified service ports and application information, use the corresponding vulnerability scanning rules to perform vulnerability scans on the hosts in the hidden subnet to obtain the security vulnerability information existing in the hidden subnet. The security vulnerability information in the scanned hidden subnet is summarized with the vulnerability information in the known network to form a complete LAN vulnerability scanning report, providing data support for network security management.

[0105] Specifically, network traffic data in the LAN is collected by using network packet capture tools such as Wireshark to obtain the packet information of each communication connection. The characteristic parameters of the packet, such as protocol type, port number, and data length, are extracted by using packet parsing libraries such as Scapy. According to the extracted characteristic parameters, the decision tree algorithm is used to classify and judge the protocol type of the communication connection, and the connections using common protocols such as TCP, UDP, and HTTP are classified as known networks, and the connections using other uncommon protocols are classified as hidden subnets. For the communication connections of the hidden subnet, the traffic statistical characteristics such as packet size, communication frequency, and duration are further analyzed, and the topological structure of the hidden subnet is inferred by using clustering algorithms, and the key host nodes are identified. The key hosts in the hidden subnet are selected, and the proxy program of the vulnerability scanner is implanted through ARP spoofing and other methods to realize port scanning of other hosts in the subnet. After scanning and discovering the service ports and applications opened by the host, the corresponding plug-ins of vulnerability scanners such as Nessus are called to detect whether the host has known security vulnerabilities. Finally, the vulnerability information found in the hidden subnet and the known network is summarized, and a complete scanning report of network assets and vulnerabilities is output to provide data support for network security management.

[0106] According to the network address information of the hidden subnet, the network scanning technology is used to detect the hidden subnet and obtain the information of active hosts in the hidden subnet. By analyzing the IP addresses and MAC addresses of the detected active hosts, the connection relationship between the hosts is determined, and the preliminary topological structure of the hidden subnet is obtained. According to the preliminary topological structure, the traffic analysis technology is used to capture and analyze the communication traffic between the hosts in the hidden subnet to obtain the communication protocol and port information between the hosts. By analyzing the communication protocol and port information, the dependency relationship and service relationship between the hosts are determined, and the topological structure of the hidden subnet is improved. According to the improved topological structure, the host discovery technology is used to deeply detect the hosts in the hidden subnet to obtain detailed information such as the host's operating system, open ports, and running services. By analyzing the detailed information of the host, the role and importance of the host in the hidden subnet are determined, and the topological structure of the hidden subnet is further optimized. According to the optimized topological structure, the network topology discovery technology is used to detect the network devices of the hidden subnet to obtain the type, model, connection relationship and other information of the network devices. By integrating the host information and network device information, the complete topological structure of the hidden subnet is constructed, including hosts, network devices, connection relationships, etc. Based on the constructed complete topology structure, visualization technology is used to generate a topology map of the hidden subnet, which intuitively displays the network architecture and composition of the hidden subnet and provides a reference for subsequent vulnerability scanning and security management.

[0107] Specifically, first, use network scanning tools such as Nmap to perform TCP SYN scanning on the target network segment, send SYN packets to the target host's common ports such as 80, 443, 3389, etc., and determine whether it is active based on the host's response. The scan results show that there are 50 active hosts in the 192.168.1.0 / 24 network segment. Then, analyze the IP and MAC addresses of these hosts and find that 30 of them belong to the same brand of network cards. Preliminary judgment is that they are located in the same switch.

[0108] Then, we used Wireshark to capture the communication traffic between hosts in the hidden subnet. We found that most hosts communicated using the TCP protocol, with common ports 22, 80, and 3306. We speculated that there were service dependencies such as SSH, Web, and MySQL between the hosts. We further used Nmap's operating system fingerprinting function to detect that most of these hosts were running the CentOS 7 system, with SSH and HTTP services open, and some hosts were also running the MySQL database.

[0109] According to the host's operating system, open ports, running services and other information, it is determined that 192.168.1.10 and 192.168.1.20 may be website servers, 192.168.1.30 is a database server, and 192.168.1.1 is a gateway router. Finally, using tools such as Traceroute to detect network devices, it is found that the IP of the core switch is 192.168.1.254, and the model is Cisco 2960.

[0110] Based on the above information, the topology diagram of the hidden subnet is drawn. The connection relationship between each host and network device is also clear at a glance, providing an important reference for subsequent security reinforcement.

[0111] According to the traffic information of the communication between the hosts in the hidden subnet, the topological structure diagram of the hidden subnet is constructed to obtain the topological structure information of the hidden subnet. The graph theory algorithm is used to analyze the topological structure diagram of the hidden subnet to obtain the connectivity and centrality of each host node in the hidden subnet. According to the connectivity and centrality of the host nodes in the hidden subnet, the candidate location for deploying the vulnerability scanning agent in the hidden subnet is determined. By evaluating the availability and stability of the host at the candidate location, the optimal vulnerability scanning agent deployment location is screened out. If the availability and stability of the host at the candidate location meet the requirements, it is determined as the deployment location of the vulnerability scanning agent. According to the determined vulnerability scanning agent deployment location, the configuration information of the vulnerability scanning agent is generated. The generated vulnerability scanning agent configuration information is sent to the selected deployment location host to complete the deployment of the vulnerability scanning agent. After the deployment is completed, the vulnerability scanning agent starts to scan the vulnerabilities of other hosts in the hidden subnet to obtain the vulnerability information of the hosts in the hidden subnet. The obtained vulnerability information of the host in the hidden subnet is reported to the vulnerability management system to achieve comprehensive identification and management of the vulnerabilities of the hidden subnet.

[0112] Specifically, by collecting traffic information of communication between hosts in the hidden subnet, using traffic analysis tools such as Wireshark to parse the data packets, extracting key information such as source IP, destination IP, and communication protocol, and constructing a topological structure diagram of the hidden subnet. Then, using graph theory algorithms such as the Dijkstra shortest path algorithm, calculate the shortest path from each node to other nodes to obtain the connectivity between nodes. At the same time, using centrality algorithms such as PageRank to calculate the centrality score of each node, and comprehensively considering connectivity and centrality to determine 3 to 5 candidate deployment locations for the vulnerability scanning agent.

[0113] Then evaluate the CPU, memory, disk and other resource utilization of the candidate host, as well as the average communication delay with other hosts, and select 1-2 optimal locations with resource utilization below 60% and average delay below 50ms. Then automatically generate the configuration file of the vulnerability scanning agent, including parameters such as scanning range, scanning frequency, scanning plug-in, etc., and send it to the deployment host through automated operation and maintenance tools such as Ansible to trigger installation and startup.

[0114] The scanning agent began to perform full port scanning and high-risk vulnerability detection on the target host once a day, randomly selecting 20% ​​of the hosts each time, using tools such as Nmap and OpenVAS. The scanning results were sent back to the vulnerability management system in real time through an encrypted channel for summary display, risk assessment and alarm. The entire process achieved automated and intelligent identification and control of hidden subnet vulnerabilities, reduced manual operations, and improved efficiency and accuracy.

[0115] The vulnerability scanning agent performs vulnerability scanning tasks in the hidden subnet and obtains vulnerability information of devices in the hidden subnet. The vulnerability scanning agent sends the scanned vulnerability information of devices in the hidden subnet to the vulnerability management platform through the network transmission protocol. The vulnerability management platform receives the vulnerability information of devices in the hidden subnet transmitted by the vulnerability scanning agent and stores it in the vulnerability database. The vulnerability management platform reads the vulnerability information of devices in the hidden subnet from the vulnerability database and classifies and statistically analyzes the vulnerability information. Based on the classification and statistical analysis results of the vulnerability information of devices in the hidden subnet, the vulnerability management platform determines the types and number of vulnerabilities existing in the hidden subnet. The vulnerability management platform determines the security risk level faced by the devices in the hidden subnet based on the determined types and number of vulnerabilities in the hidden subnet. If the security risk level faced by the devices in the hidden subnet exceeds the preset threshold, the vulnerability management platform triggers the hidden subnet vulnerability alarm information. The vulnerability management platform generates a hidden subnet vulnerability analysis report based on the vulnerability information, security risk level and vulnerability alarm information of the devices in the hidden subnet. The vulnerability management platform displays the generated hidden subnet vulnerability analysis report to the security management personnel through a graphical interface or a network interface for them to perform hidden subnet security maintenance.

[0116] Specifically, the vulnerability scanning agent uses the Nmap tool to perform a full port scan on the hidden subnet 192.168.1.0 / 24, and uses the SYN Stealth scanning technology during the scanning process to avoid being discovered by the target device. The scan found that there were 3 Windows servers, 1 Linux server, and 2 network printers in the subnet. For the discovered devices, the vulnerability scanning agent calls the Nessus vulnerability scanning engine, uses more than 50 common protocols such as RPC, SMB, SNMP, etc. to scan the devices for vulnerabilities, and transmits the scan results to the vulnerability management platform through the HTTPS protocol. The scan results received by the vulnerability management platform include information such as the IP address, open ports, operating system, and running services of each device, as well as detailed information such as the name, risk level, and CVE number of each vulnerability. The platform classifies and summarizes this information according to dimensions such as device type and operating system. Statistical analysis shows that there are 5 high-risk vulnerabilities, 10 medium-risk vulnerabilities, and 30 low-risk vulnerabilities in the hidden subnet. Because the number of high-risk vulnerabilities exceeded the preset alarm threshold of 3, the platform triggered a hidden subnet vulnerability alarm and generated a hidden subnet vulnerability analysis report containing vulnerability details, affected devices, and repair suggestions. It was displayed and distributed to security administrators through the Web management interface to assist administrators in repairing the vulnerabilities as soon as possible and eliminating security risks.

[0117] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0118] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0119] An embodiment of the present application also provides a system, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps of any of the above-mentioned method embodiments when executing the computer program.

[0120] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0121] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0123] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0124] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0125] In the embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0126] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for processing a local area network subnet vulnerability, characterized in that: The following steps are involved: Collecting network traffic in the local area network through a traffic mirroring device, and judging whether there is a hidden subnet in the local area network according to the feature differences of different protocols in the network traffic; If there is a hidden subnet in the local area network, identifying the hidden subnet by using a traffic analysis method according to the network traffic of the hidden subnet; Implanting a vulnerability scanner agent program into the hidden subnet according to the identified network address information of the hidden subnet; Acquire asset information in the hidden subnet through the agent program, and send the asset information to the vulnerability scanner; According to the asset information, the vulnerability scanner is used to perform a vulnerability scan on the assets in the hidden subnet to obtain vulnerability information existing in the hidden subnet; According to the vulnerability information, determining whether there is a vulnerability in the hidden subnet; Counting and classifying all vulnerabilities in the hidden subnet to confirm the security risk level of the vulnerabilities in the hidden subnet; If the security risk level meets the triggering condition, the preset security policy is triggered to process the vulnerability existing in the hidden subnet.

2. The method for processing a LAN subnet vulnerability according to claim 1, characterized in that: The following steps are also included: Collect all network traffic data in the local area network and all hidden subnets through the traffic mirroring device; Performing deep packet inspection on all the collected network traffic data, parsing each data packet, extracting key fields and payload content, and forming a structured traffic feature data set; Adopting an autoencoder model in an unsupervised learning algorithm and using the structured traffic feature dataset to train a normal traffic baseline model; Collect network traffic data in real time, and obtain real-time traffic feature vectors through deep packet inspection. The real-time traffic feature vector is input into the trained autoencoder model to calculate the reconstruction error. If the reconstruction error exceeds a preset threshold, it is determined to be abnormal traffic; For the detected abnormal traffic, we analyze its behavior pattern in combination with the pre-built expert rule base to determine whether it is an unknown vulnerability attack. The expert rule base contains rules such as known attack patterns, network protocol anomalies, and data packet content anomalies. Extract key features from the traffic of the determined unknown vulnerability attack, add them to the anomaly detection model feature set, and regularly retrain and update the autoencoder model through the anomaly detection model feature set.

3. The method for processing a LAN subnet vulnerability according to claim 1, characterized in that: The determining whether there is a hidden subnet in the local area network according to the feature differences of different protocols in the network traffic specifically includes the following steps: Extracting protocol data from the network traffic by protocol parsing software; According to the protocol data, it is determined whether there is a non-standard protocol or a custom protocol in the network traffic data. If so, it indicates that there is a hidden subnet in the local area network.

4. The method for processing a LAN subnet vulnerability according to claim 3, characterized in that: The method of identifying the hidden subnet by using a traffic analysis method according to the network traffic of the hidden subnet specifically includes the following steps: According to the network traffic of the hidden subnet, its traffic characteristics are further analyzed to identify the topological structure and host information of the hidden subnet, wherein the traffic characteristics include data packet size, communication frequency and communication duration.

5. The method for processing a LAN subnet vulnerability according to claim 4, characterized in that: According to the network traffic of the hidden subnet, further analyzing its traffic characteristics, Identifying the topology structure and host information of the hidden subnet specifically includes the following steps: According to the network address information of the hidden subnet, the hidden subnet is detected by using a network scanning technology to obtain the active host information in the hidden subnet; Analyze the IP addresses and MAC addresses of the detected active hosts, determine the connection relationship between the hosts, and obtain the preliminary topological structure of the hidden subnet; According to the preliminary topology structure, the communication traffic between the hosts in the hidden subnet is captured and analyzed by using traffic analysis technology to obtain the communication protocol and port information between the hosts; The communication protocol and port information are analyzed to determine the dependency and service relationship between hosts, improve the topology of the hidden subnet, form a topology diagram and determine key host nodes.

6. The method for processing a LAN subnet vulnerability according to claim 5, characterized in that: The step of implanting a vulnerability scanner agent program into the hidden subnet according to the identified network address information of the hidden subnet specifically includes the following steps: Using a graph theory algorithm, the topological structure diagram of the hidden subnet is analyzed to obtain the connectivity and centrality of each host node in the hidden subnet; Determining candidate locations for implanting an agent program of a vulnerability scanner into the hidden subnet based on connectivity and centrality of host nodes in the hidden subnet; Evaluate the availability and stability of the hosts at the candidate locations to select the best candidate locations; If the availability and stability of the host at the optimal candidate location meet the requirements, the optimal candidate location is determined as a key host node; According to the key host node, the configuration information of the vulnerability scanning agent is generated, and the configuration information of the vulnerability scanning agent is sent to the key host node to complete the implantation of the agent program of the vulnerability scanner.

7. The method for processing a LAN subnet vulnerability according to claim 6, characterized in that: The method of counting and classifying all the vulnerabilities in the hidden subnet to confirm the risk level of the vulnerabilities in the hidden subnet, and triggering a preset security policy to process the vulnerabilities in the hidden subnet if the risk level meets the triggering condition, specifically includes the following steps: Sending the scanned device vulnerability information in the hidden subnet to the vulnerability management platform through a network transmission protocol and storing it in a vulnerability database; Read the vulnerability information of the devices in the hidden subnet from the vulnerability database through the vulnerability management platform, and classify and statistically analyze the vulnerability information; According to the classification and statistical analysis results of the device vulnerability information in the hidden subnet, the type and number of vulnerabilities existing in the hidden subnet are determined through the vulnerability management platform; According to the types and numbers of vulnerabilities existing in the hidden subnet, the security risk level faced by the devices in the hidden subnet is determined through the vulnerability management platform; If the security risk level faced by the devices in the hidden subnet exceeds a preset threshold, the preset security policy is triggered through the vulnerability management platform to process the vulnerabilities existing in the hidden subnet.

8. The method for processing a LAN subnet vulnerability according to claim 1, characterized in that: The security strategy includes: isolating assets with vulnerabilities, repairing the vulnerabilities, and sending alarm information to administrators.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for handling a local area network subnet vulnerability as described in any one of claims 1 to 8 is implemented.

10. A system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for handling local area network subnet vulnerabilities as described in any one of claims 1 to 8 is implemented.

Images