Detection method for fine-grained network assets

Abstract

The invention provides a method for detecting fine-grained network assets, which comprises the following steps of: acquiring network asset clue data of a target fine-grained object, and detecting any fine-grained network asset, comprising a network asset detection main node and a plurality of network asset detection distribution nodes which are deployed in different areas and are connected with the network asset detection main node, and a related database is updated in the detection process; the network asset active detection method has the advantages that the network asset active detection is more targeted to a detection target, the detection packet can be customized and constructed to detect the detection target, the accuracy is high, the probe deployment is more flexible, the generalization ability of the model is improved, the burden of manual labeling is greatly reduced, the model can better adapt to a continuously changing data set, and the detection efficiency is improved. And the network assets are determined through the trained preset model, so that the network asset identification efficiency is improved, and the network asset identification accuracy is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of network assets, and in particular is a method for detecting fine-grained network assets. Background Art

[0002] In recent years, the construction of information systems represented by computer systems has flourished, and various new information technologies have emerged one after another. At the same time, affected by the uncertain objective environmental fluctuations, the offline development of enterprises has obviously stalled, and digitalization, onlineization, and cloudification have become solutions for many enterprises to maintain growth. Relying on new information technologies such as "cloud, big data, mobile, and intelligence" to achieve digital empowerment, enterprises are accelerating the construction and application of digital platforms, and data has become an important production factor driving enterprise development.

[0003] When data becomes one of the most important core assets of an enterprise, it means that the enterprise must attach importance to and have the ability to protect data security, because only when the data is complete, clear, secure and reliable can it generate effective value for the enterprise. Data security governance or protection first relies on data asset sorting, and data asset sorting relies on data asset discovery. Data must have storage carriers in the enterprise network, such as databases, file systems, etc., and with the digitalization process, the data assets of the enterprise are scattered in various networks, becoming a risk point for data leakage; and with the passage of time, data carriers abandoned or forgotten in the network will become the biggest hidden danger.

[0004] The target address polling method is used to detect network assets. However, this method sets the same cycle for all detection targets. When the detection cycle needs to be adjusted manually according to the importance of the detection target, different devices need to be used for detection. This method not only has low detection efficiency, but also requires more equipment resources, resulting in resource waste.

[0005] In summary, the present invention provides a fine-grained network asset detection method to solve the above problems. Summary of the invention

[0006] In order to solve the above technical problems, the present invention provides a fine-grained network asset detection method to solve the problems in the prior art that the detection efficiency is low and more equipment resources are required, resulting in resource waste.

[0007] A fine-grained network asset detection method, comprising:

[0008] Obtain network asset clue data of the target fine-grained object, and detect any of the fine-grained network assets, including a network asset detection master node and a plurality of network asset detection distribution nodes connected to the network asset detection master node and deployed in different areas, and updating the relevant database during the detection process;

[0009] Determine the detection result of the network asset;

[0010] According to the detection results, fine-grained classification is performed, and fine-grained target classification information is output to obtain a fine-grained data set corresponding to the current object;

[0011] Inputting the acquired network asset information to be classified into the trained fully connected segmentation network to obtain multiple regions;

[0012] Constructing a fine-grained classification model of the master node and the distribution node, and using the fine-grained classification model to generate a convolutional feature descriptor corresponding to each region;

[0013] The fine-grained data set is input into the preset classification model, and the established fine-grained classification model is used to perform network asset detection.

[0014] Furthermore, the network asset clue data obtained is divided into a layer 1 network and a layer 2 network, and is identified by port scanning. Port scanning is based on the transport layer protocol, and can be divided into TCP port scanning and UDP port scanning according to the specific protocol. In port scanning, TCP port scanning uses the TCP semi-connection method, using TCP SYN to request a connection by sending a SYN packet to the target port. The target responds with a SYN / ACK packet after receiving the SYN packet, and the detection host terminates the handshake with an RST packet after receiving the response.

[0015] Furthermore, in the acquisition of network asset clue data of the target fine-grained object, the detection basic data mainly includes active, passive and search engine-based, and a corresponding detection task set is selected according to the type of network assets to be detected, and the network assets in the selected detection task set are detected.

[0016] Furthermore, based on the different detection basic data types, different types of network assets are divided into different detection task sets, and the network assets in the selected detection task set are detected by the asset detection tool. When the target asset is detected in the selected detection task set, the detailed information of the target asset is obtained.

[0017] Furthermore, the specific method for selecting the convolutional feature descriptor is:

[0018] Discarding the convolutional feature descriptor representing the background area and retaining the convolutional feature descriptor representing the component;

[0019] The convolutional feature descriptors representing the object parts are retained in different semantic branches with weights corresponding to the masks.

[0020] Furthermore, the detected results are used to form a labeled data set;

[0021] A pre-trained network is trained on the labeled dataset using a hierarchical classification model.

[0022] After determining the category of the area to be labeled, the area to be labeled is merged with the labeled area and used as a new labeled data set to iteratively train the pre-trained network to obtain a hierarchical classification model.

[0023] Furthermore, the method is used to bring the traffic training data corresponding to the previous moment in the traffic training sequence corresponding to the target fine-grained object and the surrounding adjacent object group as the input of the traffic training data corresponding to the next moment into the hierarchical classification model for iterative training calculation, so as to obtain the fine-grained object traffic prediction classification model.

[0024] Furthermore, the network assets in the selected detection task set are detected by the asset detection tool, and when the target asset is detected in the selected detection task set, detailed information of the target asset is obtained.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. In the present invention, the advantage of active detection of network assets is that it is more targeted at the detection target, and it can be detected by customizing the detection package with high accuracy. The probe deployment is also more flexible, which improves the generalization ability of the model and greatly reduces the burden of manual labeling. It allows the model to better adapt to the ever-changing data set, and then determine the network assets through the trained preset model, which improves the efficiency of network asset identification while improving the accuracy of network asset identification.

[0027] 2. In the present invention, on the one hand, when detecting network assets, the detection tool only needs to scan the basic asset information obtained from the traffic, which can exponentially reduce the basic asset information that needs to be scanned; on the other hand, it can specify a small range of scanning tasks based on the classified asset types, greatly reducing the number of scans and greatly improving the efficiency of network asset discovery. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0029] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0030] like Figure 1 As shown, the present invention provides a fine-grained network asset detection method, comprising:

[0031] Obtain network asset clue data of the target fine-grained object, and detect any fine-grained network asset, including a network asset detection main node and multiple network asset detection distribution nodes deployed in different areas and connected to the network asset detection main node. During the detection process, update the relevant database;

[0032] Determine the detection result of the network asset;

[0033] According to the detection results, fine-grained classification is performed, and fine-grained target classification information is output to obtain the fine-grained data set corresponding to the current object;

[0034] Input the acquired network asset information to be classified into the trained fully connected segmentation network to obtain multiple regions;

[0035] Construct a fine-grained classification model for the main node and the distribution node, and use the fine-grained classification model to generate the convolutional feature descriptor corresponding to each region;

[0036] The fine-grained data set is input into the preset classification model, and the established fine-grained classification model is used to perform network asset detection.

[0037] As an implementation mode of the present invention, the network asset clue data is obtained, which is divided into a layer 1 network and a layer 2 network, and is identified by port scanning. Port scanning is based on the transport layer protocol, and can be divided into TCP port scanning and UDP port scanning according to the specific protocol. In the port scanning, the TCP port scanning adopts the TCP semi-connection method, using TCP SYN, and sends a SYN packet to the target port to request a connection. The target responds with a SYN / ACK packet after receiving the SYN packet, and the detection host terminates the handshake with an RST packet after receiving the response.

[0038] As an implementation mode of the present invention, in obtaining network asset clue data of the target fine-grained object, the detection basic data mainly includes active, passive and search engine-based, and a corresponding detection task set is selected according to the type of network assets to be detected, and the network assets in the selected detection task set are detected.

[0039] As an implementation mode of the present invention, different types of network assets are divided into different detection task sets based on different detection basic data types, and the network assets in the selected detection task set are detected by an asset detection tool. When the target asset is detected in the selected detection task set, detailed information of the target asset is obtained.

[0040] As an implementation mode of the present invention, a specific method for selecting a convolutional feature descriptor is as follows:

[0041] Discard the convolutional feature descriptors representing the background area and retain the convolutional feature descriptors representing the components;

[0042] Among them, the convolutional feature descriptors representing the object parts are retained in different semantic branches with weights corresponding to the masks.

[0043] As an implementation mode of the present invention, the detected results are formed into a labeled data set;

[0044] A pre-trained network is trained on the labeled dataset using a hierarchical classification model.

[0045] After determining the category of the area to be labeled, the area to be labeled is merged with the labeled area and used as a new labeled data set to iteratively train the pre-trained network to obtain a hierarchical classification model.

[0046] As an implementation mode of the present invention, the traffic training data corresponding to the previous moment in the traffic training sequence corresponding to the target fine-grained object and the surrounding adjacent object group is used as the input amount of the traffic training data corresponding to the next moment and is brought into the hierarchical classification model for iterative training calculation to obtain a fine-grained object traffic prediction classification model.

[0047] As an implementation mode of the present invention, the network assets in the selected detection task set are detected by an asset detection tool, and when the target asset is detected in the selected detection task set, detailed information of the target asset is obtained.

[0048] In the present invention, the advantage of active detection of network assets is that it is more targeted at the detection target, and it can be detected by customizing the detection package with high accuracy. The probe deployment is also more flexible, which improves the generalization ability of the model and greatly reduces the burden of manual annotation. It allows the model to better adapt to the ever-changing data set, and then determine the network assets through the trained preset model. While improving the efficiency of network asset identification, it also improves the accuracy of network asset identification. On the one hand, when detecting network assets, the detection tool only needs to scan the basic asset information obtained from the traffic, which can exponentially reduce the basic asset information that needs to be scanned; on the other hand, it can specify a small range of scanning tasks based on the classified asset type, greatly reducing the number of scans, greatly improving the efficiency of network asset discovery.

[0049] The embodiments of the present invention are provided for the purpose of illustration and description. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present invention. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A fine-grained network asset detection method, characterized in that: include: Obtain network asset clue data of the target fine-grained object, and detect any of the fine-grained network assets, including a network asset detection master node and a plurality of network asset detection distribution nodes connected to the network asset detection master node and deployed in different areas, and updating the relevant database during the detection process; Determine the detection result of the network asset; According to the detection results, fine-grained classification is performed, and fine-grained target classification information is output to obtain a fine-grained data set corresponding to the current object; Inputting the acquired network asset information to be classified into the trained fully connected segmentation network to obtain multiple regions; Constructing a fine-grained classification model of the master node and the distribution node, and using the fine-grained classification model to generate a convolutional feature descriptor corresponding to each region; The fine-grained data set is input into the preset classification model, and the established fine-grained classification model is used to perform network asset detection.

2. The fine-grained network asset detection method according to claim 1, characterized in that: The network asset clue data obtained is divided into a layer 1 network and a layer 2 network, and is identified by port scanning. Port scanning is based on the transport layer protocol and can be divided into TCP port scanning and UDP port scanning according to the specific protocol. In port scanning, TCP port scanning uses the TCP semi-connection method, using TCP SYN to request a connection by sending a SYN packet to the target port. The target responds with a SYN / ACK packet after receiving the SYN packet. The detection host terminates the handshake with an RST packet after receiving the response.

3. The fine-grained network asset detection method according to claim 1, characterized in that: In the network asset clue data of the target fine-grained object, the detection basic data mainly includes active, passive and search engine-based detection. According to the type of network assets to be detected, a corresponding detection task set is selected, and the network assets in the selected detection task set are detected.

4. The fine-grained network asset detection method according to claim 3, characterized in that: According to the different detection basic data types, different types of network assets are divided into different detection task sets, and the network assets in the selected detection task set are detected by the asset detection tool. When the target asset is detected in the selected detection task set, the detailed information of the target asset is obtained.

5. The fine-grained network asset detection method according to claim 1, characterized in that: The specific method for selecting the convolution feature descriptor is: Discarding the convolutional feature descriptor representing the background area and retaining the convolutional feature descriptor representing the component; The convolutional feature descriptors representing the object parts are retained in different semantic branches with weights corresponding to the masks.

6. The fine-grained network asset detection method according to claim 1, characterized in that: The detected results are formed into a labeled data set; A pre-trained network is trained on the labeled dataset using a hierarchical classification model. After determining the category of the area to be labeled, the area to be labeled is merged with the labeled area and used as a new labeled data set to iteratively train the pre-trained network to obtain a hierarchical classification model.

7. The fine-grained network asset detection method according to claim 6, characterized in that: The method is used to bring the traffic training data corresponding to the previous moment in the traffic training sequence corresponding to the target fine-grained object and the surrounding adjacent object group as the input of the traffic training data corresponding to the next moment into the hierarchical classification model for iterative training calculation to obtain the fine-grained object traffic prediction classification model.

8. The fine-grained network asset detection method according to claim 1, characterized in that: The network assets in the selected detection task set are detected by the asset detection tool, and when the target asset is detected in the selected detection task set, detailed information of the target asset is obtained.

Images