Network scanning method and device, equipment and storage medium
By assigning network devices with the same feature information to the same community in the network topology diagram and determining the scanning strategy based on the community characteristics, the problems of low efficiency and incomplete coverage of traditional network scanning methods are solved, and efficient and accurate network scanning is achieved .
Patent Information
- Application Number
- CN202411668124.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-02-07
AI Technical Summary
Traditional network security scanning methods are inefficient in large-scale network structures and cannot cover all network devices, resulting in inaccurate scanning results.
By building a network topology diagram, network devices with the same feature information are assigned to the same community, and targeted scanning strategies are determined based on the community's feature information, and scanned in the community.
It improves the efficiency and accuracy of network scanning, ensures coverage of all network devices, and solves the problem of inaccurate scanning results.
Smart Images
Figure CN119402283A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network scanning method, device, equipment and storage medium. Background Art
[0002] Network topology refers to the connection relationship between devices in the network. In the field of modern network security, the complexity and scale of network topology have brought great challenges to security detection and protection.
[0003] At present, traditional network security scanning methods only scan single devices in the network. When used in large-scale network structures, the scanning efficiency is low and all network devices in the network structure cannot be covered, resulting in inaccurate network scanning results. With the expansion of network scale and the increase in device types, how to quickly and accurately identify and respond to security threats has become an urgent problem to be solved. Summary of the invention
[0004] In view of this, the purpose of the present invention is to provide a network scanning method, device, equipment and storage medium, which can allocate network devices with the same characteristic information to the same community, and scan in units of communities according to the scanning strategy corresponding to the community, thereby solving the problems of inaccurate network scanning results and incomplete coverage. The specific scheme is as follows:
[0005] In a first aspect, the present application provides a network scanning method, comprising:
[0006] Scan the target network and construct a network topology diagram based on the corresponding scanning results and graph theory; wherein the nodes in the network topology diagram are used to represent the network devices in the target network, and the edges are used to represent the association relationship between the target nodes corresponding to the network devices;
[0007] Using a preset community detection algorithm and according to the corresponding characteristic information of the network devices, the network devices in the network topology diagram are allocated to a plurality of target communities; wherein the network devices having the same characteristic information are located in the same target community;
[0008] The preset community detection algorithm is used, and a target scanning strategy is determined according to the characteristic information corresponding to the network device in the target community, and the target scanning strategy is used to scan the target node corresponding to the network device.
[0009] Optionally, scanning the target network and constructing a network topology diagram based on corresponding scanning results and graph theory includes:
[0010] Scanning the target network using a preset network scanning algorithm;
[0011] If a network device in the target network is found, the corresponding device information and the connection relationship of the network device are recorded;
[0012] The network topology diagram is constructed based on the device information corresponding to the network devices and the connection relationship between the network devices.
[0013] Optionally, using the preset community detection algorithm and determining a target scanning strategy according to the characteristic information corresponding to the network devices in the target community includes:
[0014] Loading the network topology map, and using the preset community detection algorithm to retrieve the target community in the network topology map;
[0015] The characteristic information corresponding to the network devices in the target community is analyzed, and the target scanning strategy corresponding to the current target community is determined from a plurality of preset scanning strategies according to the corresponding analysis result.
[0016] Optionally, scanning the target node corresponding to the network device by using the target scanning strategy includes:
[0017] The target nodes in the target community are scanned using a DAG scanning algorithm and the target scanning strategy with a preset scanning path.
[0018] Optionally, before allocating the network devices in the network topology diagram to a plurality of target communities using a preset community detection algorithm and according to corresponding characteristic information of the network devices, the method further includes:
[0019] Constructing a risk prediction model based on the network topology diagram, and using the risk prediction model to obtain the characteristic information corresponding to the network devices in the network topology diagram;
[0020] The risk prediction model and the preset risk assessment algorithm are used to perform risk assessment on the network devices in the network topology diagram, and the risk propagation path is obtained according to the corresponding assessment results.
[0021] Optionally, the network scanning method further includes:
[0022] The target scanning strategy is dynamically adjusted according to the risk propagation path obtained by the risk prediction model.
[0023] Optionally, the network scanning method further includes:
[0024] During the scanning of the target network, the risk change situation in the target network is acquired in real time according to the risk prediction model, and the network topology relationship in the network topology diagram is dynamically updated according to the risk change situation.
[0025] In a second aspect, the present application provides a network scanning device, comprising:
[0026] A structure graph construction module is used to scan the target network and construct a network topology structure graph based on the corresponding scanning results and graph theory; wherein the nodes in the network topology structure graph are used to represent the network devices in the target network, and the edges are used to represent the association relationship between the target nodes corresponding to the network devices;
[0027] A device allocation module, used to allocate the network devices in the network topology diagram to a plurality of target communities using a preset community detection algorithm and according to the corresponding characteristic information of the network devices; wherein the network devices having the same characteristic information are located in the same target community;
[0028] The node scanning module is used to use the preset community detection algorithm and determine a target scanning strategy according to the characteristic information corresponding to the network device in the target community, and use the target scanning strategy to scan the target node corresponding to the network device.
[0029] In a third aspect, the present application provides an electronic device, including:
[0030] Memory, used to store computer programs;
[0031] The processor is used to execute the computer program to implement the above-mentioned network scanning method.
[0032] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned network scanning method when executed by a processor.
[0033] The present application first scans the target network, and constructs a network topology diagram based on the corresponding scanning results and graph theory; wherein the nodes in the network topology diagram are used to characterize the network devices in the target network, and the edges are used to characterize the association between the target nodes corresponding to the network devices, and then the network devices in the network topology diagram are assigned to several target communities using a preset community detection algorithm and according to the corresponding characteristic information of the network devices; wherein the network devices with the same characteristic information are located in the same target community, and finally the preset community detection algorithm is used to determine the target scanning strategy according to the corresponding characteristic information of the network devices in the target community, and the target scanning strategy is used to scan the target nodes corresponding to the network devices. It can be seen that the present application assigns network devices with the same characteristic information in the network topology diagram to the same community, and when scanning network devices with the same characteristic information and security requirements, a unified scan can be performed in units of communities, which ensures that the scanning strategy is more targeted on the one hand, and on the other hand, ensures that the network scanning process covers all network devices, thereby solving the problem of inaccurate network scanning results; by using a targeted target scanning strategy to scan the network devices in the corresponding target community, the efficiency of network scanning is improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0035] Figure 1 A flow chart of a network scanning method disclosed in this application;
[0036] Figure 2 A flow chart for constructing a network topology diagram disclosed in this application;
[0037] Figure 3 A risk assessment flow chart disclosed in this application;
[0038] Figure 4 A schematic diagram of a community type disclosed in this application;
[0039] Figure 5 A flow chart for determining a scanning strategy disclosed in this application;
[0040] Figure 6 A schematic diagram of a scanning strategy selection disclosed in this application;
[0041] Figure 7A schematic diagram of a DAG scanning path disclosed in this application;
[0042] Figure 8 A DAG traversal flowchart disclosed in this application;
[0043] Fig. 9 A flow chart of a network dynamic scanning method disclosed in this application;
[0044] Fig.10 A schematic diagram of a risk propagation path disclosed in this application;
[0045] Fig.11 This is a schematic diagram of the structure of a network scanning device disclosed in this application;
[0046] Fig.12 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION
[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0048] At present, the traditional network security scanning method only scans a single device in the network, which will lead to incomplete scanning coverage and low accuracy of scanning results. To this end, the present application provides a network scanning method, which solves the problem of inaccurate network scanning results and incomplete coverage by allocating network devices with the same characteristic information to the same community and performing network scanning in units of communities according to the scanning strategy corresponding to the community.
[0049] See also Figure 1 As shown, an embodiment of the present invention discloses a network scanning method, including:
[0050] Step S11, scan the target network, and construct a network topology diagram based on the corresponding scanning results and graph theory; wherein the nodes in the network topology diagram are used to represent the network devices in the target network, and the edges are used to represent the association relationship between the target nodes corresponding to the network devices.
[0051] In this embodiment, the network topology diagram is constructed based on the scanning results of the target network and graph theory, which may specifically include: scanning the target network using a preset network scanning algorithm; if a network device in the target network is found, recording the corresponding device information of the network device and the connection relationship of the network device; and constructing a network topology diagram based on the corresponding device information of the network device and the connection relationship of the network device. In a specific implementation, Figure 2 As shown in the figure, the steps of identifying all assets in the network are described, starting from initialization scanning, discovering devices, recording information, identifying device types and attributes, and building a device list until the end; identification first performs network scanning initialization. After the network scanning initialization, it starts to identify network devices in the target network. If a network device is found, the corresponding device information of the network device is recorded, and the device type and device attributes of the network device are identified through the device information, and a network topology diagram is established; if the network device is not identified in the target network, it is inferred that the network scanning initialization has failed, and the above-mentioned process of initializing the network scanning is returned. It can be understood that there are multiple network devices in the target network. In addition to the attributes and types of the network devices, a network topology diagram must be constructed based on the connection relationship between the devices. By constructing a network topology diagram, the abstract connection relationship between devices is made more intuitive, and by retrieving the network device attributes and connection relationships in the network topology diagram, the efficiency of the network scanning process is ensured.
[0052] Step S12: using a preset community detection algorithm and according to the corresponding characteristic information of the network devices, the network devices in the network topology diagram are allocated to a plurality of target communities; wherein the network devices having the same characteristic information are located in the same target community.
[0053] In this embodiment, before allocating network devices, it also includes: building a risk prediction model based on the network topology diagram, using the risk prediction model to obtain the corresponding characteristic information of the network devices in the network topology diagram; using the risk prediction model and a preset risk assessment algorithm to conduct risk assessment on the network devices in the network topology diagram, and obtaining the risk propagation path according to the corresponding assessment results; the specific process is as follows: Figure 3 As shown in the figure, the process of inputting network topology data, applying risk assessment algorithms, handling high risk and medium / low risk differently according to the assessment results, updating the risk database, and finally generating a risk report is as follows: first, the network risk assessment algorithm is applied to assess the node. If the assessment result is high risk, the node is marked and prioritized; if it is medium or low risk, it is monitored regularly; after the assessment is completed, the risk database is updated and a risk report is generated. The above-mentioned characteristic information includes but is not limited to the device attributes of the network device, the device type, the corresponding risk type and risk level of the network device obtained by the risk prediction model assessment.
[0054] In this embodiment, the network devices in the network topology diagram are divided into different communities according to corresponding characteristic information, wherein the nodes in each community have similar security requirements and characteristics, such as Figure 4 As shown in the figure, the device and their relationship between different communities are displayed, which more intuitively reflects the distribution and association of network devices; for example, community 1 contains server-type network devices, such as Web servers, database servers, etc.; community 2 contains user-type network devices, such as printers, mobile devices, etc.; community 3 contains network service-type network devices, such as routers, switches, etc. By allocating network devices of the same type and security requirements to the same community, the corresponding nodes of network devices in the community can be scanned using customized scanning strategies that match the community type, ensuring the efficiency and pertinence of the network scanning process.
[0055] Step S13: using the preset community detection algorithm and determining a target scanning strategy according to the characteristic information corresponding to the network device in the target community, and using the target scanning strategy to scan the target node corresponding to the network device.
[0056] In this embodiment, the process of determining the target scanning strategy of the devices in the community according to the characteristic information of the network devices is as follows: Figure 5 As shown in the figure, it shows the process of applying the community detection algorithm after loading the network topology map, discovering and recording community characteristics, analyzing risks within the community, designing customized scanning strategies, and applying these strategies; specifically, it may include: loading the network topology map, using the preset community detection algorithm to retrieve the target community in the network topology map; analyzing the corresponding feature information of the network devices in the target community, and determining the corresponding target scanning strategy for the current target community from several preset scanning strategies based on the corresponding analysis results. Figure 6 As shown, the figure shows the policy selection of different types of devices, highlighting the hierarchical relationship between different policies; in a specific implementation, if the characteristic information of the network devices in the community indicates that the network devices in the community are server devices, then the corresponding scanning policy of the server devices is selected from several preset scanning policies. It can be understood that the priority of the server devices in the network is higher than that of the user terminal devices, and the server devices can be scanned using scanning policies such as deep scanning and medium scanning; in another specific implementation, if the characteristic information of the network devices in the community indicates that the network devices in the community are firewall devices, then a scanning policy of full network scanning or local scanning is determined for the community according to the needs; in a third specific implementation, if the characteristic information of the network devices in the community indicates that the network devices in the community are terminal devices, the importance and priority of the user terminal devices are lower than those of the server and the firewall, then a scanning policy of lightweight scanning and basic scanning is selected for the community.
[0057] In this embodiment, the target scanning strategy is used to scan the target nodes corresponding to the network device, which may specifically include: using a DAG (Directed Acyclic Graph) scanning algorithm and a target scanning strategy to scan the target nodes in the target community with a preset scanning path. It should be noted that the network topology map generated in this embodiment is a directed acyclic graph structure, so a DAG scanning algorithm can be used, that is, a directed acyclic graph scanning algorithm to perform a depth-first or breadth-first scan of the nodes in the community in the network topology map according to a preset scanning path, thereby optimizing the scanning path and ensuring the efficiency and accuracy of the scanning process. Figure 7 As shown in the figure, the node connection relationship in the DAG traversal is shown, highlighting the traversal path from the start node to the end node. For example, if a community contains 6 network devices, the corresponding node numbers are node 1 to node 6. In one specific implementation, the network path composed of node 1, node 3, and node 5 is used as the scanning path and the target path to scan the corresponding nodes of the network devices in the community; in another specific implementation, the network path composed of node 2, node 4, and node 5 is used as the scanning path and the target path to scan the corresponding nodes of the network devices in the community. Figure 8 As shown, the figure describes the process from selecting the starting node, executing DAG traversal, checking the node status, marking it as scanned, executing security scan, recording the scan results, until the traversal is completed; the specific process of the DAG scanning algorithm includes: selecting the starting node for DAG scanning, if a new node is found, checking the node status, if the node status is not scanned, scanning the node, and updating the node status to scanned, and executing the security policy, recording the scan results, until all nodes in the scan path have been scanned. During the scanning process, once a potential risk is found, the present invention can quickly start the response mechanism and take corresponding security measures, such as isolating risk nodes, updating security policies, etc. In addition, the present invention provides a user-friendly interface, so that the operator can intuitively view the network topology map, risk assessment results and scanning progress, and automatically generate detailed scanning reports and logs through the system to record the key activities and security issues found during the scanning process. By selecting different types of targeted scanning strategies for communities with different attributes, the accuracy of the scanning process is improved, and the waste of unnecessary network resources is avoided. By scanning the nodes in the community with a preset path, the efficiency and accuracy of the scanning process are ensured.
[0058] It can be seen that this application makes the abstract connection relationship between devices more intuitive by constructing a network topology diagram, and ensures the efficiency of the network scanning process by retrieving the network device attributes and connection relationships in the network topology diagram; by allocating network devices of the same type and security requirements in the same community, the corresponding nodes of the network devices in the community can be scanned using customized scanning strategies that match the community type, thereby ensuring the efficiency and targeting of the network scanning process; by selecting different types of targeted scanning strategies for communities with different attributes, the accuracy of the scanning process is improved, and unnecessary waste of network resources is avoided. By scanning the nodes in the community along preset paths, the efficiency and accuracy of the scanning process are ensured.
[0059] In order to make the network scanning method disclosed in this application more specific and reliable, see Fig. 9 As shown, the present application implements and discloses a network dynamic scanning method, including:
[0060] Step S21: dynamically adjust the target scanning strategy according to the risk propagation path in the target network obtained by the risk prediction model.
[0061] In this embodiment, the risk propagation path in the target network is first predicted according to the risk prediction model, such as Fig.10 As shown, the figure shows the risk propagation path starting from the initial risk node, showing the change of risk level on different paths and the final risk propagation endpoint; in one specific implementation, the risk propagation path in the target network is from medium-risk nodes to high-risk nodes, and finally to serious risk nodes; in another specific implementation, the risk propagation path in the target network is from low-risk nodes to medium-risk nodes, and finally to high-risk nodes; accordingly, the target scanning strategy is dynamically adjusted according to the risk propagation path obtained by the risk prediction model. If the risk propagation path is from low-risk nodes to medium-risk nodes, and finally to high-risk nodes, the target scanning strategy is dynamically adjusted according to the device type corresponding to the node on the risk propagation path. By adjusting the scanning strategy according to the risk propagation path, the accuracy of the scan is guaranteed.
[0062] Step S22: acquiring risk changes in the target network in real time according to the risk prediction model, and dynamically updating the network topology relationship in the network topology diagram according to the risk changes.
[0063] In this embodiment, it is necessary to dynamically update the topological relationship in the network topology diagram according to the risk changes in the target network obtained by the risk prediction model, which may specifically include: deleting the original network device structure and community model, re-evaluating the risk type, risk level and other characteristic information of the network device according to the risk changes; dividing the network devices into different communities according to the characteristic information corresponding to the risk changes in the current network obtained again, wherein network devices with the same characteristic information are located in the same community. By dynamically updating the network topology structure according to the risk changes, the timeliness of the network topology structure is guaranteed, avoiding the use of an unupdated scanning strategy to scan the corresponding nodes of the network device when a new risk is generated, and improving the reliability of the scanning process.
[0064] Step S23: Scan the corresponding nodes of the network device based on the updated target scanning strategy and the network topology relationship.
[0065] Among them, regarding the process of scanning the corresponding nodes of the network device based on the target scanning strategy and the network topology relationship, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.
[0066] It can be seen that this application ensures the reliability of the scanning process and the accuracy of the scanning results by adjusting the scanning strategy according to the risk propagation path; by dynamically updating the network topology structure according to the risk changes, the timeliness of the network topology structure is ensured, and it is avoided that the corresponding nodes of the network device are scanned with an unupdated scanning strategy when new risks arise, thereby improving the reliability of the scanning process.
[0067] See also Fig.11 As shown, an embodiment of the present invention discloses a network scanning device, including:
[0068] A structure diagram construction module 11 is used to scan the target network and construct a network topology structure diagram based on the corresponding scanning results and graph theory; wherein the nodes in the network topology structure diagram are used to represent the network devices in the target network, and the edges are used to represent the association relationship between the target nodes corresponding to the network devices;
[0069] The device allocation module 12 is used to allocate the network devices in the network topology diagram to a plurality of target communities using a preset community detection algorithm and according to the corresponding characteristic information of the network devices; wherein the network devices having the same characteristic information are located in the same target community;
[0070] The node scanning module 13 is used to use the preset community detection algorithm and determine a target scanning strategy according to the characteristic information corresponding to the network device in the target community, and use the target scanning strategy to scan the target node corresponding to the network device.
[0071] It can be seen that this application makes the abstract connection relationship between devices more intuitive by constructing a network topology diagram, and ensures the efficiency of the network scanning process by retrieving the network device attributes and connection relationships in the network topology diagram; by allocating network devices of the same type and security requirements in the same community, the corresponding nodes of the network devices in the community can be scanned using customized scanning strategies that match the community type, thereby ensuring the efficiency and targeting of the network scanning process; by selecting different types of targeted scanning strategies for communities with different attributes, the accuracy of the scanning process is improved, and unnecessary waste of network resources is avoided. By scanning the nodes in the community along preset paths, the efficiency and accuracy of the scanning process are ensured.
[0072] In some specific embodiments, the structure diagram building module 11 may specifically include:
[0073] A network scanning unit, used to scan the target network using a preset network scanning algorithm;
[0074] An information recording unit, configured to record the corresponding device information and the connection relationship of the network device if a network device in the target network is found;
[0075] A structure diagram construction unit is used to construct the network topology structure diagram based on the device information corresponding to the network device and the connection relationship of the network device.
[0076] In some specific embodiments, the device allocation module 12 further includes:
[0077] An information acquisition unit, configured to construct a risk prediction model based on the network topology diagram, and use the risk prediction model to acquire the characteristic information corresponding to the network device in the network topology diagram;
[0078] The path acquisition unit is used to use the risk prediction model and a preset risk assessment algorithm to perform risk assessment on the network devices in the network topology diagram, and obtain the risk propagation path according to the corresponding assessment results.
[0079] In some specific embodiments, the node scanning module 13 may specifically include:
[0080] A community retrieval unit, used to load the network topology map and retrieve the target community in the network topology map using the preset community detection algorithm;
[0081] A strategy determination unit, configured to analyze the characteristic information corresponding to the network devices in the target community, and determine the target scanning strategy corresponding to the current target community from a plurality of preset scanning strategies according to the corresponding analysis results;
[0082] The node scanning unit is used to use the DAG scanning algorithm and the target scanning strategy to scan the target node in the target community with a preset scanning path.
[0083] In some specific implementations, the network scanning device further includes:
[0084] A strategy adjustment unit, configured to dynamically adjust the target scanning strategy according to the risk propagation path obtained by the risk prediction model;
[0085] The structure diagram updating unit is used to obtain the risk changes in the target network in real time according to the risk prediction model during the scanning of the target network, and dynamically update the network topology relationship in the network topology structure diagram according to the risk changes.
[0086] Furthermore, the present application also discloses an electronic device. Fig.12 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of the present application.
[0087] Fig.12 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network scanning method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.
[0088] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.
[0089] In addition, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.
[0090] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network scanning method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.
[0091] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed network scanning method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.
[0092] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.
[0093] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0094] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0095] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0096] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A network scanning method, characterized in that: include: Scan the target network and construct a network topology diagram based on the corresponding scanning results and graph theory; wherein the nodes in the network topology diagram are used to represent the network devices in the target network, and the edges are used to represent the association relationship between the target nodes corresponding to the network devices; Using a preset community detection algorithm and according to the corresponding characteristic information of the network devices, the network devices in the network topology diagram are allocated to a plurality of target communities; wherein the network devices having the same characteristic information are located in the same target community; The preset community detection algorithm is used, and a target scanning strategy is determined according to the characteristic information corresponding to the network device in the target community, and the target scanning strategy is used to scan the target node corresponding to the network device.
2. The network scanning method according to claim 1, characterized in that: The target network is scanned, and a network topology diagram is constructed based on the corresponding scanning results and graph theory, including: Scanning the target network using a preset network scanning algorithm; If a network device in the target network is found, the corresponding device information and the connection relationship of the network device are recorded; The network topology diagram is constructed based on the device information corresponding to the network devices and the connection relationship between the network devices.
3. The network scanning method according to claim 1, characterized in that: The using the preset community detection algorithm and determining the target scanning strategy according to the characteristic information corresponding to the network devices in the target community includes: Loading the network topology map, and using the preset community detection algorithm to retrieve the target community in the network topology map; The characteristic information corresponding to the network devices in the target community is analyzed, and the target scanning strategy corresponding to the current target community is determined from a plurality of preset scanning strategies according to the corresponding analysis result.
4. The network scanning method according to claim 1, characterized in that: The scanning of the target node corresponding to the network device by using the target scanning strategy includes: The target nodes in the target community are scanned using a DAG scanning algorithm and the target scanning strategy with a preset scanning path.
5. The network scanning method according to claim 1, characterized in that: Before allocating the network devices in the network topology diagram to a plurality of target communities using a preset community detection algorithm and according to the corresponding characteristic information of the network devices, the method further includes: Constructing a risk prediction model based on the network topology diagram, and using the risk prediction model to obtain the characteristic information corresponding to the network devices in the network topology diagram; The risk prediction model and the preset risk assessment algorithm are used to perform risk assessment on the network devices in the network topology diagram, and the risk propagation path is obtained according to the corresponding assessment results.
6. The network scanning method according to claim 5, characterized in that: Also includes: The target scanning strategy is dynamically adjusted according to the risk propagation path obtained by the risk prediction model.
7. The network scanning method according to claim 5 or 6, characterized in that: Also includes: During the scanning of the target network, the risk change situation in the target network is acquired in real time according to the risk prediction model, and the network topology relationship in the network topology diagram is dynamically updated according to the risk change situation.
8. A network scanning device, characterized in that: include: A structure graph construction module is used to scan the target network and construct a network topology structure graph based on the corresponding scanning results and graph theory; wherein the nodes in the network topology structure graph are used to represent the network devices in the target network, and the edges are used to represent the association relationship between the target nodes corresponding to the network devices; A device allocation module, used to allocate the network devices in the network topology diagram to a plurality of target communities using a preset community detection algorithm and according to the corresponding characteristic information of the network devices; wherein the network devices having the same characteristic information are located in the same target community; The node scanning module is used to use the preset community detection algorithm and determine a target scanning strategy according to the characteristic information corresponding to the network device in the target community, and use the target scanning strategy to scan the target node corresponding to the network device.
9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network scanning method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the network scanning method according to any one of claims 1 to 7.