Network resource affiliation determination method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a network resource affiliation determination method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring a current network resource of a target object; querying a plurality of association vectors corresponding to the current network resource in a multi-source database; the multi-source database is obtained by performing periodic real-time processing on full-amount network resources; each association vector comprises at least two vectors obtained by querying in a corresponding data a first vector, a second vector and a third vector; the second vector is a vector of a same subnet network resource located in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold value; and after feature extraction is performed on the plurality of association vectors, inputting a trained network resource affiliation model, and obtaining resource affiliation information of the target object. According to the method, diversified query results are provided for the current network resources through the multi-source database, and the accuracy and comprehensiveness of IP attribution calculation are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for determining the ownership of network resources. Background Art

[0002] In the extremely large network communication space, there are billions of communication behaviors every second. For enterprises, it is particularly important to identify the ownership of digital resources associated with their communications, especially the ownership of Internet Protocol (IP) digital resources. Identifying the ownership of communication IP addresses can help understand the background information of communicating customers, locate potential attack sources, or help network security teams quickly determine the network security situation.

[0003] In the related art, when performing IP attribution calculations, the currently registered information sources are used for query or reasoning. This method is limited by the quantity and real-time nature of the IP data contained in the official website registration information, and cannot dynamically expand the data source of IP data. The IP information source is single and not comprehensive enough, and the data does not have the characteristics of real-time update, which affects the accuracy and comprehensiveness of IP attribution calculations.

[0004] In summary, how to improve the accuracy and comprehensiveness of IP attribution calculations is an urgent issue to be addressed. Summary of the invention

[0005] The embodiments of the present application provide a method, device, electronic device and storage medium for determining network resource ownership to improve the accuracy and comprehensiveness of IP ownership calculation.

[0006] In a first aspect, an embodiment of the present application provides a method for determining network resource ownership, including:

[0007] Get the current network resources of the target object;

[0008] Query multiple association vectors corresponding to the current network resource in a multi-source database; each of the association vectors corresponds to a database of the multi-source database; the multi-source database is obtained after periodic real-time processing of all network resources; each of the association vectors includes at least two vectors obtained by querying the corresponding database: a first vector, a second vector and a third vector; the first vector is a vector of the current network resource, the second vector is a vector of a network resource in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold;

[0009] After feature extraction is performed on the multiple association vectors, a trained network resource attribution model is input to obtain resource attribution information of the target object; the network resource attribution model is obtained by training based on the multi-source database and the labeled network resources.

[0010] In a second aspect, an embodiment of the present application provides a network resource ownership determination device, including:

[0011] An acquisition unit, used to acquire the current network resources of the target object;

[0012] A query unit, used to query a plurality of association vectors corresponding to the current network resource in a multi-source database; each of the association vectors corresponds to a database of the multi-source database; the multi-source database is obtained after periodic real-time processing of the full amount of network resources; each of the association vectors includes at least two vectors obtained by querying in the corresponding database: a first vector, a second vector and a third vector; the first vector is a vector of the current network resource, the second vector is a vector of a network resource in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold;

[0013] The attribution unit is used to extract features from the multiple association vectors, input a trained network resource attribution model, and obtain resource attribution information of the target object; the network resource attribution model is trained based on the multi-source database and marked network resources.

[0014] In some embodiments, the query unit is specifically used to:

[0015] If the association vector includes the first vector, querying the current network resource in the multi-source database to obtain the queried first vector;

[0016] If the association vector includes the second vector, performing subnet network resource expansion on the current network resource, after acquiring the same-subnet network resource, querying the same-subnet network resource in the multi-source database to acquire the queried second vector;

[0017] If the association vector includes the third vector, similar network resources are recalled for the current network resource, and after similar network resources are acquired, the similar network resources are queried in the multi-source database to acquire the queried third vector.

[0018] In some embodiments, the multi-source database includes a network resource behavior vector library, and before obtaining the current network resource of the target object, the device further includes:

[0019] A database unit, used for periodically extracting data from network traffic data;

[0020] In each cycle, feature modeling and network resource vectorization are performed on the communication behavior of each network resource in the extracted network traffic data to generate a network resource behavior vector; the network resources correspond to the network resource behavior vectors one by one;

[0021] The network resource behavior vector library is updated according to the network resource behavior vector of the full amount of network resources.

[0022] In some embodiments, the multi-source database includes a network resource portrait vector library, and before obtaining the current network resource of the target object, the database unit is further used to:

[0023] For each network resource, do the following:

[0024] By periodically constructing features of multi-dimensional portrait attributes of the network resources in the network resource portrait library, a corresponding first feature is generated;

[0025] According to the geographical attribute in the multi-dimensional portrait attribute, query the same type of network resources as the network resource type in the point of interest information, and construct features for the same type of network resources to generate corresponding second features;

[0026] Vectorize the first feature and the second feature corresponding to the network resource to generate a corresponding network resource portrait vector;

[0027] The network resource portrait vector library is updated according to the network resource portrait vector of the full amount of network resources.

[0028] In some embodiments, the multi-source database includes a network resource domain name vector library, and before obtaining the current network resource of the target object, the database unit is further used to:

[0029] For each network resource, the domain name information associated with the network resource in the domain name database is periodically expressed and vectorized to generate a corresponding network resource domain name vector;

[0030] The network resource domain name vector library is updated according to the network resource domain name vector of the full network resource.

[0031] In some embodiments, the multi-source database further includes a third-party database; and the query unit is further configured to:

[0032] Querying the third-party portrait vector corresponding to the current network resource in the third-party database;

[0033] The attribution unit is also used for:

[0034] Feature extraction is performed on the multiple association vectors and the third-party portrait vector.

[0035] In some embodiments, the attribution unit is specifically configured to:

[0036] Acquire the resource attribution information and the confidence level corresponding to the resource attribution information;

[0037] If the confidence level is greater than a preset value, outputting the resource ownership information;

[0038] If the confidence level is less than or equal to the preset value, a resource attribution list and the confidence level are output according to the resource attribution information, where the resource attribution list is a reference list for determining network resources owned by the target object.

[0039] In some embodiments, the attribution unit is specifically used to train the network resource attribution model in the following manner:

[0040] Querying the multi-source database for a training association vector corresponding to the labeled network resource;

[0041] Inputting the training association vector into the network resource attribution model to obtain training attribution information;

[0042] The network resource attribution model is trained according to the difference between the training attribution information and the real attribution information of the marked network resources.

[0043] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0044] A memory for storing program instructions;

[0045] The processor is used to call the program instructions stored in the memory and execute the above-mentioned network resource ownership determination method according to the obtained program instructions.

[0046] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned method for determining the ownership of network resources is implemented.

[0047] In the fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device executes the above-mentioned network resource ownership determination method.

[0048] The embodiments of the present application provide a method, device, electronic device and storage medium for determining the ownership of network resources. Among them, the embodiments of the present application provide diversified query results for the current network resources by inputting the current network resources of the target object into a multi-source database for query. Compared with the method of query results relying on a single registered information source in the related art, the use of the multi-source database significantly improves the accuracy and reliability of the process of determining the ownership of network resources. In addition, the multi-source database provided by the embodiments of the present application is a real-time database, which greatly improves the dynamic monitoring capability and early warning speed, and ensures the continuous accuracy and relevance of network resource information.

[0049] By training the network resource attribution model, the network resource attribution is made intelligent, and hidden network resources can be detected. By inputting the association vector into the network resource attribution model, the resource attribution information can be obtained, thus realizing the automation of network resource attribution determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A schematic diagram of an application scenario of a method for determining network resource ownership provided in an embodiment of the present application;

[0051] Figure 2 A flowchart of a method for determining the ownership of network resources provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of generating an IP behavior vector library provided in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of generating an IP portrait vector library provided in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of generating a PDNS vector library provided in an embodiment of the present application;

[0055] Figure 6 A training diagram of a network resource attribution model provided in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of an online reasoning stage provided in an embodiment of the present application;

[0057] Figure 8 A schematic diagram of the structure of an electronic device for determining the ownership of a network resource in an embodiment of the present application;

[0058] Fig. 9 A schematic diagram of a hardware structure of an electronic device to which an embodiment of the present application is applied;

[0059] Fig.10A schematic diagram of the hardware composition structure of a computing device using an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0061] The following is an introduction to some concepts involved in the embodiments of the present application.

[0062] Network flow data: Netflow, for example, is a type of network flow data generated by network devices (such as routers and switches) that provides detailed measurement and statistical information on IP data flows in the network. NetFlow technology has become the most recognized industry standard for IP / Multi-Protocol Label Switching (MPLS) flow analysis, statistics, and billing in the Internet field.

[0063] Network resources: also known as network assets, generally refer to all valuable things owned by an organization or individual in a network environment, including software, data, and various services provided. In the embodiment of the present application, network resources mainly refer to IP addresses, because IP addresses are the basis of network communication and are key identifiers for identifying devices and services in the network. In addition, the network resource behavior vector in the embodiment of the present application can be abbreviated as an IP behavior vector library, and the network resource portrait vector library can be abbreviated as an IP portrait vector library.

[0064] Passive Domain Name System (PDNS): used to record and analyze passive information of domain name resolution in the network. Unlike active Domain Name System (DNS) queries, PDNS does not need to directly query the DNS server for domain names, but collects data by monitoring and capturing DNS resolution activities that have occurred in network traffic. Network security researchers use PDNS to enhance their network security measures and identify potential security threats by analyzing domain name resolution patterns. In addition, the domain name database in the embodiment of the present application is the PDNS library, and the network resource domain name vector library in the embodiment of the present application can be abbreviated as the PDNS vector library.

[0065] C-segment IP: It is a term in IP address classification, especially in Internet Protocol Version 4 (IPv4) network, which refers to a network segment consisting of 256 consecutive IP addresses. In a classified network, the format of a C-class address is "xxx.xxx.xxx.x", where "x" represents any integer between 0 and 255. The C-segment is usually used in small and medium-sized organizations or local area networks and can support up to 256 devices, but in fact, due to the occupation of network devices and broadcast addresses, the number of available IP addresses will be less than 256.

[0066] Domain Name Registration Information Query System Query (Worldwide Administrator of Registered Internet Names and Numbers or Who Owns It, WHOIS) query: is a standard Internet tool for querying domain name or IP address registration information on the Internet. Through WHOIS, you can obtain detailed information such as the owner information of the domain name or IP address, registration date, expiration date, registration service agency, contact information, etc. WHOIS query plays an important role in network security management, preventing network fraud, maintaining the legal use of network resources, and investigating network crimes. However, for privacy protection reasons, some WHOIS query results may not be fully disclosed.

[0067] Fingerprint of Full Asset (FOFA) query: It is a search engine for cyberspace mapping, mainly used in the field of information security, especially in cyberspace asset discovery and security vulnerability research. This tool can help network security researchers and enterprise security teams quickly identify and collect various network assets, such as websites, servers, routers, cameras, etc., and perform accurate fingerprint identification on them. In addition, FOFA can also be used in conjunction with other tools for vulnerability scanning and data analysis, helping enterprises understand their network exposure and discover potential security threats in a timely manner.

[0068] VirusTotal query: is a free online virus, Uniform Resource Locator (URL) and IP detection service that can help users analyze suspicious files and URLs to determine whether they are potential security threats. VirusTotal can query the input URL and IP for related information. It plays an important role in the field of network security and is one of the tools widely trusted and used by network security researchers, corporate users and individual users.

[0069] Geographic latitude and longitude information: is a set of coordinate data used to accurately locate a specific point on the earth's surface. Longitude represents the horizontal angular distance between the point and the prime meridian, and latitude represents the vertical angular distance between the point and the equator. This information is usually expressed in degrees, minutes, seconds, or in decimal degrees. This information is usually obtained by the Global Positioning System (GPS) or other geographic information systems, and can be widely used in map production, navigation systems, geographic location services, and geographic location analysis of network resources.

[0070] Point of Interest (POI) information: also known as information point. In the field of maps, POI refers to any meaningful point on the map that is not geographically significant, such as stores, bars, gas stations, hospitals, train stations, etc. These points are usually marked on the map and contain information such as name, category, longitude, latitude, etc., which is a comprehensive information with location information. With the development of the electronic map market, the collection of POI data has been separated from the traditional map manufacturer's collection and business model and has become a relatively independent industry. Now, POIs on the map are generally applied for merchant marking and claiming on the map platform by merchants through mobile phone GPS and online maps, such as shops, hotels, stores, supermarkets and other points.

[0071] IPIP library: that is, the network resource portrait library (IP portrait library) in the embodiment of the present application, which focuses on the research, compilation and distribution of IP geographic location and IP portrait data, wherein the IP geographic location database is mainly based on Border Gateway Protocol (Border Gateway Protocol, BGP) / Autonomous System Number (Autonomous System Number, ASN) data and network monitoring points around the world to perform city-level IP regional data annotation, and use IP addresses to locate users' geographic information.

[0072] Before introducing the method for determining the ownership of network resources provided in the embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0073] In the extremely large network communication space, there are billions of communication behaviors every second. For enterprises, it is particularly important to identify the ownership of digital resources associated with their communications, especially the ownership of Internet Protocol (IP) digital resources. Identifying the ownership of communication IP addresses can help understand the background information of communicating customers, locate potential attack sources, or help network security teams quickly determine the network security situation.

[0074] Although relevant technologies have made some progress in network resource mining and network resource attribution identification, the following technical problems still exist:

[0075] (1) Single data source: Existing IP attribution calculation methods use currently registered information sources for query or reasoning, for example, over-reliance on a single DNS query result. This method is limited by the amount and real-time nature of official website registration information data, and cannot dynamically expand the data source. The single information source is not comprehensive enough, thus affecting the accuracy and comprehensiveness of IP attribution calculation.

[0076] (2) Accuracy limitations: Due to reliance on a single data source that may contain errors, related technologies are prone to errors when verifying network resource associations, which directly affects the accuracy and credibility of the verification results.

[0077] (3) Lack of dynamism: In related technologies, IP attribution calculations are often timed, and the IP attribution is calculated and inferred over a period of time. This is usually unable to adapt to the dynamic changes of IP addresses in the network and lacks the ability to update and respond to changes in the network environment in real time. This is a major flaw in the rapidly changing network security environment and cannot reflect changes in the target object's network resources in real time.

[0078] (4) Lack of intelligent processing: Related technologies need to be improved in terms of intelligent analysis. Since they process single data logs, they cannot make more data associations, cannot learn or detect hidden asset behavior patterns, and do not involve processing massive data and identifying complex patterns. They require a lot of manual intervention, which is not only inefficient but also prone to errors due to human factors.

[0079] In view of this, the embodiments of the present application provide a method, device, electronic device and storage medium for determining the ownership of network resources. Among them, the embodiments of the present application provide a variety of query results for the current network resources by inputting the current network resources of the target object into a multi-source database for query. Compared with the method of query results relying on a single registered information source in the related art, the use of the multi-source database significantly improves the accuracy and reliability of the process of determining the ownership of network resources. In addition, the multi-source database provided by the embodiments of the present application is a real-time database, which greatly improves the dynamic monitoring capability and early warning speed, and ensures the continuous accuracy and relevance of network resource information.

[0080] By training the network resource attribution model, the network resource attribution is made intelligent, and hidden network resources can be detected. By inputting the association vector into the network resource attribution model, the resource attribution information can be obtained, thus realizing the automation of network resource attribution determination.

[0081] It should be noted that the application scenarios described in the following embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. A person of ordinary skill in the art can know that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0082] The following first briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0083] like Figure 1 As shown, it is a schematic diagram of an application scenario of a method for determining network resource ownership provided by an embodiment of the present application. The application scenario diagram includes a terminal device 110, current network resources 1101, a server 120 and resource ownership information 130.

[0084] It should be noted that the network resource attribution determination method in the embodiment of the present application can be executed by an electronic device, and the electronic device can be a server 120 or a terminal device 110, that is, the method can be executed by the server 120 or the terminal device 110 alone, or can be executed by the server 120 and the terminal device 110 together. For example, when the method is executed by the server 120 and the terminal device 110 together, the current network resource 1101 currently known to the target object is input on the terminal device 110, and the current network resource 1101 is sent to the server 120, and the server 120 queries the multiple association vectors corresponding to the current network resource 1101 in the multi-source database. After the server 120 extracts features from the multiple association vectors, it inputs the trained network resource attribution model, obtains the resource attribution information 130, and feeds back the resource attribution information 130 to the terminal device 110, so that network security researchers and others can obtain the resource attribution information 130 of the target object.

[0085] In an optional implementation, the terminal device 110 and the server 120 may communicate with each other via a communication network.

[0086] In an optional implementation, the communication network is a wired network or a wireless network.

[0087] It should be noted that Figure 1The examples shown are just for illustration. In fact, the number of terminal devices and servers is not limited, and no specific limitation is made in the embodiments of this application. The embodiments of this application propose to use data mining and feature modeling to model the third-party data of IP associated with behavioral features, portrait features (geographic features), and domain name features based on the fusion of network traffic data and other multi-source data, and train through a deep neural network model to integrate multiple information to trace the IP ownership. It mainly includes the following three stages, namely offline hourly processing, offline training, and online reasoning. Figure 2 A flowchart of a method for determining the ownership of network resources provided in an embodiment of the present application is shown, taking a server as an example. Figure 2 As shown, the method may include the following steps S21 to S23:

[0088] S21: Acquire the current network resources of the target object.

[0089] The current network resource may be at least one IP address of a currently known target object, or may be a domain name of a currently known target object. If the current network resource is a domain name, a DNS resolution tool is required to convert the collected domain name into an IP address.

[0090] Specifically, the current network resource may be the network resource of the communication object obtained in daily communication. At this time, the network resource ownership determination method provided in the embodiment of the present application is used to provide real-time and comprehensive IP ownership calculation capabilities: it can calculate the ownership of the IP in real time and comprehensively, and help enterprises understand the ownership, quantity, type, location, status and other information of their network assets and the IPs connected to them, so as to help enterprises better manage and utilize these assets.

[0091] Alternatively, the current network resource may also be the network resource of the attack initiator obtained in a network attack event. At this time, the network resource ownership determination method provided in the embodiment of the present application provides IP ownership from the perspective of network security attack and defense: from the perspective of network security attack and defense, the enterprise is presented with the overall ownership and security status of its network resources and communication IPs. Mastering this information helps the network security attack and defense team to identify the status of the communication IP in the system, monitor potential attack behaviors, and respond to security incidents in a timely manner. If necessary, tracing and countermeasures can be carried out more quickly, and corresponding defense measures can be implemented to protect corporate assets from attacks, etc. This application will not go into details here.

[0092] After obtaining the current network resources, query the Internet Content Provider (ICP) filing information to verify the legitimacy of the IP address. Query the corresponding domain name URL based on the current IP. If the domain name URL obviously belongs to another company, the IP address can be filtered and deleted.

[0093] After obtaining the current network resource, you can take the following steps to associate the current network resource with other network resources of the target object through multi-source information:

[0094] S22: Query multiple association vectors corresponding to the current network resource in the multi-source database.

[0095] Among them, the multi-source database is obtained after periodic real-time processing of all network resources;

[0096] Specifically, the multi-source database refers to a general term for at least two databases from different data sources. For example, the multi-source database may be a database including an IP behavior vector library and an IP portrait vector library, or a database including an IP behavior vector library and a PDNS vector library, or a database including a PDNS vector library and a third-party database, or a database including an IP behavior vector library, an IP portrait vector library and a PDNS vector library, or a database including an IP behavior vector library, an IP portrait vector library, a PDNS vector library and a third-party database, and so on.

[0097] In addition to the IP behavior vector library, IP portrait vector library, PDNS vector library and third-party database, any other database / information related to network resources can be used for the network resource ownership determination method provided in the embodiment of the present application.

[0098] The association vector is a vector obtained by querying the current network resource in each database of the multi-source database.

[0099] Taking the IP behavior vector library, IP portrait vector library, and PDNS vector library as examples, the generation method of each database included in the multi-source database is first introduced, that is, the offline periodic processing stage in the embodiment of the present application:

[0100] (1) IP behavior vector library.

[0101] It is mainly responsible for characterizing the communication behavior characteristics of IP in the periodically updated network traffic data, and generating a periodically updated behavior vector expression library for all IPs through operations such as feature extraction and normalization.

[0102] The embodiment of the present application periodically generates an IP behavior vector library offline in the following manner:

[0103] Data is extracted periodically from the network traffic data; in each period, feature modeling and network resource vectorization are performed on the communication behavior of each network resource in the extracted network traffic data to generate a network resource behavior vector; network resources correspond to network resource behavior vectors one by one; and the network resource behavior vector library is updated based on the network resource behavior vectors of all network resources.

[0104] The periodicity may be half an hour, one hour, etc. as a cycle.

[0105] like Figure 3 As shown, it is a schematic diagram of generating an IP behavior vector library provided by an embodiment of the present application. Taking hourly updates as an example, network traffic data is extracted in each hour, and feature extraction, feature modeling, and IP vectorization are performed on the IPs in the network traffic data. An IP behavior vector is generated for each IP in the full amount of IPs, and then the vectors in the IP behavior vector library are updated.

[0106] For example, assuming that all IPs include IP1, IP2, IP3, and IP4, the time is 14:23, and the periodic real-time update is hourly update. Then at 14:23, the network traffic data for the hour from 13:00 to 14:00 is extracted, and feature extraction, feature modeling, and IP vectorization are performed on IP1, IP2, IP3, and IP4 respectively to obtain IP1 behavior vectors, IP2 behavior vectors, IP3 behavior vectors, and IP4 behavior vectors, and the original behavior vectors in the IP vector behavior library are updated.

[0107] In the above implementation, by integrating real-time network traffic data and modeling all IP behavior characteristics, a comprehensive and real-time updated IP behavior vector library can be constructed.

[0108] (2)IP portrait vector library.

[0109] By constructing features for all IP portraits in the IP portrait library, including but not limited to the basic attribute features such as the country, province, city, street, longitude and latitude corresponding to the IP, the associated POI type / details, operator, etc., a periodically updated portrait vector expression library is generated for all IPs.

[0110] The embodiment of the present application periodically generates an IP portrait vector library offline in the following manner:

[0111] For each network resource, the following operations are performed respectively: by periodically constructing the features of the multi-dimensional portrait attributes of the network resources in the network resource portrait library, a corresponding first feature is generated; according to the geographical attributes in the multi-dimensional portrait attributes, similar network resources of the same type as the network resource are queried in the point of interest information, and features of the similar network resources are constructed to generate corresponding second features; the first and second features corresponding to the network resources are vectorized to generate a corresponding network resource portrait vector;

[0112] The network resource portrait vector library is updated based on the network resource portrait vectors of the entire network resources.

[0113] The periodicity can be half an hour, one hour, etc. Feature construction includes operations such as multi-dimensional portrait attribute query and multi-dimensional portrait feature expression. Geographic attributes refer to attributes such as latitude and longitude, streets, etc. that can represent the geographical location of the IP, which can be obtained by querying the IP portrait library.

[0114] The POI information can be used to determine the geographical location of the current network resource, other buildings of the same type (such as stores, banks, etc.) adjacent to it, and the number of buildings, etc. For example, if the current network resource is a bank, the POI information can be used to determine other banks within 10 kilometers of the current network resource and the number of banks, etc. The proximity distance and type accuracy can be adjusted as needed.

[0115] like Figure 4 As shown, it is a schematic diagram of generating an IP portrait vector library provided by an embodiment of the present application. Taking hourly updates as an example, a multi-dimensional portrait attribute query and a multi-dimensional portrait feature expression are performed on each IP in the IP portrait library every hour, wherein the multi-dimensional portrait attributes include but are not limited to the basic attributes such as the country, province, city, street, longitude and latitude corresponding to the IP, the type / details of the associated POI, and the operator. A first feature will be generated for each IP in the full amount of IPs. Furthermore, by querying the geographic attributes of each IP in the IP portrait library, a map POI-level feature is constructed for the geographic location associated with each IP, including but not limited to the type of merchants associated with the POI point, the number of merchants, etc., and a second feature will be generated for each IP in the full amount of IPs. Finally, the first feature and the second feature corresponding to each IP are vectorized to generate the corresponding IP portrait vector, and the IP portrait vector library is updated.

[0116] For example, assuming that the full amount of IPs includes IP1, IP2, IP3 and IP4, the time is 14:23, and the periodic real-time update is hourly update. Then at 14:23, multi-dimensional portrait attribute query and multi-dimensional portrait feature expression and other operations are performed on IP1, IP2, IP3 and IP4 in the hour from 13:00 to 14:00 to obtain the first feature of IP1, the first feature of IP2, the first feature of IP3 and the first feature of IP4. Then, the longitude and latitude of IP1, IP2, IP3 and IP4 are queried through the IP portrait library to obtain the longitude and latitude of IP1, IP2, IP3 and IP4. Map POI-level feature construction is performed for the geographic location associated with each IP to obtain the second feature of IP1, IP2, IP3 and IP4. The first feature and the second feature of each IP are vectorized so that each IP corresponds to an IP portrait vector, and the original IP portrait vector in the IP vector IP portrait library is updated.

[0117] In the above implementation, the IP address is mapped to geographic coordinates through the IPIP library tool, providing a geographical dimension perspective for network assets. By analyzing the longitude and latitude and other geographical attributes of the IP address and linking the POI resources of the map, the merchant information near the longitude and latitude can be obtained to help identify the geographical location of the network resource, thereby assisting in verifying the physical location and operating scope of the network resource, and facilitating the attribution verification of the network resource.

[0118] (3)PDNS vector library.

[0119] By constructing features of dimensional information such as domain names associated with all IPs in the PDNS library, including but not limited to domain names, subdomains, registration information, and associated company names associated with the IPs, a periodically updated PDNS vector library is generated for all IPs.

[0120] The embodiment of the present application periodically generates a PDNS vector library offline in the following manner:

[0121] For each network resource, the domain name information associated with the network resource in the domain name database is periodically expressed and vectorized to generate a corresponding network resource domain name vector; the network resource domain name vector library is updated based on the network resource domain name vectors of the full network resources.

[0122] The periodicity may be half an hour, one hour, etc. Domain name information includes but is not limited to domain name, subdomain name, registration information, name of associated company, etc.

[0123] like Figure 5As shown, it is a schematic diagram of generating a PDNS vector library provided by an embodiment of the present application. Taking hourly updates as an example, after performing a domain name query on each IP in the PDNS library every hour, the domain name information associated with each IP is semantically expressed and vectorized, and a PDNS vector is generated for each IP in the full amount of IPs, and then the vector in the PDNS vector library is updated.

[0124] For example, assuming that all IPs include IP1, IP2, IP3 and IP4, the time is 14:23, and the periodic real-time update is an hourly update. Then at 14:23, the domain name information associated with IP1, IP2, IP3 and IP4 in the hour from 13:00 to 14:00 is individually subjected to domain name semantic expression and vectorization operations to obtain IP1 PDNS vector, IP2 PDNS vector, IP3 PDNS vector and IP4 PDNS vector, and the original PDNS vector in the PDNS vector library is updated.

[0125] In the above implementation, different from the traditional method of determining IP ownership by associating filing information, the embodiment of the present application associates information from multiple sources, including IP behavior, IP portrait, POI associated with IP geographic location, PDNS information, etc. This combination of multi-dimensional data not only enhances the depth of cognition of network resources, but also improves the understanding of network status, providing a solid data foundation for further analysis and decision-making.

[0126] After updating the multi-source database offline in real time through the above steps, the association vector can be obtained in the multi-source database during actual use.

[0127] Among them, each association vector corresponds to a database of the multi-source database; each association vector includes at least two vectors obtained by querying in the corresponding database: a first vector, a second vector and a third vector; the first vector is a vector of the current network resource, the second vector is a vector of the same-subnet network resource in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold.

[0128] Specifically, the same-subnet network resource and the current network resource are in the same C-segment subnet. The similarity between the third vector and the first vector can be determined by calculating the cosine similarity, Euclidean distance, Manhattan distance, etc. between the two vectors. The preset threshold is also set in combination with the similarity requirement and the similarity determination method.

[0129] In an optional implementation, the association vector is obtained in the following manner:

[0130] (1) If the associated vector includes the first vector, query the current network resource in the multi-source database to obtain the queried first vector.

[0131] Still taking the multi-source database including the IP behavior vector library, the IP portrait vector library, and the PDNS vector library as an example, for the association vector corresponding to the IP behavior vector library, the first vector included is the IP behavior vector; for the association vector corresponding to the IP portrait vector library, the first vector included is the IP portrait vector; for the association vector corresponding to the PDNS vector library, the first vector included is the PDNS vector.

[0132] (2) If the associated vector includes the second vector, the subnet network resource is expanded for the current network resource, and after obtaining the same subnet network resource, the same subnet network resource is queried in the multi-source database to obtain the queried second vector.

[0133] Still taking the multi-source database including IP behavior vector library, IP portrait vector library, and PDNS vector library as an example, for the association vector corresponding to the IP behavior vector library, the second vector included is the C-segment IP behavior vector; for the association vector corresponding to the IP portrait vector library, the second vector included is the C-segment IP portrait vector; for the association vector corresponding to the PDNS vector library, the second vector included is the C-segment PDNS vector.

[0134] In the above implementation, by identifying the C-segment range of a specific IP address, other IP addresses that may be related in the same subnet are expanded. The activities and properties of these IP addresses, including port usage and open services, are further verified to determine the potential connection between the IP in the same subnet and the target asset, providing a more detailed IP association network view.

[0135] (3) If the associated vector includes the third vector, similar network resources are recalled for the current network resource. After the similar network resources are obtained, similar network resources are queried in a multi-source database to obtain the queried third vector.

[0136] Still taking the multi-source database including IP behavior vector library, IP portrait vector library, and PDNS vector library as an example, for the association vector corresponding to the IP behavior vector library, the third vector included therein is a similar IP behavior vector; for the association vector corresponding to the IP portrait vector library, the third vector included therein is a similar IP portrait vector; for the association vector corresponding to the PDNS vector library, the third vector included therein is a similar PDNS vector.

[0137] In addition, the multi-source database in the embodiment of the present application may also include a third-party database, which is obtained by integrating and analyzing data from third parties, wherein the third-party data can be query results of network security tools such as WHOIS, VirtusTotal, FOFA, online forums, security announcements, etc., extracting key IP or URL registration information, such as domain name owner, registration date, contact information, etc., and correlating it with network resources for analysis.

[0138] In the case where the multi-source database includes a third-party database, in addition to the association vector, the third-party portrait vector corresponding to the current network resource can also be queried in the third-party database.

[0139] In the above implementation, the legal and ownership background of network resources is provided through a third-party database, thereby enhancing the legal and compliance considerations of association verification.

[0140] S23: After extracting features from multiple association vectors, input the trained network resource attribution model to obtain resource attribution information of the target object;

[0141] Among them, the network resource attribution model is trained based on multi-source databases and labeled network resources.

[0142] In the case where the multi-source database includes a third-party database, it is necessary to extract features from multiple association vectors and third-party portrait vectors and then input them into the trained network resource attribution model to obtain resource attribution information.

[0143] As a core intelligent component, the network resource attribution model can use neural network technology to process and analyze the association vectors and third-party portrait vectors provided in the above steps. It can be trained through machine learning algorithms to convert multi-dimensional feature inputs into decision outputs for determining network resource associations.

[0144] In an optional implementation manner, the network resource attribution model is trained in the following manner, that is, the offline training phase of the embodiment of the present application:

[0145] The training association vectors corresponding to the marked network resources are queried in the multi-source database; the training association vectors are input into the network resource attribution model to obtain the training attribution information; and the network resource attribution model is trained according to the difference between the training attribution information and the real attribution information of the marked network resources.

[0146] Specifically, Figure 6As shown, it is a training diagram of a network resource attribution model provided in an embodiment of the present application. The labeled network resources are queried in a multi-source database, wherein the IP behavior vector, the C-segment IP behavior vector and the similar IP behavior vector are queried in the IP behavior vector library. The IP portrait vector, the C-segment IP portrait vector and the similar IP portrait vector are queried in the IP portrait vector library. The PDNS vector, the C-segment PDNS vector and the similar PDNS vector are queried in the PDNS vector library. The scanned third-party portrait vector is queried in the third-party database. After each of the above vectors is expressed as a vector, it is input into the network resource attribution model for model training.

[0147] Specifically, the following formula 1 may be selected to calculate the difference between the training attribution information and the true attribution information of the labeled network resources:

[0148]

[0149] Among them, J(w) is the cross entropy loss function, N is the number of labeled network resources, and p n is the true distribution of the nth labeled network resource, q n is the model prediction distribution of the nth labeled network resource, H(p n ,q n ) is p n With q n The cross entropy of y n is the real attribution information, with a value of [0, 1], y' n For training attribution information.

[0150] Alternatively, a function such as log loss can be used to calculate the difference between the training attribution information and the true attribution information of labeled network resources.

[0151] In an optional implementation, during the actual use of the network resource attribution model, the association vector is input into the network resource attribution model to obtain resource attribution information and the confidence level of the corresponding resource attribution information;

[0152] If the confidence level is greater than the preset value, the resource ownership information is output;

[0153] If the confidence level is less than or equal to a preset value, a resource attribution list and the confidence level are output according to the resource attribution information. The resource attribution list is a reference list for determining the network resources owned by the target object.

[0154] The confidence range is often [0, 1], and the preset value is generally set to 0.5, or the preset value can be adjusted to be larger or smaller according to needs.

[0155] Specifically, for the output results of the model, if the confidence is greater than the preset value, the most likely IP attribution predicted by the model can be directly output; for the case where it is less than or equal to the preset value, a resource attribution list of possible IP attributions and the confidence corresponding to each possible IP attribution can be output for reference in subsequent processes.

[0156] like Figure 7 As shown, it is a schematic diagram of an online reasoning stage provided in an embodiment of the present application. Figure 7 The current network resources are queried in the IP behavior vector library, IP portrait vector library, PDNS vector library and third-party databases. After the queried association vectors are vector expressed and other operations are performed to extract features, they are input into the network resource attribution model. If the confidence output by the network resource attribution model is greater than the preset threshold, the resource attribution information is output; if the confidence is less than or equal to the preset value, the resource attribution list and confidence are output.

[0157] In the above implementation, the network resource attribution model can identify complex patterns and associations, handle data conflicts, and provide accurate attribution discrimination, which significantly improves the predictive ability and robustness of the network resource attribution determination method. In addition, the network resource attribution model also has the ability to self-optimize and can continuously adjust and improve its performance based on new data and feedback.

[0158] The following takes www.ctct.cn as an example to introduce the method for determining the ownership of network resources provided in the embodiment of the present application.

[0159] (1) PDNS data utilization: query the corresponding domain name URL based on the current IP address. If the domain name URL obviously belongs to another company, it can be filtered and deleted. For example, among the 6,329 IP addresses recalled by ctct.cn, 135 asset IP addresses that obviously did not belong to ctct were filtered.

[0160] (2) C-segment IP extension verification: According to the current IP, the C-segment IP of the network segment to which it belongs is extended. Theoretically, an IP has 255 C-segment extended IPs. After the extension, special types of IPs are filtered, such as intranet IP addresses (127.0.0.0, 192.168.0.0, etc.). Through IP extension, the recalled IP can be associated with the current IP to a certain extent. If the recalled IP and the current IP belong to the same C segment, it is very likely that the recalled IP is the IP of the target object network resource. For example, there are 4797 IPs belonging to the same C segment as ctct.cn.

[0161] (3) IP behavior vector library: Query the IP behavior vectors of the current IP, recalled IPs in the same C segment, and similar IPs in the IP behavior vector library.

[0162] (4) IP portrait vector library combined with POI information: Based on the latitude and longitude information of the current IP, request the data of the map POI, and filter the POI category in combination with the industry to which the target object belongs. For example, ctct.cn belongs to the category of life service-telecommunication business hall. If there is a POI merchant that matches the industry to which the target object belongs within 10 kilometers of the latitude and longitude of the IP, the current recalled IP has a higher credibility. Query the IP portrait vector of the current IP, the recalled IP in the same C segment, and similar IPs in the IP portrait vector library.

[0163] (5) PDNS vector library: Query the PDNS vectors of the current IP, recalled IPs in the same C segment, and similar IPs in the PDNS vector library.

[0164] (6) Third-party database: Combined with the IP information associated with third-party information such as whois, FOFA, and Virustotal, the query is performed to determine the similarity between the IP registration information, registration unit, and ownership information and the target object.

[0165] (7) Network resource attribution determination model based on neural network: All the above vectors are combined for feature modeling, and the network resource attribution determination model is used to score whether the current recalled IP belongs to the network assets of the target object. The final model has an accuracy rate of 92.36% and a recall rate of 86.72%.

[0166] The embodiment of the present application provides a method for determining the ownership of network resources. By integrating IP behavior, IP portrait features, PDNS data and third-party information (such as WHOIS query results) in network traffic data, the accuracy and reliability of the determination process are significantly improved compared to the method that relies on the query results of a single data source in the related art. The use of a neural network model to process these multi-dimensional data not only enhances the adaptability to dynamic network environments, but also enables automatic optimization of the verification process through machine learning. In addition, in the IP portrait features, additional enterprise-associated POI data is introduced as a geolocation technology, adding a key analysis dimension, which helps to identify and exclude network resources that do not match the target geographic location, thereby further improving the relevance and accuracy of the verification. The automation and real-time design of the embodiment of the present application ensures a rapid response to network changes and provides strong support for network security.

[0167] Based on the same inventive concept, the embodiment of the present application also provides a network resource ownership determination device, such as Figure 8 As shown, the network resource ownership determination device 8000 includes:

[0168] The acquisition unit 8001 is used to acquire the current network resources of the target object;

[0169] A query unit 8002 is used to query a plurality of association vectors corresponding to the current network resource in a multi-source database; each association vector corresponds to a database of the multi-source database; the multi-source database is obtained after periodic real-time processing of the full amount of network resources; each association vector includes at least two vectors obtained by querying in the corresponding database: a first vector, a second vector and a third vector; the first vector is a vector of the current network resource, the second vector is a vector of a network resource in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold;

[0170] The attribution unit 8003 is used to extract features from multiple association vectors, input the trained network resource attribution model, and obtain resource attribution information of the target object; the network resource attribution model is trained based on a multi-source database and labeled network resources.

[0171] In some embodiments, the query unit 8002 is specifically used to:

[0172] If the associated vector includes the first vector, querying the current network resource in the multi-source database to obtain the queried first vector;

[0173] If the associated vector includes the second vector, the subnet network resource is expanded for the current network resource, and after obtaining the same subnet network resource, the same subnet network resource is queried in the multi-source database to obtain the queried second vector;

[0174] If the associated vector includes the third vector, similar network resources are recalled for the current network resource. After similar network resources are obtained, similar network resources are queried in a multi-source database to obtain the queried third vector.

[0175] In some embodiments, the multi-source database includes a network resource behavior vector library, and before obtaining the current network resource of the target object, the device further includes:

[0176] The database unit 8004 is used to periodically extract data from the network traffic data;

[0177] In each cycle, the communication behavior of each network resource in the extracted network traffic data is modeled and vectorized to generate a network resource behavior vector; the network resources correspond to the network resource behavior vectors one by one;

[0178] The network resource behavior vector library is updated according to the network resource behavior vectors of the entire network resources.

[0179] In some embodiments, the multi-source database includes a network resource portrait vector library. Before obtaining the current network resource of the target object, the database unit 8004 is further used to:

[0180] For each network resource, do the following:

[0181] By periodically constructing features of multi-dimensional portrait attributes of network resources in the network resource portrait library, a corresponding first feature is generated;

[0182] According to the geographical attributes in the multi-dimensional portrait attributes, similar network resources of the same type as the network resource are searched in the point of interest information, and features of the similar network resources are constructed to generate corresponding second features;

[0183] Vectorize the first feature and the second feature corresponding to the network resource to generate a corresponding network resource portrait vector;

[0184] The network resource portrait vector library is updated based on the network resource portrait vectors of the entire network resources.

[0185] In some embodiments, the multi-source database includes a network resource domain name vector library. Before obtaining the current network resource of the target object, the database unit 8004 is further used to:

[0186] For each network resource, the domain name information associated with the network resource in the domain name database is periodically expressed and vectorized to generate a corresponding network resource domain name vector;

[0187] The network resource domain name vector library is updated according to the network resource domain name vectors of the full network resources.

[0188] In some embodiments, the multi-source database also includes a third-party database; the query unit 8002 is further used to:

[0189] Query the third-party portrait vector corresponding to the current network resource in the third-party database;

[0190] The attribution unit 8003 is also used for:

[0191] Feature extraction is performed on multiple association vectors and third-party portrait vectors.

[0192] In some embodiments, the attribution unit 8003 is specifically configured to:

[0193] Obtain resource attribution information and the confidence level of the corresponding resource attribution information;

[0194] If the confidence level is greater than the preset value, the resource ownership information is output;

[0195] If the confidence level is less than or equal to a preset value, a resource attribution list and the confidence level are output according to the resource attribution information. The resource attribution list is a reference list for determining the network resources owned by the target object.

[0196] In some embodiments, the attribution unit 8003 is specifically used to train the network resource attribution model in the following manner:

[0197] Query the training association vectors corresponding to the labeled network resources in the multi-source database;

[0198] Input the training association vector into the network resource attribution model to obtain the training attribution information;

[0199] The network resource attribution model is trained based on the difference between the training attribution information and the real attribution information of the labeled network resources.

[0200] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application. In one embodiment, the electronic device may be Figure 1 The terminal device 110 shown in FIG. 1 is a terminal device 110 shown in FIG. 1 . In this embodiment, the structure of the electronic device can be as follows: Fig. 9 As shown, it includes a memory 901 , a communication module 903 and one or more processors 902 .

[0201] The memory 901 is used to store computer programs executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0202] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 901 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0203] The processor 902 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 902 is configured to implement the above-mentioned network resource ownership determination method when calling the computer program stored in the memory 901 .

[0204] The communication module 903 is used to communicate with terminal devices and other servers.

[0205] The specific connection medium between the memory 901, the communication module 903 and the processor 902 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 901 and the processor 902 are connected via a bus 904. The bus 904 is connected to the processor 902 via a bus 904. Fig. 9 The connections between the other components are only for illustration and are not intended to be limiting. The bus 904 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig. 9 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0206] The memory 901 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the network resource ownership determination method of the embodiment of the present application. The processor 902 is used to execute the above-mentioned network resource ownership determination method. Based on the same inventive concept, the embodiment of the present application provides a computer-readable storage medium, and the computer program product includes: computer program code, when the computer program code runs on a computer, the computer executes any of the communication methods discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the resource verification method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0207] Refer to the following Fig.10 hereinafter, a computing device 1000 according to this embodiment of the present application is described. Fig.10 The computing device 1000 is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0208] like Fig.10 The computing device 1000 is in the form of a general computing device. The components of the computing device 1000 may include but are not limited to: at least one processing unit 1001, at least one storage unit 1002, and a bus 1003 connecting different system components (including the storage unit 1002 and the processing unit 1001).

[0209] Bus 1003 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0210] The storage unit 1002 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1021 and / or a cache memory 1022 , and may further include a read-only memory (ROM) 1023 .

[0211] The storage unit 1002 may also include a program / utility 1025 having a set (at least one) of program modules 1024, such program modules 1024 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0212] The computing device 1000 may also communicate with one or more external devices 1004 (e.g., keyboards, pointing devices, etc.), one or more devices that enable a user to interact with the computing device 1000, and / or any device that enables the computing device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1005. Furthermore, the computing device 1000 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1006. Fig.10 As shown, the network adapter 1006 communicates with other modules for the computing device 1000 via the bus 1003. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the computing device 1000, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0213] The embodiment of the present application also provides a computer program product, and the method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0214] A computer-readable storage medium can be implemented as a computer program product, that is, an embodiment of the present application also provides a computer-readable storage medium, which includes a computer program, and when the computer program is executed by a processor, it implements any of the above-mentioned methods for determining the ownership of network resources.

[0215] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0216] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0217] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0218] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0219] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0220] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for determining the ownership of network resources, characterized in that: include: Get the current network resources of the target object; Query multiple association vectors corresponding to the current network resource in a multi-source database; each of the association vectors corresponds to a database of the multi-source database; the multi-source database is obtained after periodic real-time processing of all network resources; each of the association vectors includes at least two vectors obtained by querying the corresponding database: a first vector, a second vector and a third vector; the first vector is a vector of the current network resource, the second vector is a vector of a network resource in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold; After extracting features from the multiple association vectors, inputting the trained network resource attribution model to obtain resource attribution information of the target object; The network resource attribution model is obtained by training based on the multi-source database and labeled network resources.

2. The method according to claim 1, characterized in that The querying of the multiple association vectors corresponding to the current network resource in the multi-source database includes: If the association vector includes the first vector, querying the current network resource in the multi-source database to obtain the queried first vector; If the association vector includes the second vector, performing subnet network resource expansion on the current network resource, after acquiring the same-subnet network resource, querying the same-subnet network resource in the multi-source database to acquire the queried second vector; If the association vector includes the third vector, similar network resources are recalled for the current network resource, and after similar network resources are acquired, the similar network resources are queried in the multi-source database to acquire the queried third vector.

3. The method according to claim 1, characterized in that The multi-source database includes a network resource behavior vector library. Before obtaining the current network resource of the target object, the method further includes: Periodically extract data from network traffic data; In each cycle, feature modeling and network resource vectorization are performed on the communication behavior of each network resource in the extracted network traffic data to generate a network resource behavior vector; the network resources correspond to the network resource behavior vectors one by one; The network resource behavior vector library is updated according to the network resource behavior vector of the full amount of network resources.

4. The method according to claim 1, characterized in that The multi-source database includes a network resource portrait vector library. Before obtaining the current network resource of the target object, the method further includes: For each network resource, do the following: By periodically constructing features of multi-dimensional portrait attributes of the network resources in the network resource portrait library, a corresponding first feature is generated; According to the geographical attribute in the multi-dimensional portrait attribute, query the same type of network resources as the network resource type in the point of interest information, and construct features for the same type of network resources to generate corresponding second features; Vectorize the first feature and the second feature corresponding to the network resource to generate a corresponding network resource portrait vector; The network resource portrait vector library is updated according to the network resource portrait vector of the full amount of network resources.

5. The method according to claim 1, characterized in that The multi-source database includes a network resource domain name vector library. Before obtaining the current network resource of the target object, the method further includes: For each network resource, the domain name information associated with the network resource in the domain name database is periodically expressed and vectorized to generate a corresponding network resource domain name vector; The network resource domain name vector library is updated according to the network resource domain name vector of the full network resource.

6. The method according to claim 1, characterized in that The multi-source database also includes a third-party database; The querying of the multiple association vectors corresponding to the current network resource in the multi-source database further includes: Querying the third-party portrait vector corresponding to the current network resource in the third-party database; The extracting features from the plurality of association vectors further comprises: Feature extraction is performed on the multiple association vectors and the third-party portrait vector.

7. The method according to claim 1, characterized in that The acquiring resource ownership information of the target object includes: Acquire the resource attribution information and the confidence level corresponding to the resource attribution information; If the confidence level is greater than a preset value, outputting the resource ownership information; If the confidence level is less than or equal to the preset value, a resource attribution list and the confidence level are output according to the resource attribution information, where the resource attribution list is a reference list for determining network resources owned by the target object.

8. The method according to claim 1, characterized in that The network resource attribution model is trained in the following way: Querying the multi-source database for a training association vector corresponding to the labeled network resource; Inputting the training association vector into the network resource attribution model to obtain training attribution information; The network resource attribution model is trained according to the difference between the training attribution information and the real attribution information of the marked network resources.

9. A network resource ownership determination device, characterized in that: include: An acquisition unit, used to acquire the current network resources of the target object; A query unit, used to query a plurality of association vectors corresponding to the current network resource in a multi-source database; each of the association vectors corresponds to a database of the multi-source database; the multi-source database is obtained after periodic real-time processing of the full amount of network resources; each of the association vectors includes at least two vectors obtained by querying in the corresponding database: a first vector, a second vector and a third vector; the first vector is a vector of the current network resource, the second vector is a vector of a network resource in the same subnet as the current network resource, and the vector similarity between the third vector and the first vector reaches a preset threshold; An attribution unit, configured to extract features from the plurality of association vectors, input the features into a trained network resource attribution model, and obtain resource attribution information of the target object; The network resource attribution model is obtained by training based on the multi-source database and labeled network resources.

10. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in the method according to any one of claims 1 to 8 according to the obtained program instructions.

11. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that The method comprises a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device executes the steps of the method according to any one of claims 1 to 8.

Images