Method and device for determining exposed surface of network resource

Abstract

The embodiment of the invention provides a network resource exposure surface determination method and device, and the method comprises the steps: determining a target asset, and obtaining the asset attribute of the target asset; determining a network visitor set based on the asset attributes and policy rules; and determining an exposed surface of the target asset in the target network area based on the network visitor set. The asset attribute of a target asset is obtained by determining the target asset; determining a network visitor set based on the asset attributes and policy rules; the exposed surface of the target asset in the target network area is determined based on the network visitor set, so that quantification of the exposed surface can be realized, and subsequent network management is facilitated.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network security technology, and in particular to a method for determining the exposure surface of network resources. Background Art

[0002] With the rapid development of information technology, cybersecurity issues have become increasingly prominent, becoming a major challenge that businesses and organizations urgently need to address. A deep understanding of the core concepts of cybersecurity is crucial when addressing increasingly complex cyberattack threats. Exposure, attack surface, and vulnerability are three key elements in assessing cybersecurity risk.

[0003] Exposure surfaces refer to externally accessible portions of a network. These typically include publicly accessible resources, such as public IP addresses, network services, and APIs. Exposure surfaces are a primary target for attackers, encompassing any resource directly accessible from the internet. The more exposed resources, the greater the potential for attack. Exposed resources are often the primary target of attackers because they provide a direct entry point for attack. Therefore, managing exposure surfaces is crucial for improving network security. Consequently, a solution for exposure assessment is urgently needed. Summary of the Invention

[0004] In view of this, embodiments of this specification provide a method for determining the exposure surface of a network resource. One or more embodiments of this specification also involve an apparatus for determining the exposure surface of a network resource, a computing device, a computer-readable storage medium, and a computer program to address technical deficiencies in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a method for determining an exposure surface of a network resource is provided, comprising: Determine the target asset and obtain the asset attributes of the target asset; determining a set of network visitors based on asset attributes and policy rules; Determine the exposure of target assets in target network areas based on the set of network visitors.

[0006] In one possible implementation, obtaining the asset attributes of the target asset includes: Gets the workload attributes, role attributes, workgroup attributes, protocol port attributes, and policy status attributes of the target asset.

[0007] In one possible implementation, determining a network visitor set based on asset attributes and policy rules includes: Determine the target attribute based on the asset attribute, and determine the sub-rule corresponding to the target attribute from the policy rule; Determines the visitor set based on target attributes and sub-rules.

[0008] In a possible implementation, determining the exposure of a target asset in a target network area based on a set of network visitors includes: Identify the location information of aggregated website visitors; determining network area relationship information based on the address information and the address definition table; The exposure area of ​​the target asset in the target network area is determined based on the network area relationship information; wherein the target network area includes the intranet and the extranet.

[0009] In one possible implementation, determining network area relationship information based on address information and an address definition table includes: Determine an address definition table; wherein the address definition table includes an intranet address and an extranet address; Match the address information with the address definition table to determine the network area; Network region relationship information is determined based on the network regions.

[0010] In a possible implementation, determining the exposure of a target asset in a target network area based on a set of network visitors includes: Determine the workgroup attributes of a collection of network visitors; Determine group-region relationship information based on workgroup attributes; The exposure of the target asset in the target network area is determined based on the group-area relationship information; wherein the target network area includes inter-group and intra-group areas.

[0011] In one possible implementation, determining group-region relationship information based on workgroup attributes includes: Match the workgroup attributes with the target asset's workgroup attributes to determine the group area; Determine network region relationship information based on group regions.

[0012] According to a second aspect of an embodiment of this specification, a device for determining an exposure surface of a network resource is provided, including: an asset attribute determination module, configured to determine a target asset and obtain asset attributes of the target asset; an access set determination module configured to determine a network visitor set based on asset attributes and policy rules; The exposure determination module is configured to determine the exposure of the target asset in the target network area based on the network visitor set.

[0013] According to a third aspect of an embodiment of this specification, a computing device is provided, including: memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned method for determining the exposure surface of a network resource are implemented.

[0014] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions. When the instructions are executed by a processor, the steps of the above-mentioned method for determining the exposure surface of a network resource are implemented.

[0015] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned method for determining the exposure surface of a network resource.

[0016] Embodiments of this specification provide a method and apparatus for determining the exposure surface of a network resource. The method includes: determining a target asset and obtaining the target asset's asset attributes; determining a set of network visitors based on the asset attributes and policy rules; and determining the exposure surface of the target asset in a target network area based on the set of network visitors. By determining the target asset and obtaining the target asset's asset attributes; determining a set of network visitors based on the asset attributes and policy rules; and determining the exposure surface of the target asset in a target network area based on the set of network visitors, the exposure surface can be quantified, thereby facilitating subsequent network management. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of a method for determining a network resource exposure surface provided by an embodiment of this specification; Figure 2 This is a schematic diagram of a method for determining a network resource exposure surface provided by an embodiment of this specification; Figure 3 This is a schematic diagram of the structure of a device for determining a network resource exposure surface provided by an embodiment of this specification; Figure 4 This is a structural block diagram of a computing device provided by one embodiment of this specification. DETAILED DESCRIPTION

[0018] The following description sets forth many specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0019] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "an," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0020] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0021] This specification provides a method for determining the exposure surface of a network resource. This specification also relates to an apparatus for determining the exposure surface of a network resource, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0022] See also Figure 1 , Figure 1 A flowchart of a method for determining a network resource exposure surface provided according to an embodiment of this specification is shown, which specifically includes the following steps.

[0023] Step 101: Determine the target asset and obtain the asset attributes of the target asset.

[0024] Assets can include information technology assets, which are any information or data, software, or hardware used by an organization in the course of its business operations. Hardware assets include physical computing devices, such as physical servers in data centers, desktop computers, mobile devices, laptops, keyboards, and printers. Software assets, on the other hand, include applications, typically licensed on a per-user or per-machine basis, as well as software systems and databases built using open source resources. Software assets also include cloud-based assets and cloud services, such as Software as a Service (SaaS) applications.

[0025] In a possible implementation, acquiring the asset attributes of the target asset includes acquiring workload attributes, role attributes, workgroup attributes, protocol port attributes, and policy status attributes of the target asset.

[0026] In actual applications, as shown in Table 1, asset attributes may include workload ID, protocol port, workgroup, role, and policy status attributes. Among them, the policy status attribute may include access by office network address and access by external address.

[0027] Table 1

[0028] In the table above, there are three assets: w1, w2, and w3. w1's open ports include tcp / 80 and tcp / 8080, and it belongs to workgroup g1, with role r1. w2's open ports include tcp / 80, and it belongs to workgroup g1, with role r2. w3's open ports include tcp / 22, and it belongs to workgroup g2, with role r3.

[0029] Step 102: Determine a set of network visitors based on asset attributes and policy rules.

[0030] In a possible implementation, determining a network visitor set based on asset attributes and policy rules includes: determining a target attribute based on the asset attributes, determining a sub-rule corresponding to the target attribute from the policy rules; and determining a visitor set based on the target attribute and the sub-rules.

[0031] In practical applications, as shown in Table 2, the policy rules may include policy rules for the server and the visitor in the workgroup dimension, role dimension, address dimension, and port dimension.

[0032] Table 2

[0033] For example, the R2 role in workgroup G1 can access the TCP port 8080 of the R1 role in workgroup G1. The R3 role in workgroup G2 or the network segment is located at 123.186.0.0 / 16 and can access the TCP port 80 of the R2 role in workgroup G1.

[0034] The above method can be used to determine the set of all network visitors. For example, for w1, w1's open ports include tcp / 80 and tcp / 8080, it belongs to workgroup g1, and its role is r1. Then w1's visitor set includes all assets in the 123.186.0.0 / 16 network segment or assets corresponding to the r2 role in workgroup g1.

[0035] It should be noted that the visitor can be judged from the dimension of the overall asset, or from other dimensions, for example, see Figure 2 , the visitor set for the asset port can be obtained by matching the asset port dimension and policy rules, which is not limited in the embodiments of this specification.

[0036] Step 103: Determine the exposure of the target asset in the target network area based on the network visitor set.

[0037] In one possible implementation, determining the exposure surface of a target asset in a target network area based on a set of network visitors includes: determining address information of the set of network visitors; determining network area relationship information based on the address information and an address definition table; and determining the exposure surface of the target asset in the target network area based on the network area relationship information; wherein the target network area includes an intranet and an extranet.

[0038] In practical applications, see Figure 2 ,If the intranet is an office network, the number of exposed surfaces can be determined ,by the IP addresses of all visitors in the visitor set.

[0039] Table 3

[0040] See Table 3, which is the address definition table. The intranet segment is 192.168.0.0 / 16; The external network segments are 0.0.0.0 / 0, !192.168.0.0 / 16, !10.0.0.0 / 8, and !172.16.0.0 / 12. ! indicates negation, which means excluding the address segments 192.168.0.0 / 16, 10.0.0.0 / 8, and 172.16.0.0 / 12.

[0041] Specifically, determining network area relationship information based on address information and an address definition table includes: determining an address definition table; wherein the address definition table includes an intranet address and an extranet address; matching the address information with the address definition table to determine a network area; and determining network area relationship information based on the network area.

[0042] Continuing with the previous example, from the perspective of IP addresses, the visitor set of w1 includes all assets in the 123.186.0.0 / 16 network segment. From the "IP Address Definition Table," we can see that 123.186.0.0 / 16 is an external address, and its number of IP addresses is 2 to the power of (32-24), or 2 to the power of 16: 65536. In the IP Address Definition Table, the upper limit of the number of external addresses is defined as 60,000. As shown in Table 4, the value here is 60,000, which means the exposure is quantified to 60,000.

[0043] For example, from the perspective of IP addresses, the visitor set of w3 includes all assets in the 192.168.10.0 / 24 network segment. From the "IP Address Definition Table", it can be seen that 192.168.10.0 / 24 belongs to the office network address, and its number of IP addresses is 2 to the power of (32-24), that is, 2 to the power of 8: 256. Because the number of office network assets in the IP Address Definition Table is 400, and 256 is less than 400, the value here is 256.

[0044] Table 4

[0045] In one possible implementation, determining the exposure of a target asset in a target network area based on a set of network visitors includes: determining a workgroup attribute of the set of network visitors; determining group-area relationship information based on the workgroup attribute; and determining the exposure of the target asset in the target network area based on the group-area relationship information; wherein the target network area includes inter-group and intra-group areas.

[0046] In practical applications, see Figure 2 ,You can also determine the number of exposed surfaces by the work groups of all visitors in the visitor set.

[0047] Specifically, determining the group region relationship information based on the workgroup attributes includes: matching the workgroup attributes with the workgroup attributes of the target asset to determine the group region; and determining the network region relationship information based on the group region.

[0048] For example, from the perspective of the workgroup, the visitor set of w1 includes the assets corresponding to the r2 role in the workgroup g1, and the asset corresponding to the r2 role in the workgroup g1 is w2, so the intra-group exposure is 1.

[0049] Furthermore, if the visitor set of w2 includes the assets corresponding to the role r3 in the work group g2, the inter-group exposure is 1.

[0050] Embodiments of this specification provide a method and apparatus for determining the exposure surface of a network resource. The method includes: determining a target asset and obtaining the target asset's asset attributes; determining a set of network visitors based on the asset attributes and policy rules; and determining the exposure surface of the target asset in a target network area based on the set of network visitors. By determining the target asset and obtaining the target asset's asset attributes; determining a set of network visitors based on the asset attributes and policy rules; and determining the exposure surface of the target asset in a target network area based on the set of network visitors, the exposure surface can be quantified, thereby facilitating subsequent network management.

[0051] Corresponding to the above method embodiment, this specification also provides an embodiment of a device for determining a network resource exposure surface. Figure 3FIG. 1 shows a schematic diagram of a network resource exposure surface determination device provided by an embodiment of this specification. Figure 3 As shown, the device includes: The asset attribute determination module 301 is configured to determine a target asset and obtain the asset attributes of the target asset; An access set determination module 302 is configured to determine a network visitor set based on asset attributes and policy rules; The exposure determination module 303 is configured to determine the exposure of the target asset in the target network area based on the network visitor set.

[0052] In one possible implementation, obtaining the asset attributes of the target asset includes: Gets the workload attributes, role attributes, workgroup attributes, protocol port attributes, and policy status attributes of the target asset.

[0053] In one possible implementation, determining a network visitor set based on asset attributes and policy rules includes: Determine the target attribute based on the asset attribute, and determine the sub-rule corresponding to the target attribute from the policy rule; Determines the visitor set based on target attributes and sub-rules.

[0054] In a possible implementation, determining the exposure of a target asset in a target network area based on a set of network visitors includes: Identify the location information of aggregated website visitors; determining network area relationship information based on the address information and the address definition table; The exposure area of ​​the target asset in the target network area is determined based on the network area relationship information; wherein the target network area includes the intranet and the extranet.

[0055] In one possible implementation, determining network area relationship information based on address information and an address definition table includes: Determine an address definition table; wherein the address definition table includes an intranet address and an extranet address; Match the address information with the address definition table to determine the network area; Network region relationship information is determined based on the network regions.

[0056] In a possible implementation, determining the exposure of a target asset in a target network area based on a set of network visitors includes: Determine the workgroup attributes of a collection of network visitors; Determine group-region relationship information based on workgroup attributes; The exposure of the target asset in the target network area is determined based on the group-area relationship information; wherein the target network area includes inter-group and intra-group areas.

[0057] In one possible implementation, determining group-region relationship information based on workgroup attributes includes: Match the workgroup attributes with the target asset's workgroup attributes to determine the group area; Determine network region relationship information based on group regions.

[0058] Embodiments of this specification provide a method and apparatus for determining the exposure surface of a network resource. The apparatus includes the following steps: determining a target asset and obtaining the target asset's asset attributes; determining a set of network visitors based on the asset attributes and policy rules; and determining the exposure surface of the target asset in a target network area based on the set of network visitors. By determining the target asset and obtaining the target asset's asset attributes; determining a set of network visitors based on the asset attributes and policy rules; and determining the exposure surface of the target asset in a target network area based on the set of network visitors, the exposure surface can be quantified, thereby facilitating subsequent network management.

[0059] The above is a schematic diagram of a network resource exposure surface determination device according to this embodiment. It should be noted that the technical solution of this network resource exposure surface determination device and the technical solution of the aforementioned network resource exposure surface determination method are based on the same concept. For details not described in detail in the technical solution of the network resource exposure surface determination device, please refer to the description of the technical solution of the aforementioned network resource exposure surface determination method.

[0060] Figure 4 The block diagram of a computing device 400 according to one embodiment of the present disclosure is shown. Components of the computing device 400 include, but are not limited to, a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and a database 450 is used to store data.

[0061] Computing device 400 also includes an access device 440 that enables computing device 400 to communicate via one or more networks 460. Examples of such networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. Access device 440 may include one or more of any type of network interface (e.g., a network interface controller (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, or a near field communication (NFC) interface.

[0062] In one embodiment of the present specification, the above components of the computing device 400 and Figure 4 Other components not shown in the figure may also be connected to each other, for example, via a bus. Figure 4 The computing device structure block diagram shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art may add or replace other components as needed.

[0063] Computing device 400 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, personal digital assistant, laptop computer, notebook computer, netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or personal computer (PC). Computing device 400 can also be a mobile or stationary server.

[0064] Processor 420 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the aforementioned method for determining the network resource exposure surface. The above is a schematic diagram of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the aforementioned method for determining the network resource exposure surface are based on the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the aforementioned method for determining the network resource exposure surface.

[0065] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned method for determining the exposure surface of a network resource.

[0066] The above is a schematic diagram of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium is based on the same concept as the technical solution of the method for determining the exposure surface of network resources described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the method for determining the exposure surface of network resources described above.

[0067] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned method for determining the exposure surface of a network resource.

[0068] The above is an illustrative embodiment of a computer program according to this embodiment. It should be noted that the technical solution of this computer program and the technical solution of the aforementioned method for determining the network resource exposure surface are based on the same concept. For details not described in detail in the technical solution of the computer program, please refer to the description of the technical solution of the aforementioned method for determining the network resource exposure surface.

[0069] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0070] The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content of the computer-readable medium may be appropriately increased or decreased based on the requirements of legislation and patent practice within a jurisdiction. For example, in some jurisdictions, based on legislation and patent practice, computer-readable media does not include electric carrier signals and telecommunication signals.

[0071] It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0072] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0073] The preferred embodiments disclosed above are intended only to help illustrate this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made based on the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that those skilled in the art can better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A method for determining a network resource exposure surface, characterized in that: include: Determine a target asset, and obtain asset attributes of the target asset; determining a set of network visitors based on the asset attributes and policy rules; The exposure of the target asset in a target network area is determined based on the set of network visitors.

2. The method according to claim 1, characterized in that The acquiring of the asset attributes of the target asset includes: The workload attributes, role attributes, workgroup attributes, protocol port attributes, and policy status attributes of the target asset are obtained.

3. The method according to claim 1, characterized in that The determining of the network visitor set based on the asset attributes and policy rules comprises: Determine a target attribute based on the asset attribute, and determine a sub-rule corresponding to the target attribute from the policy rule; A visitor set is determined based on the target attribute and the sub-rule.

4. The method according to claim 1, characterized in that: The step of determining the exposure of the target asset in the target network area based on the network visitor set includes: Determining address information of the set of network visitors; Determine network area relationship information based on the address information and the address definition table; Based on the network area relationship information, the exposure area of ​​the target asset in the target network area is determined; wherein the target network area includes an intranet and an extranet.

5. The method according to claim 4, characterized in that The determining of the network area relationship information based on the address information and the address definition table includes: Determine an address definition table; wherein the address definition table includes an intranet address and an extranet address; Matching the address information with the address definition table to determine a network area; Network area relationship information is determined based on the network areas.

6. The method according to claim 1, characterized in that The step of determining the exposure of the target asset in the target network area based on the network visitor set includes: determining a workgroup attribute of the set of network visitors; Determining group-area relationship information based on the work group attributes; Based on the group-area relationship information, the exposure area of ​​the target asset in the target network area is determined; wherein the target network area includes between groups and within groups.

7. The method according to claim 6, characterized in that The determining of group-area relationship information based on the work group attributes includes: Matching the workgroup attribute with the workgroup attribute of the target asset to determine a group area; Network area relationship information is determined based on the group areas.

8. A device for determining a network resource exposure surface, characterized in that: include: An asset attribute determination module is configured to determine a target asset and obtain asset attributes of the target asset; an access set determination module configured to determine a network visitor set based on the asset attributes and policy rules; The exposure determination module is configured to determine the exposure of the target asset in a target network area based on the network visitor set.

9. A computing device, characterized in that include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method for determining the exposure surface of a network resource described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the method for determining the exposure surface of a network resource as described in any one of claims 1 to 7.

Images