Web asset identification method and device based on multiple modes

Abstract

The invention discloses a Web asset identification method and device based on multiple modes, and relates to the technical field of network asset security. The method comprises the following steps: acquiring multi-modal Web asset information, namely scanning web assets to extract server information, acquiring Web behavior characteristics and extracting Web home page information; based on the multi-modal Web asset information, establishing a multi-modal model of assets, including a machine classification discrimination model for identifying interface layout, a machine classification discrimination model for identifying interface pictures, and an interaction behavior model for identifying interaction behaviors; and identifying different types of asset information by using a multi-modal model. By using the technical scheme of the invention, richer and more complete asset information can be obtained, technical sources behind assets can be identified, and a solid foundation is laid for subsequent work of vulnerability analysis, risk early warning and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of network asset security, and in particular to a multi-modal based Web asset identification method and device. Background Art

[0002] The detection and mapping of cyberspace assets is the underlying support for building a network security system. One of the core points in implementing the "three transformations and six defenses, and battle plans" proposed by the competent authorities is to do a good job in the mapping of cyberspace assets.

[0003] Web assets account for the vast majority of Internet assets. In the field of industrial control, more and more industrial control systems are beginning to use Web-based management interfaces. Many PLCs, SCADA, DCS, etc. provide Web-based unified management systems. Therefore, the identification of Web assets is an important task in cyberspace scanning and detection, and is also a key step in industrial Internet asset scanning and detection. For industrial Internet asset detection, once the Web-based unified management system is identified, the industrial control equipment behind it can be further discovered.

[0004] The common web scanning detection method now is to extract and match fingerprints from the banner information in HTTP data to identify the corresponding assets. However, there may be problems with extracting fingerprints from the banner information in HTTP data to identify assets: incomplete banner information data; OEM product replacement modifies banner information. Summary of the invention

[0005] The present invention provides a multi-modal based Web asset identification method, comprising:

[0006] Obtain multimodal web asset information, including scanning web assets to extract server information, collecting web behavior features, and extracting web homepage information;

[0007] Based on multimodal Web asset information, a multimodal model of assets is established, including a machine classification and discrimination model for identifying interface layout, a machine classification and discrimination model for identifying interface images, and an interactive behavior model for identifying interactive behaviors;

[0008] Apply multimodal models to identify different types of asset information.

[0009] As described above, a multimodal Web asset identification method is described, wherein the web asset is scanned to extract server information, specifically a text message containing server information sent by the server to the client when responding to a client request, including the server name, version number, operating system, and supported protocols.

[0010] A multimodal based Web asset identification method as described above, wherein the Web behavior features include: HTTP protocol level interaction behavior and application level interaction behavior;

[0011] HTTP protocol level interaction behaviors include: ① sending correct basic HTTP requests; ② sending requests that are not allowed; ③ sending illegal versions of HTTP requests; ④ sending HTTP requests with incorrect specifications;

[0012] Application-level interaction behaviors include: ① accessing a random URL address of the server; ② inputting extremely long, extremely short, or commonly illegal characters; ③ random account and password login verification behaviors.

[0013] In the above-mentioned multimodal-based Web asset recognition method, the Web homepage information includes a Web homepage image, OCR-recognized text, and logo information.

[0014] The above-mentioned method for identifying Web assets based on multimodality, wherein a multimodal model of assets is established, specifically comprises the following sub-steps:

[0015] Extract key information from the server information, discard invalid data, and form the first asset information; summarize the key data extracted from the OCR recognized text to form the second asset information; extract the Logo image content from the Web homepage image to generate the third asset information; integrate the above three asset information into complete asset information;

[0016] Summarize the classification and result data of interactive behaviors to form asset interactive behavior features, generate feature vectors for asset interactive behavior features, learn modeling, and perform manual annotation to form an interactive behavior model for identifying interactive behaviors;

[0017] Extract home page image information, generate interface layout feature vectors, conduct learning modeling and labeling of interface layout features, use integrated complete asset information as labels, and form a machine classification and discrimination model for identifying interface layout;

[0018] A neural network classification model is built for the home page pictures, and the pictures are labeled. The previously integrated asset information is directly used as labels to form a machine classification and discrimination model for identifying interface pictures.

[0019] The multimodal Web asset identification method described above, wherein the multimodal model is applied to identify asset information, specifically includes the following sub-steps:

[0020] The first asset information, the second asset information and the third asset information are obtained, and summarized into the first asset identification information; the Web assets are interactively detected, and the detection results are extracted into vectors, which are delivered to the interactive behavior model for judgment, so as to obtain the second asset identification information; the asset homepage interface layout information is extracted to generate a vector, which is delivered to the machine classification and discrimination model for identifying the interface layout for judgment, so as to obtain the third asset identification information; the homepage image is generated into a vector, which is delivered to the machine classification and discrimination model for identifying the interface image for judgment, so as to obtain the fourth asset identification information; the above four sets of asset identification information are integrated and summarized to obtain the final asset identification information.

[0021] As described above, a multimodal Web asset identification method is described, wherein a decision algorithm is set based on the asset identification information attribute, and asset identification is determined according to the decision algorithm.

[0022] The present invention also provides a multi-modal based Web asset identification device, comprising:

[0023] The asset information acquisition module is used to obtain multimodal Web asset information, including scanning Web assets to extract server information, collecting Web behavior features, and extracting Web homepage information;

[0024] A multimodal model building module is used to build a multimodal model of assets based on multimodal Web asset information, including a machine classification and discrimination model for identifying interface layout, a machine classification and discrimination model for identifying interface images, and an interactive behavior model for identifying interactive behaviors;

[0025] The asset information identification module is used to apply multimodal models to identify different types of asset information.

[0026] The present invention also provides a computer storage medium, characterized in that it comprises: at least one memory and at least one processor;

[0027] The memory is used to store one or more program instructions;

[0028] The processor is used to run one or more program instructions to execute any one of the above-mentioned methods for identifying Web assets based on multimodality.

[0029] The beneficial effects achieved by the present invention are as follows:

[0030] (1) Based on the analysis of banner information, the present invention integrates the behavior interaction model, image OCR recognition, interface layout model, and home page picture model to form a complete multimodal model that can detect and identify richer and more detailed information of Web assets.

[0031] (2) The present invention uses a behavioral interaction model to detect the behavioral characteristics of the server, more accurately identify Web server information, and determine application system information; generates an image of the Web homepage, and then extracts interface text through image OCR recognition technology, which can more accurately and richly identify the manufacturer and system name; uses the homepage image to extract layout models and picture models, which can more accurately identify OEM scenarios and identify products from essentially the same manufacturer.

[0032] (3) By using the technical solution of the present invention, more abundant and complete asset information can be obtained, and the technical source behind the assets can be identified, laying a solid foundation for subsequent vulnerability analysis, risk warning and other work. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0034] Figure 1 It is a flow chart of a multi-modal Web asset identification method provided in Embodiment 1 of the present application;

[0035] Figure 2 It is a schematic diagram of the process of building a multimodal model;

[0036] Figure 3 It is a schematic diagram of the process of applying multimodal models to identify asset information;

[0037] Figure 4 It is a schematic diagram of a multimodal Web asset identification device provided in Example 1 of the present application. DETAILED DESCRIPTION

[0038] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0039] Embodiment 1

[0040] like Figure 1 As shown, the first embodiment of the present invention provides a multimodal Web asset identification method, including:

[0041] Step 110: Acquire multimodal Web asset information, including scanning Web assets to extract server information, collecting Web behavior features, and extracting Web homepage information.

[0042] (1) Scan web assets to extract server information, including:

[0043] Specifically, the server information extracted from the web asset is the server banner, which is a text message containing server information sent to the client when the server responds to the client request. This text information often appears in the header of the HTTP response, which is called the Server field in the HTTP response header.

[0044] The server banner contains various information about the server, such as the server name, version number, operating system, supported protocols, etc. This information is important and meaningful to both clients and attackers. For example, the banner of an Apache server is:

[0045] Http / 1.1200OK

[0046] Date:Mon,08Oct 202420:48:19GMT

[0047] Server:Apache / 1.3.23

[0048] Last-Modified:Mon,08Oct 202420:48:19GMT

[0049] ETag:"32417-c4-3e5d8a83"

[0050] Accept-Ranges:bytes

[0051] Content-Length:196

[0052] Connection:close

[0053] Content-Type:text / html

[0054] In many cases, obtaining a banner is a good method for HTTP fingerprint identification. Many applications now hide or modify banner information for security reasons, so many web assets cannot rely on banner information to identify detailed information. Although the banner information of the web server is modified, the web server's interactive response to the client generally does not change, and different servers have different behavioral characteristics. Therefore, by simply interacting with the web server and collecting its behavioral characteristics, it can be used to identify different web servers.

[0055] (2) Collect Web behavior characteristics;

[0056] The main interactive behaviors collected at the HTTP protocol level include:

[0057] ①Send the correct basic HTTP request;

[0058] ②Send an unauthorized request, such as DELETE / Http / 1.0;

[0059] ③Send illegal version of HTTP request, such as GET / Http / 5.0;

[0060] ④Sending HTTP requests with incorrect specifications, such as GET / JUNK / 1.0;

[0061] The data returned by different web servers have subtle differences. For example, there are certain differences in the order of key fields in the header, the return code of the error request, the string of the error message, etc. These differences can be combined to determine the type of backend web server.

[0062] In addition to collecting interactive features at the HTTP protocol level, it is also necessary to collect interactive behavior features at the application level. The interactive behaviors collected at the application level mainly include:

[0063] ①Access the random URL address of the server;

[0064] ② Inputting a very long or short character, or common illegal characters, such as <>{}, etc.;

[0065] ③Random account and password login verification;

[0066] Different application systems have different processing mechanisms and prompt messages for accessing illegal addresses, illegal input, and login failures. Collecting this information can be used as a differential feature of the application system to identify a certain type of application system.

[0067] In summary, the interactive behavior characteristics are summarized into the interactive behavior characteristics table shown below:

[0068]

[0069]

[0070] These behavioral characteristics can be used to assist in identifying OEM products (OEM: Original Equipment Manufacturer, refers to a manufacturer that produces products and product accessories for another manufacturer based on its requirements, also known as OEM or authorized OEM. The products produced by OEM manufacturers are generally labeled with different brand logos and serve multiple different manufacturers). OEM products generally only modify the interface information and do not modify the interactive behavior of the application server.

[0071] (3) Extracting Web homepage information

[0072] Some key information does not appear in the banner of the web page, but may appear on the web page in the form of pictures, such as the company logo (Logo: the logo of a company or organization, etc.). The manufacturer information of the asset can be accurately determined based on the company logo. In addition, some companies also display their product names in the form of pictures for aesthetics, so analyzing the pictures can greatly enrich the information of the asset.

[0073] Simply using code to interact with the Web server cannot obtain the system's home page image information. It is necessary to call the browser's kernel, simulate the browser receiving the output of the Web server and draw the page in memory, and then save the image for further analysis.

[0074] Use OCR (Optical Character Recognition) technology to extract key information from the image: company information, product name, copyright information (generally including release time), and version information. Products from different companies are different, so this information may or may not be extracted. The extracted information can supplement the banner information to enrich and improve the asset information.

[0075] Image information can be used to assist in identifying OEM products. OEM products generally simply modify banner information, product information, or background color and background image, but elements on the interface, including text, input boxes, button size and layout, are generally not modified. Through these image features, a family's product line can be accurately identified.

[0076] Step 120: Based on the multimodal Web asset information, a multimodal model of the asset is established, including a machine classification and recognition model for identifying interface layout, a machine classification and recognition model for identifying interface images, and an interactive behavior model for identifying interactive behaviors.

[0077] In the embodiment of the present application, the process of establishing a multimodal model is as follows: Figure 2 Based on the above multi-dimensional and multi-modal information, a multi-modal model of assets is established, which specifically includes the following sub-steps:

[0078] Step 121: extract key information from the Banner of the Header, discard invalid data (such as time), and form the first asset information.

[0079] Step 122: Summarize the key data extracted from OCR, including company information, product name, copyright information, version information, etc., to form second asset information.

[0080] Step 123: extract the logo image content from the web homepage image, and compare it with the logo image and company dictionary table pre-stored in the system to generate third asset information;

[0081] The third asset information may only contain company information, or may not contain any information at all, because the logo image may not exist on the home page of the interface.

[0082] Step 124: Integrate the above three types of asset information into complete asset information. The same fields in the asset information shall be based on the information in the Banner, and the information extracted by other methods shall be used as a supplement to the Banner information.

[0083] Step 125: Summarize the classification and result data of the interactive behavior to form asset interactive behavior features, generate feature vectors for the asset interactive behavior features, learn to model, and perform manual annotation to form an interactive behavior model for identifying interactive behaviors.

[0084] Specifically, only the protocol-level interaction features of the Web server are labeled to indicate the type of the Web server. The application-level interaction features do not need to be labeled, and the asset information integrated in the above steps is directly used as a label. This forms a machine learning discriminant model of asset interaction behavior.

[0085] Step 126: extract the home page image information, generate the interface layout feature vector, learn to model and label the interface layout features, use the previously integrated complete asset information as a label, and form a machine classification and discrimination model for identifying the interface layout.

[0086] Specifically, the coordinate information, position ratio, size and other information of the key text and controls in the home page image are extracted to generate an interface layout feature vector.

[0087] Step 127: Build a neural network classification model for the home page pictures and label the pictures. Directly use the previously integrated asset information as labels to form a machine classification and discrimination model for identifying interface pictures.

[0088] Return to see Figure 1 , step 130, applying a multimodal model to identify different types of asset information.

[0089] In the embodiment of the present application, the process of using the multimodal model to identify asset information is as follows: Figure 3 As shown in the figure, the application of multimodal model to identify asset information includes the following sub-steps:

[0090] Step 131: Obtain first asset identification information;

[0091] The process of obtaining the first asset identification information is the same as steps 121 to 124 in the multimodal model training and is not limited here. The obtained complete asset information is used as the first asset identification information.

[0092] Step 132: Perform interaction detection on the Web assets, extract vectors from the detection results, and deliver them to the asset interaction behavior model for identification to obtain second asset identification information;

[0093] Step 133: extract the asset homepage interface layout information to generate a vector, and deliver it to the asset interface layout model for identification to obtain the third asset identification information;

[0094] Step 134: Generate a vector from the home page image and deliver it to the interface image model for identification to obtain fourth asset identification information;

[0095] Step 135: Integrate the above four sets of asset identification information to obtain the final asset identification information, set a decision algorithm based on the attributes of the asset identification information, and perform asset identification determination based on the decision algorithm.

[0096] Four sets of asset identification information attributes, specifically:

[0097] First asset identification information: The data comes from the interface code and display information, and is highly reliable. However, it cannot identify OEM scenarios or products that actively modify banners.

[0098] Second asset identification information: Data comes from the interactive behavior model and is highly credible. It can be used to identify Web servers (to make up for the problem of being unable to identify due to active banner modification) and to distinguish OEM products.

[0099] Third asset identification information: The data comes from the interface layout model, which is highly reliable and can be used to identify OEM products.

[0100] Fourth asset identification information: The data comes from the interface picture model, which is highly reliable and can be used to identify OEM products.

[0101] Because these four sets of asset information may be conflicting and inconsistent, an algorithm needs to be designed to make selection decisions. The algorithm design is as follows:

[0102] Based on the first asset identification information, the Web server information in the second asset identification information is used to replace the corresponding fields in the first asset identification information; the equipment manufacturer information, application system information, and software version information in the second, third, and fourth asset identification information are mainly used to identify OEM scenarios. If two of the three are consistent, the original manufacturer, software, and version corresponding to the product are indicated. This information will be used for subsequent vulnerability matching and other business processing.

[0103] Embodiment 2

[0104] like Figure 3 As shown, the second embodiment of the present invention provides a multi-modal based Web asset identification device, including:

[0105] The asset information acquisition module 31 is used to acquire multimodal Web asset information, including scanning Web assets to extract server information, collecting Web behavior features, and extracting Web homepage information;

[0106] A multimodal model building module 32, used to build a multimodal model of assets based on multimodal Web asset information, including a machine classification and discrimination model for identifying interface layout, a machine classification and discrimination model for identifying interface images, and an interactive behavior model for identifying interactive behaviors;

[0107] The asset information identification module 33 is used to apply a multimodal model to identify different types of asset information.

[0108] Corresponding to the above embodiment, an embodiment of the present invention provides a computer storage medium, including: at least one memory and at least one processor;

[0109] The memory is used to store one or more program instructions;

[0110] The processor is used to run one or more program instructions to execute a multi-modal based Web asset identification method.

[0111] Corresponding to the above embodiment, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer storage medium includes one or more program instructions, and the one or more program instructions are used for a processor to execute a multi-modal based Web asset identification method.

[0112] The embodiment disclosed in the present invention provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed on a computer, the computer executes the above-mentioned multimodal-based Web asset identification method.

[0113] In the embodiment of the present invention, the processor may be an integrated circuit chip having the ability to process signals. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0114] The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware.

[0115] The storage medium may be a memory, which may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.

[0116] Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.

[0117] The volatile memory may be a random access memory (RAM) which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDRSDRAM), enhanced synchronous DRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus DRAM (DRRAM).

[0118] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0119] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention can be implemented using a combination of hardware and software. When software is used, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that can be accessed by general or special-purpose computers.

[0120] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multimodal Web asset identification method, characterized in that: include: Obtain multimodal web asset information, including scanning web assets to extract server information, collecting web behavior features, and extracting web homepage information; Based on multimodal Web asset information, a multimodal model of assets is established, including a machine classification and discrimination model for identifying interface layout, a machine classification and discrimination model for identifying interface images, and an interactive behavior model for identifying interactive behaviors; Apply multimodal models to identify different types of asset information.

2. A multimodal Web asset identification method as claimed in claim 1, characterized in that: Scan web assets to extract server information, specifically, a text message containing server information sent to the client when the server responds to a client request, including the server name, version number, operating system, and supported protocols.

3. A multimodal Web asset identification method as claimed in claim 1, characterized in that: Web behavior characteristics include: HTTP protocol level interaction behavior and application level interaction behavior; HTTP protocol level interaction behaviors include: ① sending correct basic HTTP requests; ② sending requests that are not allowed; ③ sending illegal versions of HTTP requests; ④ sending HTTP requests with incorrect specifications; Application-level interaction behaviors include: ① accessing a random URL address of the server; ② inputting extremely long, extremely short, or commonly illegal characters; ③ random account and password login verification behaviors.

4. A multimodal Web asset identification method as claimed in claim 1, characterized in that: Web home page information includes Web home page pictures, OCR recognized text and logo information.

5. The multimodal Web asset identification method according to claim 1, characterized in that: Building a multimodal model of assets includes the following sub-steps: Extract key information from the server information, discard invalid data, and form the first asset information; summarize the key data extracted from the OCR recognized text to form the second asset information; extract the Logo image content from the Web homepage image to generate the third asset information; integrate the above three asset information into complete asset information; Summarize the classification and result data of interactive behaviors to form asset interactive behavior features, generate feature vectors for asset interactive behavior features, learn modeling, and perform manual annotation to form an interactive behavior model for identifying interactive behaviors; Extract home page image information, generate interface layout feature vectors, conduct learning modeling and labeling of interface layout features, use integrated complete asset information as labels, and form a machine classification and discrimination model for identifying interface layout; A neural network classification model is built for the home page pictures, and the pictures are labeled. The previously integrated asset information is directly used as labels to form a machine classification and discrimination model for identifying interface pictures.

6. A multimodal Web asset identification method as claimed in claim 5, characterized in that: Applying multimodal models to identify asset information includes the following sub-steps: The first asset information, the second asset information and the third asset information are obtained and summarized as the first asset identification information; the Web asset is interactively detected, a vector is extracted from the detection result, and the vector is delivered to the interactive behavior model for judgment to obtain the second asset identification information; The asset homepage interface layout information is extracted to generate a vector, which is delivered to a machine classification and discrimination model for identifying the interface layout to obtain the third asset identification information. The homepage image is generated into a vector, which is delivered to a machine classification and discrimination model for identifying the interface image to obtain the fourth asset identification information. The above four sets of asset identification information are integrated to obtain the final asset identification information.

7. A multimodal Web asset identification method as claimed in claim 6, characterized in that: Based on the attributes of asset identification information, a decision algorithm is set, and asset identification is determined according to the decision algorithm.

8. A multimodal Web asset identification device, characterized in that: include: The asset information acquisition module is used to obtain multimodal Web asset information, including scanning Web assets to extract server information, collecting Web behavior features, and extracting Web homepage information; A multimodal model building module is used to build a multimodal model of assets based on multimodal Web asset information, including a machine classification and discrimination model for identifying interface layout, a machine classification and discrimination model for identifying interface images, and an interactive behavior model for identifying interactive behaviors; The asset information identification module is used to apply multimodal models to identify different types of asset information.

9. A computer storage medium, characterized in that: include: at least one memory and at least one processor; The memory is used to store one or more program instructions; A processor is used to run one or more program instructions to execute a multimodal based Web asset identification method as described in any one of claims 1 to 7.

Images