Network asset security management system and method

Abstract

The embodiment of the invention provides a network asset security management system and method, and relates to the technical field of security management. Wherein the system comprises: a scheduling layer configured to generate a task in a probe layer based on a user instruction or a system call; the detection layer comprises an intelligence acquisition module, an asset discovery module, an asset detection module and a vulnerability detection module, the intelligence acquisition module is used for acquiring intelligence data based on a built-in tool, the asset discovery module is used for generating asset information based on the intelligence data, the asset detection module is used for detecting available resources in assets, and the vulnerability detection module is used for detecting vulnerability of the assets; the vulnerability detection module is used for detecting security vulnerabilities in assets; the processing layer comprises a data verification module and a data processing module; and the display layer is configured to display the data of the detection layer processed by the processing layer. According to the embodiment provided by the invention, the real-time synchronism, convenience and safety of network asset management can be improved.

Description

Technical Field

[0001] The present application relates to the field of security management technology, and specifically to a network asset security management system, a network asset security management method, an electronic device and a corresponding storage medium. Background Art

[0002] After several years of gradual evolution and popular application of information technology, a large number of network information systems have played an increasingly critical role, not only profoundly affecting industrial production, financial communications, and transportation, but also becoming more and more closely linked to our daily lives. While these information systems provide us with convenience and speed, they also bring with them increasingly serious network information security issues. Based on the effective management of network systems, we call those software and hardware information closely related to network information security network security assets. In order to identify risks, quickly provide vulnerability risk information, and help managers carry out network security protection work in a targeted manner, it is necessary to more comprehensively include network security asset content in the scope of normalized management.

[0003] The current network asset security management system is generally based on asset discovery, asset detection and vulnerability detection for security management, but does not have real-time updates and data associations for network assets, resulting in difficulty in achieving real-time synchronization and convenient and fast query data during management. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a network asset security management system and method, which has the characteristics of improving the real-time synchronization, convenience and security of network asset management, so as to at least solve some of the problems in the background technology.

[0005] In order to achieve the above-mentioned purpose, a network asset security management system is provided in the present application, which includes: a scheduling layer, the scheduling layer is configured to generate tasks in the detection layer based on user instructions or system calls; a detection layer, the detection layer includes an intelligence collection module, an asset discovery module, an asset detection module and a vulnerability detection module, the intelligence collection module is used to collect intelligence data based on built-in tools, the asset discovery module is used to generate asset information based on the intelligence data, the asset detection module is used to detect available resources in assets, and the vulnerability detection module is used to detect security vulnerabilities in assets; a processing layer, the processing layer includes a data verification module and a data processing module, which are used to process the data obtained by the detection layer; and a display layer, the display layer is configured to: display the data of the detection layer after being processed by the processing layer.

[0006] Optionally, the scheduling layer includes a task configuration module, a task classification module, a task issuing module and a result feedback module; the task configuration module is used to generate a task template based on user instructions or system calls, the task template includes a task type and task parameters, the task type corresponds to the module in the detection layer, the task parameters include a task mode, a task target and an execution frequency, the task mode includes an intelligent mode and a custom mode, the task target is the range of assets to be detected, and the execution frequency is the execution cycle of the task; the task classification module is used to classify the tasks configured by the task configuration module based on the task type; the task issuing module is used to issue the tasks classified by the task classification module to the detection layer, the issuance includes direct issuance and delayed issuance, the direct issuance includes adding the task to the task queue of the detection layer, and the delayed issuance includes copying the task and sending the task copy to the multi-processing engine, which is then issued to the detection layer by the multi-processing engine; and a result feedback module is used to obtain result feedback on the issued tasks by the task issuing module.

[0007] Optionally, the intelligence collection module includes: a filing intelligence collection module for collecting filing intelligence; a domain name intelligence collection module for collecting domain name intelligence; an asset intelligence collection module for collecting asset intelligence; an organizational intelligence collection module for collecting organizational intelligence; a vulnerability intelligence collection module for collecting vulnerability intelligence; a POC intelligence collection module for collecting POC intelligence; the asset discovery module includes: a filing association detection module for detecting the filing association of assets; a domain name detection module for detecting the domain name association of assets; an IP detection module for detecting the survival of IP assets; the asset detection module includes: a port detection module for detecting asset port opening information; a fingerprint detection module for detecting assets based on fingerprints including information about operating systems, device types, ports / services, application components and organizations; a traffic detection module for detecting abnormal traffic of assets based on traffic; the vulnerability detection module includes: a host vulnerability detection module for detecting whether assets have host vulnerabilities; a Web vulnerability detection module for detecting whether assets have Web vulnerabilities; a website vulnerability detection module for detecting whether assets have website vulnerabilities; a weak password detection module for detecting whether assets have weak password vulnerabilities; and a POC detection module for detecting whether assets have POC vulnerabilities.

[0008] Optionally, the system also includes: a storage layer arranged between the detection layer and the processing layer; the storage layer is used to cache the information generated by the detection layer and provide it to the processing layer for reading; the storage layer includes: an intelligence library, which is used to store the intelligence collected by the filing intelligence collection module, the domain name intelligence collection module, the asset intelligence collection module and the organization intelligence collection module; a fingerprint library, which is used to store the fingerprint intelligence collected by the asset intelligence collection module; a vulnerability library, which is used to store the vulnerability intelligence collected by the vulnerability intelligence collection module; a POC library, which is used to store the POC intelligence collected by the POC intelligence collection module; an association library, which is used to store asset-vulnerability association data; an asset library, which is used to store assets discovered based on the filing association detection module, the domain name detection module and the IP detection module.

[0009] Optionally, the data verification module includes: an asset legitimacy verification module, used to verify the legitimacy of assets; a data update verification module, used to verify whether the asset data is updated; a data consistency verification module, used to verify the consistency of asset data; a whitelist data verification module, used to verify whether the asset data is whitelist data; the data processing module includes: a data cleaning module, used to clean asset data; a data grouping module, used to group asset data; a data parsing module, used to parse asset data; a data conversion module, used to convert asset data based on the parsing results of the data parsing module to make the two consistent; a data statistics module, used to count asset data; a data aggregation module, used to aggregate asset data; a data association module, used to associate asset data.

[0010] Optionally, the system also includes a support layer, which is used to provide various management functions of the system; the support layer includes: a user management module for managing user information; a role management module for managing role authority information; an organization management module for managing organization information; an authorization management module for managing authorization information; a node management module for managing node information; a query module for querying required information; a monitoring center module for monitoring all system information; an upgrade center module for remote contactless version updates and upgrades; and an expansion module for expanding modules according to the actual operation of the system.

[0011] Optionally, the system also includes a docking layer, which includes: a data import module for importing third-party data; a data export module for exporting data to a third party; correspondingly, the intelligence collection module also includes: a third-party data intelligence collection module for collecting third-party intelligence data.

[0012] A network asset security management method is also provided in the present application. Based on the aforementioned network asset security management system, the method includes: obtaining user instructions based on the display layer; generating tasks in the detection layer based on the scheduling layer and the user instructions; the detection layer calls at least one of the intelligence collection module, asset discovery module, asset detection module and vulnerability detection module to perform the task and obtain result data corresponding to the task; processing the result data based on the data verification module and / or data processing module in the processing layer to obtain processed result data; displaying the processed result data based on the display layer; when there is a support layer, the method also includes: before obtaining the user instructions, determining the user's role information, organizational structure information and authorization information based on the user's login information.

[0013] The present application also provides an electronic device, comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the aforementioned network asset security management system or method by executing the instructions stored in the memory.

[0014] The present application also provides a machine-readable storage medium on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the aforementioned network asset security management system or method.

[0015] A computer program product is also provided in the present application, including a computer program, which implements the aforementioned network asset security management method when executed by a processor.

[0016] The above technical solution has the following beneficial effects:

[0017] The network assets are detected based on asset discovery, asset detection and vulnerability detection, and the network assets are updated in real time based on asset updates. At the same time, network assets are associated with vulnerabilities based on data aggregation and association. Compared with the existing technology, it can improve the real-time synchronization, convenience and security of network asset management.

[0018] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0020] Figure 1A schematic diagram of the structure of a network asset security management system according to an embodiment of the present application is shown;

[0021] Figure 2 Another structural diagram of the network asset security management system according to an embodiment of the present application is schematically shown;

[0022] Figure 3 The following schematically shows the steps of the network asset security management method according to the implementation mode of the present application;

[0023] Figure 4 The internal structure of an electronic device according to an embodiment of the present application is schematically shown.

[0024] 1-support layer; 2-scheduling layer; 3-detection layer; 4-storage layer; 5-processing layer; 6-display layer; 7-docking layer. DETAILED DESCRIPTION

[0025] The specific implementation of the embodiment of the present application is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present application, and is not used to limit the embodiment of the present application.

[0026] Figure 1 The schematic diagram shows the structure of the network asset security management system according to the implementation mode of the present application. Figure 1 As shown, a network asset security management system includes:

[0027] a scheduling layer configured to generate tasks in the detection layer based on user instructions or system calls;

[0028] The detection layer includes an intelligence collection module, an asset discovery module, an asset detection module, and a vulnerability detection module. The intelligence collection module is used to collect intelligence data based on built-in tools, the asset discovery module is used to generate asset information based on the intelligence data, the asset detection module is used to detect available resources in assets, and the vulnerability detection module is used to detect security vulnerabilities in assets;

[0029] A processing layer, comprising a data verification module and a data processing module, for processing the data acquired by the detection layer; and

[0030] The display layer is configured to display the data of the detection layer after being processed by the processing layer.

[0031] Through the above implementation methods, network assets are detected based on asset discovery, asset detection and vulnerability detection, network assets are updated in real time based on asset updates, and network assets are associated with assets and vulnerabilities based on data aggregation and association. Compared with the existing technology, the real-time synchronization, convenience and security of network asset management can be improved.

[0032] In some optional implementations of the present application, the scheduling layer includes a task configuration module, a task classification module, a task delivery module and a result feedback module; the task configuration module is used to generate a task template based on user instructions or system calls, the task template includes a task type and task parameters, the task type corresponds to the module in the detection layer, the task parameters include a task mode, a task target and an execution frequency, the task mode includes an intelligent mode and a custom mode, the task target is the asset range to be detected, and the execution frequency is the execution cycle of the task; the task classification module is used to classify the tasks configured by the task configuration module based on the task type; the task delivery module is used to deliver the tasks classified by the task classification module to the detection layer, the delivery includes direct delivery and delayed delivery, the direct delivery includes adding the task to the task queue of the detection layer, the delayed delivery includes copying the task, sending the task copy to the multi-processing engine, and the multi-processing engine delivers it to the detection layer; and the result feedback module is used to obtain the result feedback of the task delivery module on the delivered task. This implementation illustrates the specific structure of the scheduling layer. The scheduling layer performs task scheduling management according to the operation status of the system; the scheduling layer includes: a task configuration module, which is used to configure system tasks, including intelligent mode, custom mode, asset range and frequency, among which the intelligent mode is the system preset task mode, which is an automatic task mode, the custom mode is the task mode set by the user, which can be set according to the actual needs of the user, the asset range is the asset range to be detected, which is set manually by the user, and the frequency is the cycle of detecting assets, which is set manually by the user; a task classification module, which is used to classify the tasks configured by the task configuration module, including asset discovery, asset detection and threat detection; a task issuing module, which is used to issue tasks classified by the task classification module, including system immediate execution and delayed execution, among which delayed execution is a replication task, which is issued by multiple processing engines based on load balancing and executed immediately after issuance; a result feedback module, which receives result feedback of tasks issued by the task issuing module.

[0033] In some embodiments of the present application, the intelligence collection module includes: a filing intelligence collection module for collecting filing intelligence; a domain name intelligence collection module for collecting domain name intelligence; an asset intelligence collection module for collecting asset intelligence; an organizational intelligence collection module for collecting organizational intelligence; a vulnerability intelligence collection module for collecting vulnerability intelligence; a POC intelligence collection module for collecting POC intelligence; the asset discovery module includes: a filing association detection module for detecting the filing association of assets; a domain name detection module for detecting the domain name association of assets; an IP detection module for detecting the survival of IP assets; the asset detection module includes: a port detection module for detecting asset port opening information; a fingerprint detection module for detecting assets based on fingerprints including information about operating systems, device types, ports / services, application components and organizations; a traffic detection module for detecting abnormal traffic of assets based on traffic; the vulnerability detection module includes: a host vulnerability detection module for detecting whether assets have host vulnerabilities; a Web vulnerability detection module for detecting whether assets have Web vulnerabilities; a website vulnerability detection module for detecting whether assets have website vulnerabilities; a weak password detection module for detecting whether assets have weak password vulnerabilities; and a POC detection module for detecting whether assets have POC vulnerabilities. This embodiment illustrates the structure of the detection layer. The detection layer is used for intelligence collection, and performs asset discovery, asset detection and vulnerability detection based on intelligence collection; the detection layer includes: an intelligence collection module, an asset discovery module, an asset detection module and a vulnerability detection module, wherein: the intelligence collection module includes: a filing intelligence collection module, which is used to collect filing intelligence; a domain name intelligence collection module, which is used to collect domain name intelligence; an asset intelligence collection module, which is used to collect asset intelligence; an organization intelligence collection module, which is used to collect organization intelligence; a vulnerability intelligence collection module, which is used to collect vulnerability intelligence; and a POC intelligence collection module, which is used to collect POC intelligence.

[0034] The asset discovery module includes: a filing association detection module to detect the filing association of assets; a domain name detection module to detect the domain name association of assets; an IP detection module to detect the survival status of IP assets; the asset detection module includes: a port detection module to detect asset port opening information; a fingerprint detection module to detect the information of the asset package operating system, device type, port / service and application component based on fingerprint detection; a traffic detection module to detect abnormal traffic of assets based on traffic; the vulnerability detection module includes: a host vulnerability detection module to detect whether assets have host vulnerabilities; a Web vulnerability detection module to detect whether assets have Web vulnerabilities; a website vulnerability detection module to detect whether assets have website vulnerabilities; a weak password detection module to detect whether assets have weak password vulnerabilities; a POC detection module to detect whether assets have POC vulnerabilities. Specifically, network assets are imported, and the asset scope and frequency are set through the task configuration module. If the intelligent mode is adopted, the task is pre-configured. If the custom mode is adopted, the task is configured. After the task configuration is successful, the task classification module classifies the configuration tasks, including asset discovery, asset detection and threat detection. After the classification is successful, the task delivery module delivers the task. If there are many configuration tasks, they are delivered to multiple processing engines for processing based on load balancing and executed immediately after delivery.The registration association detection module is used to detect the registration association of network assets, the domain name detection module is used to detect the domain name association of network assets, the IP detection module is used to detect the survival of IP assets, and the IP assets are confirmed. After the IP assets are confirmed, they are stored in the asset library; the port detection module is used to detect the port opening information of the IP assets in the asset library based on the intelligence information in the intelligence library, the fingerprint detection module is used to detect the operating system, device type, port / service, application component and organization information of the IP assets in the asset library based on the fingerprint in the fingerprint library, and the traffic detection module is used to detect the abnormal traffic of the IP assets in the asset library based on the intelligence information in the intelligence library, so as to dynamically grasp the asset changes; the fingerprint detection module can identify more than 1,300 protocols, more than 40,000 fingerprints and dozens of unique securities industry fingerprints, and can also detect securities-specific applications such as Tongdaxin and Tonghuashun, and has 2,500+ trust-created fingerprints; the host vulnerability detection module is used to detect whether the network assets have host vulnerabilities based on the vulnerability intelligence information in the vulnerability library, and the Web vulnerability detection module is used to detect whether the network assets have Web vulnerabilities based on the vulnerability intelligence information in the vulnerability library. The website vulnerability detection module is based on the vulnerability The vulnerability intelligence information in the library detects whether there are website vulnerabilities in network assets. The weak password detection module detects whether there are weak password vulnerabilities in network assets based on the vulnerability intelligence information in the vulnerability library. The POC detection module detects whether there are POC vulnerabilities in network assets based on the POC information in the POC library. The host vulnerability detection is based on powerful vulnerability intelligence data such as 10w host vulnerability libraries, 5000+POCs, and docking with vulnerability libraries such as CVE, CNVD / CNNVD, etc., which can automatically detect local or remote host security weaknesses and vulnerabilities, and can quickly and accurately discover vulnerabilities in the scan target. Web vulnerability detection uses highly accurate crawlers and rich authentication login capabilities to conduct a comprehensive vulnerability security assessment of the website, and checks vulnerabilities such as SQL injection, Cookie injection, blind injection, cross-site, file inclusion, and sensitive information leakage on the website; weak password vulnerability detection uses brute force to guess passwords, and users can customize the weak password library; if there are vulnerabilities in network assets, the asset data with vulnerabilities are aggregated through the data aggregation module, and the asset data with vulnerabilities are associated through the data association module 511 to form "asset-vulnerability" data, which is stored in the association library;.

[0035] This implementation method uses data aggregation and data association to correlate assets, vulnerabilities, user information, and organizational information to complete the information of network assets. At the same time, it builds an overall correlation relationship based on the basic data IP, port, domain name, website, business system, etc. in the network assets, such as associating the application system with the corresponding application server, domain name, IP, port, intermediate and other assets, as well as associating assets with security holes and vulnerabilities.

[0036] In some optional embodiments of the present application, the system further includes: a storage layer disposed between the detection layer and the processing layer; the storage layer is used to cache the information generated by the detection layer and provide it to the processing layer for reading; the storage layer includes: an intelligence library for storing intelligence collected by the filing intelligence collection module, the domain name intelligence collection module, the asset intelligence collection module and the organizational intelligence collection module; a fingerprint library for storing fingerprint intelligence collected by the asset intelligence collection module; a vulnerability library for storing vulnerability intelligence collected by the vulnerability intelligence collection module; a POC library for storing POC intelligence collected by the POC intelligence collection module; an association library for storing asset-vulnerability association data; an asset library for storing assets discovered based on the filing association detection module, the domain name detection module and the IP detection module. For example, the working process of the storage layer and the detection layer includes: collecting filing intelligence through the filing intelligence collection module, collecting domain name intelligence through the domain name intelligence collection module, collecting asset intelligence through the asset intelligence collection module, collecting organizational intelligence through the organizational intelligence collection module, collecting vulnerability intelligence through the vulnerability intelligence collection module, and collecting POC intelligence through the POC intelligence collection module;

[0037] The intelligence data collected by the filing intelligence collection module, domain name intelligence collection module, asset intelligence collection module, organizational intelligence collection module, vulnerability intelligence collection module and POC intelligence collection module are verified for asset intelligence legitimacy by the asset legitimacy verification module, verified whether the asset intelligence is updated by the data update verification module 502, verified for consistency by the data consistency verification module, verified whether the asset intelligence is whitelist data by the whitelist data verification module, and then cleaned by the data cleaning module, grouped by the data grouping module, parsed by the data parsing module, converted by the data conversion module, and counted by the data statistics module. The intelligence collected by the filing intelligence collection module, domain name intelligence collection module, asset intelligence collection module and organizational intelligence collection module are stored in the intelligence library, the fingerprint intelligence collected by the asset intelligence collection module is stored in the fingerprint library, the vulnerability intelligence collected by the vulnerability intelligence collection module is stored in the vulnerability library, and the POC intelligence collected by the POC intelligence collection module is stored in the POC library.

[0038] The security data provided by the intelligence library include but are not limited to 5.5 million+ ICP filing data, 15 years of full-dimensional PDNS data, asset intelligence covering 260,000 key units worldwide and 70,000 key units in China, 3 million+ dark web intelligence data, 4 billion+ IP positioning data, 40,000+ fingerprint libraries, 10w+ host vulnerability libraries and 5,000+ POCs, etc.; the fingerprint library involves whois library, asset information library, PDNS data, filing data and IPv4 / IPv6 domain name intelligence, etc.; the vulnerability library includes security sample library, world-class attack and defense team and 360 vulnerability capability center, etc.; the intelligence library, fingerprint library and vulnerability library build a security underlying data middle platform and service capabilities, so that users can better "see" assets and vulnerabilities.

[0039] In some embodiments of the present application, the data verification module includes: an asset legitimacy verification module, used to verify the legitimacy of assets; a data update verification module, used to verify whether the asset data is updated; a data consistency verification module, used to verify the consistency of asset data; a whitelist data verification module, used to verify whether the asset data is whitelist data; the data processing module includes: a data cleaning module, used to clean asset data; a data grouping module, used to group asset data; a data parsing module, used to parse asset data; a data conversion module, used to convert asset data based on the parsing results of the data parsing module to make the two consistent; a data statistics module, used to count asset data; a data aggregation module, used to aggregate asset data; a data association module, used to associate asset data.

[0040] In some embodiments of the present application, the display layer includes an intelligence display module, an asset display module, and a vulnerability display module. Intelligence data, asset data, and vulnerability data are displayed on the intelligence display module, asset display module, and vulnerability display module, respectively; the display method of the intelligence display module, asset display module, and vulnerability display module is illustrated with pictures and texts, and users can also customize statistical dimensions to count and display assets and threats according to business needs. The system supports data analysis and display in a variety of ways such as tables, curve charts, pie charts, bar charts, and stacked charts; the system support uses Centos; the interface uses API; the gateway uses Nginx. When the system's access volume reaches a certain level, multiple server clusters can use Nginx as a reverse proxy, and multiple server flat The load is evenly shared, and there will be no downtime or idleness due to high load on a server; the data is implemented by Mybatis to operate the database, and insert, update, delete, and obtain data from the database according to the input data; the display is implemented by MVC mode, and the application data, graphical interface (GUI) display logic code, and business logic are separated to reduce the coupling degree of data presentation and business operation and improve the reuse of logic; html, react, antd, etc. are used for front-end display, and AJAX asynchronous technology is used to implement a large number of query and report functions, which improves the friendliness and convenience of the system. The display layer provided in this embodiment has the advantages of user-friendliness, intuitiveness and convenience.

[0041] In some embodiments of the present application, the system also includes a support layer, which is used to provide various management functions of the system; the support layer includes: a user management module, which is used to manage user information; a role management module, which is used to manage role authority information; an organization management module, which is used to manage organization information; an authorization management module, which is used to manage authorization information; a node management module, which is used to manage node information; a query module, which is used to query required information; a monitoring center module, which is used to monitor all system information; an upgrade center module, which is used to perform remote contactless version updates and upgrades; and an expansion module, which is used to expand the module according to the actual operation of the system.

[0042] In some embodiments of the present application, the system also includes a docking layer, and the docking layer includes: a data import module for importing third-party data; a data export module for exporting data to a third party; correspondingly, the intelligence collection module also includes: a third-party data intelligence collection module for collecting third-party intelligence data. The intelligence collection module also includes: a third-party data intelligence collection module for collecting third-party intelligence data; and also includes a docking layer, and the docking layer includes: a data import module for importing third-party data; a data export module for exporting data to a third party. The working principle of this embodiment includes: the third-party data intelligence collection module can be connected with the data import module and the data export module, and reference third-party data or export data to a third party, breaking the "data island" effect and allowing data to play its value. The third party here includes 360 security brain, intelligence infrastructure, situational awareness infrastructure, security operation infrastructure, advanced threat infrastructure and vulnerability infrastructure, etc., providing accurate asset information for related systems, helping the system to complete security construction more quickly with the help of accurate asset information, and completing missing asset data. For example, the situational awareness system can better complete the data drill-down of the threat log with the help of accurate asset data, presenting a more complete attack path.

[0043] Figure 2 Another schematic diagram of the structure of the network asset security management system according to the embodiment of the present application is shown schematically. Figure 2 As shown, the network asset security management system includes: a support layer 1, a scheduling layer 2, a detection layer 3, a storage layer 4, a processing layer 5, a display layer 6, and a docking layer 7. Each layer interacts with each other to realize the various functions of the aforementioned network asset security management system.

[0044] Based on the same inventive concept, the present application also provides a network asset security management method based on the aforementioned network asset security management system. Figure 3 The following is a schematic diagram showing the steps of the network asset security management method according to the implementation mode of the present application. Figure 3 As shown, the method includes:

[0045] S01. Obtaining user instructions based on the presentation layer;

[0046] S02, generating a task in the detection layer based on the scheduling layer and the user instruction;

[0047] S03, the detection layer calls at least one of the intelligence collection module, the asset discovery module, the asset detection module and the vulnerability detection module to perform the task and obtain result data corresponding to the task;

[0048] S04, processing the result data based on the data verification module and / or the data processing module in the processing layer to obtain processed result data;

[0049] S05. Display the processed result data based on the display layer;

[0050] When the support layer exists, the method further includes: before obtaining the user instruction, determining the user's role information, organizational structure information and authorization information based on the user's login information.

[0051] In some optional embodiments of the present application, tasks are generated in the detection layer based on the scheduling layer and the user instructions, including: generating a task template based on user instructions or system calls, the task template including a task type and task parameters, the task type corresponding to the module in the detection layer, the task parameters including a task mode, a task target and an execution frequency, the task mode including an intelligent mode and a custom mode, the task target is the range of assets to be detected, and the execution frequency is the execution cycle of the task; tasks configured for the task configuration module are classified based on the task type; tasks classified by the task classification module are sent to the detection layer, the sending includes direct sending and delayed sending, the direct sending includes adding the task to the task queue of the detection layer, and the delayed sending includes copying the task and sending the task copy to the multi-processing engine, which is sent to the detection layer by the multi-processing engine; and obtaining result feedback from the task sending module on the sent tasks.

[0052] In some optional implementations of the present application, the intelligence collection module includes: a filing intelligence collection module for collecting filing intelligence; a domain name intelligence collection module for collecting domain name intelligence; an asset intelligence collection module for collecting asset intelligence; an organizational intelligence collection module for collecting organizational intelligence; a vulnerability intelligence collection module for collecting vulnerability intelligence; a POC intelligence collection module for collecting POC intelligence; the asset discovery module includes: a filing association detection module for detecting the filing association of assets; a domain name detection module for detecting the domain name association of assets; an IP detection module for detecting the survival of IP assets; the asset detection module includes: a port detection module for detecting asset port opening information; a fingerprint detection module for detecting assets based on fingerprints including information about operating systems, device types, ports / services, application components and organizations; a traffic detection module for detecting abnormal traffic of assets based on traffic; the vulnerability detection module includes: a host vulnerability detection module for detecting whether assets have host vulnerabilities; a Web vulnerability detection module for detecting whether assets have Web vulnerabilities; a website vulnerability detection module for detecting whether assets have website vulnerabilities; a weak password detection module for detecting whether assets have weak password vulnerabilities; and a POC detection module for detecting whether assets have POC vulnerabilities.

[0053] In some optional implementations of the present application, the method further includes: caching information generated by the detection layer and providing it to the processing layer for reading;

[0054] The intelligence collected by the filing intelligence collection module, domain name intelligence collection module, asset intelligence collection module and organizational intelligence collection module is stored through the intelligence library; the fingerprint intelligence collected by the asset intelligence collection module is stored through the fingerprint library; the vulnerability intelligence collected by the vulnerability intelligence collection module is stored through the vulnerability library; the POC intelligence collected by the POC intelligence collection module is stored through the POC library; the asset-vulnerability association data is stored through the association library; the assets discovered based on the filing association detection module, domain name detection module and IP detection module are stored through the asset library.

[0055] In some optional embodiments of the present application, the method also includes verifying the data, including: verifying the legitimacy of the assets; verifying whether the asset data is updated; verifying the consistency of the asset data; verifying whether the asset data is whitelist data; the method also includes processing the data, including: cleaning the asset data; grouping the asset data; parsing the asset data; converting the asset data based on the parsing results of the data parsing module to make the two consistent; counting the asset data; aggregating the asset data; and associating the asset data.

[0056] In some optional embodiments of the present application, the method also includes providing various management functions of the system through a support layer; the management functions include: managing user information; managing role authority information; managing organizational information; managing authorization information; managing node information; querying required information; monitoring all system information; remote contactless version updates and upgrades; and expanding modules according to the actual operation of the system.

[0057] In some optional implementations of the present application, the method further includes importing third-party data and exporting data to a third party; correspondingly, the intelligence collection module further includes: a third-party data intelligence collection module for collecting third-party intelligence data.

[0058] The specific definition of each step of the above-mentioned network asset security management method can refer to the definition of the network asset security management system above, which will not be repeated here. Each module in the above-mentioned system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. It also has the advantages of improving the real-time synchronization, convenience and security of network asset management.

[0059] In some embodiments of the present application, an electronic device is also provided, comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the aforementioned network asset security management system or method. Its internal structure diagram can be as follows Figure 4 shown. Figure 4 The internal structure diagram of an electronic device according to an embodiment of the present application is schematically shown. The electronic device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected via a system bus. Among them, the processor A01 of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The network interface A02 of the electronic device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a network asset security management method or a network asset security management system is implemented.

[0060] Those skilled in the art will understand that Figure 4 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0061] In one embodiment provided in the present application, a machine-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the aforementioned network asset security management method.

[0062] In one embodiment provided in the present application, a computer program product is provided, including a computer program, which implements the aforementioned network asset security management method when executed by a processor.

[0063] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0064] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0065] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0066] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0067] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0068] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0069] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0070] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0071] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A network asset security management system, characterized in that: The system includes: a scheduling layer configured to generate tasks in the detection layer based on user instructions or system calls; The detection layer includes an intelligence collection module, an asset discovery module, an asset detection module, and a vulnerability detection module. The intelligence collection module is used to collect intelligence data based on built-in tools, the asset discovery module is used to generate asset information based on the intelligence data, the asset detection module is used to detect available resources in assets, and the vulnerability detection module is used to detect security vulnerabilities in assets; A processing layer, comprising a data verification module and a data processing module, for processing the data acquired by the detection layer; and The display layer is configured to display the data of the detection layer after being processed by the processing layer.

2. The system according to claim 1, characterized in that The scheduling layer includes a task configuration module, a task classification module, a task issuing module and a result feedback module; A task configuration module is used to generate a task template based on user instructions or system calls. The task template includes a task type and task parameters. The task type corresponds to a module in the detection layer. The task parameters include a task mode, a task target, and an execution frequency. The task mode includes an intelligent mode and a custom mode. The task target is the range of assets to be detected, and the execution frequency is the execution cycle of the task. A task classification module is used to classify the tasks configured by the task configuration module based on the task type; A task sending module is used to send the tasks classified by the task classification module to the detection layer, wherein the sending includes direct sending and delayed sending. The direct sending includes adding the tasks to the task queue of the detection layer, and the delayed sending includes copying the tasks and sending the task copies to the multi-processing engine, which sends the tasks to the detection layer; as well as The result feedback module is used to obtain the result feedback of the task issuing module on the issued task.

3. The system according to claim 1, characterized in that The intelligence collection module includes: a filing intelligence collection module for collecting filing intelligence; a domain name intelligence collection module for collecting domain name intelligence; an asset intelligence collection module for collecting asset intelligence; an organization intelligence collection module for collecting organization intelligence; a vulnerability intelligence collection module for collecting vulnerability intelligence; and a POC intelligence collection module for collecting POC intelligence. The asset discovery module includes: a filing association detection module to detect the filing association of assets; a domain name detection module to detect the domain name association of assets; an IP detection module to detect the survival status of IP assets; The asset detection module includes: a port detection module for detecting asset port opening information; a fingerprint detection module for detecting assets including operating system, device type, port / service, application component and organization information based on fingerprints; a flow detection module for detecting abnormal flow of assets based on flow; The vulnerability detection module includes: a host vulnerability detection module, which is used to detect whether an asset has a host vulnerability; a Web vulnerability detection module, which is used to detect whether an asset has a Web vulnerability; a website vulnerability detection module, which is used to detect whether an asset has a website vulnerability; a weak password detection module, which is used to detect whether an asset has a weak password vulnerability; and a POC detection module, which is used to detect whether an asset has a POC vulnerability.

4. The system according to claim 1, characterized in that The system further comprises: a storage layer disposed between the detection layer and the processing layer; the storage layer is used to cache information generated by the detection layer and provide it to the processing layer for reading; The storage layer includes: an intelligence library, which is used to store the intelligence collected by the filing intelligence collection module, the domain name intelligence collection module, the asset intelligence collection module and the organization intelligence collection module; a fingerprint library, which is used to store the fingerprint intelligence collected by the asset intelligence collection module; a vulnerability library, which is used to store the vulnerability intelligence collected by the vulnerability intelligence collection module; a POC library, which is used to store the POC intelligence collected by the POC intelligence collection module; an association library, which is used to store asset-vulnerability association data; and an asset library, which is used to store assets discovered based on the filing association detection module, the domain name detection module and the IP detection module.

5. The system according to claim 1, characterized in that The data verification module includes: an asset legitimacy verification module, which is used to verify the legitimacy of assets; a data update verification module, which is used to verify whether the asset data is updated; a data consistency verification module, which is used to verify the consistency of asset data; and a whitelist data verification module, which is used to verify whether the asset data is whitelist data. The data processing module includes: a data cleaning module for cleaning asset data; a data grouping module for grouping asset data; a data analysis module for analyzing asset data; a data conversion module for converting asset data based on the analysis results of the data analysis module to make the two consistent; a data statistics module for counting asset data; a data aggregation module for aggregating asset data; and a data association module for associating asset data.

6. The system according to claim 1, characterized in that The system also includes a support layer, which is used to provide various management functions of the system; The support layer includes: a user management module for managing user information; a role management module for managing role authority information; an organization management module for managing organization information; an authorization management module for managing authorization information; a node management module for managing node information; a query module for querying required information; a monitoring center module for monitoring all system information; an upgrade center module for remote contactless version updates and upgrades; and an expansion module for expanding modules according to the actual operation of the system.

7. The system according to claim 1, characterized in that The system further comprises a docking layer, which comprises: a data import module for importing third-party data; a data export module for exporting data to a third party; Correspondingly, the intelligence collection module also includes: a third-party data intelligence collection module, which is used to collect third-party intelligence data.

8. A network asset security management method, characterized in that: Based on the network asset security management system according to any one of claims 1 to 7, the method comprises: Get user instructions based on the presentation layer; Generate tasks in the detection layer based on the scheduling layer and the user instructions; The detection layer calls at least one of the intelligence collection module, the asset discovery module, the asset detection module and the vulnerability detection module to perform the task and obtain result data corresponding to the task; Processing the result data based on the data verification module and / or the data processing module in the processing layer to obtain processed result data; Display the processed result data based on the display layer; When the support layer exists, the method further includes: before obtaining the user instruction, determining the user's role information, organizational structure information and authorization information based on the user's login information.

9. An electronic device, characterized in that: include: at least one processor; a memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the network asset security management system described in any one of claims 1 to 7 or the network asset security management method described in claim 8 by executing the instructions stored in the memory.

10. The electronic device according to claim 9, characterized in that: The electronic device is a server or a server cluster.

Images