Network asset surveying and mapping method, device, equipment and medium

Abstract

The invention relates to the technical field of network surveying and mapping, and discloses a network asset surveying and mapping method, device and equipment and a medium, and the method comprises the steps: capturing data traffic in network communication through employing a traffic probe; analyzing the captured data traffic, and extracting network asset feature information; storing the network asset feature information in a graph database in a graph form; the graph database is used for representing association and dependency relationships between network assets; and surveying and mapping the network assets by using the graph database. Therefore, the data traffic in network communication is captured by adopting the traffic probe, the network asset characteristic information obtained from the data traffic is stored in the graph database, the importance of asset association is realized through the graph relationship, the complex association and connection between assets are clearly displayed, the dependency relationship between the assets is emphasized, and the network asset association accuracy is improved. Network assets of organizations or entities can be efficiently and accurately mapped, and comprehensive network asset management and safety guarantee are provided for network administrators.

Description

Technical Field

[0001] The present invention relates to the technical field of network mapping, and in particular to a network asset mapping method, device, equipment and medium. Background Art

[0002] In today's network environment, there are a large number of servers, visitors, and complex network topologies. Even if users build their own network environment, it is difficult to map the complete network asset situation and the access relationship between assets. If this situation continues, if attackers obtain assets that users have not paid attention to, and the assets can directly communicate with core assets, it will cause serious consequences. For example, a university has many network assets, including student machines, computer room machines, school servers, switches, domain names, various cloud server Internet Protocols (IP), etc. For such a large organization, it is difficult for the organization to fully and clearly know most of the assets of the self-organizing organization.

[0003] It can be seen that providing a method for accurately mapping network assets is a technical problem that people in this field urgently need to solve. Summary of the invention

[0004] The purpose of the present invention is to provide a network asset mapping method, device, equipment and medium, which can efficiently and accurately map the network assets of an organization or entity, and provide comprehensive network asset management and security for network administrators.

[0005] In order to solve the above technical problems, the present invention provides a network asset mapping method, the method comprising:

[0006] Use traffic probes to capture data traffic in network communications;

[0007] Analyze the captured data traffic to extract network asset feature information;

[0008] The network asset feature information is stored in a graph database in the form of a graph; the graph database is used to characterize the association and dependency relationship between network assets;

[0009] The graph database is used to map network assets.

[0010] In a first aspect, in the network asset mapping method provided by the present invention, the captured data traffic is analyzed to extract network asset feature information, including:

[0011] Analyze the flow direction of the captured data flow, and obtain the flow belonging to the network asset according to the analysis result;

[0012] Feature extraction is performed on the acquired traffic belonging to the network assets to obtain network asset feature information.

[0013] On the other hand, in the network asset mapping method provided by the present invention, while extracting the network asset feature information, it also includes:

[0014] Define suspected attackers;

[0015] Extracting features of the suspected attacker to obtain the attack path and confidence level of the suspected attacker;

[0016] Accordingly, while storing the network asset feature information in the form of a graph in a graph database, it also includes:

[0017] The attack path and confidence level of the suspected attacker are stored in a graph database in the form of a graph.

[0018] On the other hand, in the network asset mapping method provided by the present invention, the network asset feature information is stored in a graph database in the form of a graph, including:

[0019] Classifying the network asset feature information by device to obtain network asset feature data corresponding to different devices;

[0020] Each device is used as a node in the graph in the graph database, and the connection relationship between devices is used as an edge, so that the graph database stores network asset feature data corresponding to different devices.

[0021] On the other hand, in the network asset mapping method provided by the present invention, the network asset feature information is stored in a graph database in the form of a graph, and further includes:

[0022] Performing behavior classification on the network asset characteristic information to obtain network asset characteristic data corresponding to different asset behaviors;

[0023] Each asset behavior is used as a node in the graph in the graph database, and the connection relationship between asset behaviors is used as an edge, so that the graph database stores network asset feature data corresponding to different asset behaviors.

[0024] On the other hand, in the network asset mapping method provided by the present invention, the network asset mapping is performed using the graph database, including:

[0025] Utilizing the graph structure of the graph database, obtaining network asset information, as well as associations and dependencies between network assets through a query language;

[0026] Based on the acquired network asset information, as well as the associations and dependencies between network assets, a network topology map containing a portrait of the network assets is obtained through mapping.

[0027] On the other hand, in the above network asset mapping method provided by the present invention, it also includes:

[0028] Based on the network topology map obtained through surveying and mapping, determine whether the network asset profile is complete;

[0029] If the network asset profile is incomplete, redeploy the traffic probe;

[0030] If the network asset portrait is complete, it is determined that the mapping of the network assets has been completed.

[0031] In order to solve the above technical problems, the present invention further provides a network asset mapping device, the device comprising:

[0032] A traffic capture module, used to capture data traffic in network communication using a traffic probe;

[0033] A feature extraction module, used to analyze the captured data traffic and extract network asset feature information;

[0034] An information storage module, used to store the network asset feature information in the form of a graph in a graph database; the graph database is used to characterize the association and dependency relationship between network assets;

[0035] The asset mapping module is used to map network assets using the graph database.

[0036] In order to solve the above technical problems, the present invention further provides a network asset mapping device, the device comprising:

[0037] Memory for storing computer programs;

[0038] The processor is used to implement the steps of the above-mentioned network asset mapping method when executing the computer program.

[0039] In order to solve the above technical problem, the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above network asset mapping method are implemented.

[0040] It can be seen from the above technical scheme that the present invention provides a network asset mapping method, which includes: using a traffic probe to capture data traffic in network communications; analyzing the captured data traffic to extract network asset feature information; storing the network asset feature information in the form of a graph in a graph database; the graph database is used to characterize the association and dependency relationship between network assets; and using the graph database to map network assets.

[0041] The beneficial effect of the present invention is that the above-mentioned network asset mapping method provided by the present invention deploys a flow probe in the network, uses the flow probe to capture the data flow in the network communication, obtains the network asset characteristic information from the data flow, stores the network asset characteristic information based on the graph database, and uses the query and association characteristics of the graph database to provide a more intuitive asset mapping, so that the asset information is stored in the form of a graph, and the importance of associating assets through graphical relationships can be efficiently and accurately mapped. The network assets of an organization or entity can provide comprehensive network asset management and security for network administrators. In addition, the present invention can clearly display the complex associations and connections between assets, emphasize the dependencies between assets, enhance the visualization of asset relationships, and help network administrators better understand network topology and relationships.

[0042] In addition, the present invention also provides a corresponding network asset mapping device, a network asset mapping equipment and a computer-readable storage medium for the network asset mapping method, which have the same or corresponding technical features as the above-mentioned network asset mapping method and have the same effects as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A flowchart of a network asset mapping method provided by an embodiment of the present invention;

[0045] Figure 2 A schematic diagram of the structure of a network asset mapping device provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of the structure of a network asset mapping device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The core of the present invention is to provide a network asset mapping method, device, equipment and medium to solve the technical problem that it is difficult to map network assets in the current network environment.

[0049] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 A flowchart of a network asset mapping method provided by an embodiment of the present invention, such as Figure 1 As shown, the method includes:

[0050] S101. Use a traffic probe to capture data traffic in network communications.

[0051] It should be noted that a traffic probe is a device or software used to monitor, analyze and record network traffic. The present invention deploys a traffic probe in the network, which can monitor network communications and obtain data packets in network communications, that is, capture data traffic in network communications, including communications of all devices, so that administrators, security experts or network analysts can understand the network usage, performance, security status and other relevant information.

[0052] S102: Analyze the captured data traffic and extract network asset feature information.

[0053] It is understandable that network assets can include physical devices (such as servers, routers, switches), virtual instances (such as virtual machines, containers), applications, databases, data files, various cloud servers, a certain IP or a port of a certain IP, domain name, Uniform Resource Locator (URL), etc. Data flow analysis refers to the monitoring, analysis and interpretation of network data traffic, which helps to identify the main assets and communication patterns in the network.

[0054] After the present invention uses a flow probe to capture data flow in network communication, the data flow can be analyzed to extract network asset feature information; wherein, the data flow can be cleaned to clean out the features of the network assets, which can include information such as IP addresses, port numbers, communication protocols, etc., related to devices, applications, communication modes, etc. These features can be used to identify devices and understand their behavior.

[0055] S103. Store the network asset feature information in a graph database in the form of a graph; the graph database is used to represent the association and dependency relationship between network assets.

[0056] It should be noted that a graph database is a type of database used to store and query graph structured data. In the graph database of the present invention, data is organized in the form of a graph, which consists of nodes (vertices) and edges (edges) connecting the nodes. Nodes can represent entities, while edges represent the relationship between entities. This data model can naturally represent and process complex associations, such as social networks, knowledge graphs, geographic information systems, recommendation systems, and network assets. That is, after storing network asset feature information in the graph database, the network asset feature information changes from independent to clustered and clumped. The graph database of the present invention can be created by data modeling, and the data modeling method can include feature modeling, rule modeling, object modeling, etc.

[0057] The present invention can store the network asset features extracted in step S102 in the form of a graph in a graph database, and the graph structure of the graph database can intuitively represent the association and dependency between network assets, thereby enhancing the visualization and understanding of asset relationships. The present invention can discover relationships and patterns hidden in the network through the graph analysis capability of the graph database, which enables administrators to more easily identify potential security threats and risks.

[0058] S104. Use the graph database to map network assets.

[0059] In the above-mentioned network asset mapping method provided by the embodiment of the present invention, a traffic probe is deployed in the network, and the traffic probe is used to capture the data traffic in the network communication, and the network asset feature information is obtained from the data traffic. The network asset feature information is stored based on the graph database, and the query and association characteristics of the graph database are used to provide a more intuitive asset mapping, so that the asset information is stored in the form of a graph, and the importance of asset association through graphical relationships can be efficiently and accurately mapped. The network assets of the organization or entity can provide comprehensive network asset management and security for network administrators. In addition, the present invention can clearly display the complex associations and connections between assets, emphasize the dependencies between assets, enhance the visualization of asset relationships, and help network administrators better understand network topology and relationships.

[0060] Furthermore, in a specific implementation, in the above-mentioned network asset mapping method provided in an embodiment of the present invention, step S102 analyzes the captured data traffic and extracts network asset characteristic information, which may specifically include: analyzing the traffic direction of the captured data traffic, and obtaining the traffic belonging to the network assets based on the analysis results; and performing feature extraction on the obtained traffic belonging to the network assets to obtain network asset characteristic information.

[0061] In practice, the direction of traffic exists in the traffic data. By judging the traffic direction of the captured data traffic, it is possible to determine which are network assets. The traffic determined to belong to network assets is subjected to feature recognition to extract network asset feature information. Feature recognition refers to extracting meaningful features from data for further analysis and processing. In the network, feature recognition can be used to identify features such as devices, applications, and communication patterns. These features can help classify, label, and organize network assets, thereby achieving more accurate network asset mapping.

[0062] Taking the network of an organization as an example, the present invention can install flow probes at each network flow entrance and each network exit of the organization. The flow probe can extract characteristic information such as source IP, destination IP, source port, destination port, destination domain name, destination request parameters, destination request protocol, etc. in the network. The collected characteristic information is abstracted into a graph object, and the access relationship between the graph objects is obtained, for example, ip:10.1.1.10 accesses port 80 of the destination ip:222.22.11.11. It is parsed in the request that the destination domain name is www.test.cn. Then the entire path 10.1.1.10->www.test.com->>222.22.11.11 is stored. When enough data is collected, most of the network assets that are accessed by the organization are stored in the graph database. Based on this data, the nearly complete assets of the organization and the access relationship between assets can be mapped.

[0063] Furthermore, in a specific implementation, in the above-mentioned network asset mapping method provided in the embodiment of the present invention, while executing step S102 to extract network asset feature information, it can also include: defining suspected attackers; extracting features of suspected attackers to obtain the attack path and confidence level of the suspected attackers.

[0064] Accordingly, while storing the network asset feature information in the form of a graph in the graph database, it may also include: storing the attack path and confidence level of the suspected attacker in the form of a graph in the graph database.

[0065] In implementation, the present invention can obtain the access direction in the traffic data, in which the suspected attacker can be defined, and the attack path and confidence level of the suspected attacker can be cleaned out based on the characteristic rules, and stored in the graph database, so that the attack path and confidence level of the attacker can be more clearly described using the graph database. The present invention can store the attack path and confidence level of the suspected attacker and the network asset characteristic information in the form of a complete access link, which helps to improve the overall network security.

[0066] Assume that there is a machine with an IP of 222.22.11.12, which is not accessible to any other IP but only to 222.22.11.11. Then, when the machine 222.22.11.11 is maliciously controlled, through the construction of a graph database and asset mapping capabilities, it can be quickly found that the asset 222.22.11.12 is also at risk of being attacked.

[0067] Furthermore, in a specific implementation, in the above-mentioned network asset mapping method provided in an embodiment of the present invention, step S103 stores the network asset feature information in the form of a graph to a graph database, which may specifically include: classifying the network asset feature information into devices to obtain network asset feature data corresponding to different devices; treating each device as a node in the graph in the graph database, and treating the connection relationship between devices as an edge, so that the graph database stores the network asset feature data corresponding to different devices.

[0068] In implementation, the present invention can analyze data traffic and use machine learning and pattern recognition algorithms to extract network asset feature information from data traffic to identify and classify devices in the network. This helps to automatically identify devices and classify them into different types such as servers, routers, and workstations. By classifying network asset feature information, it is possible to understand information such as the communication mode between devices, the applications used, and the amount of data transmitted. Each device is regarded as a node in the graph, and the connection relationship between devices is regarded as an edge. The graph structure of the graph database can intuitively represent the association and dependency relationship between devices. This helps to identify the main assets and communication patterns in the network and improve the classification accuracy.

[0069] Furthermore, in a specific implementation, in the above-mentioned network asset mapping method provided in an embodiment of the present invention, the network asset feature information is stored in a graph database in the form of a graph, and also includes: classifying the network asset feature information by behavior to obtain network asset feature data corresponding to different asset behaviors; taking each asset behavior as a node in the graph in the graph database, and the connection relationship between the asset behaviors as an edge, so that the graph database stores the network asset feature data corresponding to different asset behaviors.

[0070] In implementation, in addition to classifying devices, the present invention can also classify asset behaviors. Each asset behavior is taken as a node in the graph database, and the connection relationship between asset behaviors is taken as an edge. The graph structure of the graph database can intuitively represent the association and dependency between asset behaviors. In order to further facilitate network mapping, the present invention can also classify asset features, classify the association relationship between assets, classify the attack path of suspected attackers, etc., which will not be elaborated here.

[0071] Furthermore, in a specific implementation, in the above-mentioned network asset mapping method provided in an embodiment of the present invention, step S104 utilizes a graph database to map network assets, which may specifically include: utilizing the graph structure of the graph database to obtain network asset information, as well as the associations and dependencies between network assets through a query language; based on the obtained network asset information, as well as the associations and dependencies between network assets, mapping a network topology map containing a network asset portrait.

[0072] In practice, network topology refers to the physical or logical arrangement of devices and connections in a computer network. A network topology diagram can intuitively display the connection between various devices in the network (such as computers, servers, routers, switches, etc.), and how they communicate and exchange data with each other in the network. It can also intuitively display the behavior of various assets in the network, access relationships, and the subordination of asset features. The network topology determines the flow mode and path of data in the network. The present invention can quickly query network asset information, as well as the associations and dependencies between network assets through the query language of the graph database, such as the Graph Query Language (GQL). In this way, the query language of the graph database can efficiently perform complex queries, quickly obtain asset information and associations, improve query efficiency, and meet the administrator's query needs for asset information in a more efficient manner.

[0073] Furthermore, in a specific implementation, the above-mentioned network asset mapping method provided in the embodiment of the present invention may also include: judging whether the network asset portrait is complete based on the network topology map obtained by mapping; if the network asset portrait is incomplete, redeploying the traffic probe; if the network asset portrait is complete, determining that the mapping of the network assets has been completed.

[0074] In implementation, in order to ensure efficient and accurate deployment of traffic probes, the present invention can obtain a network topology map drawn by deploying probes to determine whether the asset portrait is complete, thereby determining whether the deployment location is accurate.

[0075] In the above embodiments, the network asset mapping method is described in detail, and the present invention also provides embodiments of a network asset mapping device and a network asset mapping equipment. It should be noted that the present invention describes the embodiments of the device part from two perspectives, one is based on the functional module perspective, and the other is based on the hardware perspective.

[0076] Figure 2 This is a schematic diagram of the structure of the network asset mapping device provided by an embodiment of the present invention. This embodiment is based on the perspective of functional modules, such as Figure 2 As shown, the device comprises:

[0077] The traffic capture module 10 is used to capture the data traffic in the network communication by using a traffic probe;

[0078] The feature extraction module 11 is used to analyze the captured data traffic and extract network asset feature information;

[0079] The information storage module 12 is used to store the network asset feature information in the form of a graph in a graph database; the graph database is used to represent the association and dependency relationship between network assets;

[0080] The asset mapping module 13 is used to map network assets using a graph database.

[0081] In the above-mentioned network asset mapping device provided by the embodiment of the present invention, through the interaction of the above-mentioned four modules, a traffic probe can be used to capture the data traffic in the network communication, obtain network asset feature information from the data traffic, store the network asset feature information based on the graph database, and use the query and association characteristics of the graph database to provide more intuitive asset mapping, so that the asset information is stored in the form of a graph, and the importance of asset association through graphical relationships can be used to efficiently and accurately map the network assets of organizations or entities, providing comprehensive network asset management and security for network administrators. In addition, the present invention can clearly display the complex associations and connections between assets, emphasize the dependencies between assets, enhance the visualization of asset relationships, and help network administrators better understand network topology and relationships.

[0082] Since the embodiments of the device part correspond to the embodiments of the method part, the embodiments of the device part refer to the description of the embodiments of the method part, which will not be described here. And it has the same beneficial effects as the above-mentioned network asset mapping method.

[0083] Figure 3 This is a schematic diagram of the structure of the network asset mapping device provided by the embodiment of the present invention. This embodiment is based on the hardware perspective, such as Figure 3 As shown, the network asset mapping equipment includes:

[0084] A memory 20, used for storing computer programs;

[0085] The processor 21 is used to implement the steps of the network asset mapping method mentioned in the above embodiment when executing the computer program.

[0086] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU; the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0087] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the network asset mapping method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include, but is not limited to, the data involved in the above-mentioned network asset mapping method, etc.

[0088] In some embodiments, the network asset mapping device may further include a display screen 22, an input / output interface 23, a communication interface 24, a power supply 25, and a communication bus 26. Those skilled in the art will appreciate that Figure 3 The structure shown in the figure does not constitute a limitation on the network asset mapping device, and may include more or fewer components than shown in the figure. The network asset mapping device provided by the embodiment of the present invention includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the network asset mapping method mentioned above, and the effect is the same as above.

[0089] Finally, the present invention also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0090] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and executes all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code. The computer-readable storage medium provided by the present invention can implement the above-mentioned network asset mapping method, and the effect is the same as above.

[0091] Finally, the present invention also provides an embodiment corresponding to a computer program product. The computer program product includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps described in the above network asset mapping method embodiment are implemented. The computer program product provided by the present invention can implement the above-mentioned network asset mapping method, and the effect is the same as above.

[0092] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0093] The network asset mapping method, device, equipment and medium provided by the present invention are introduced in detail above. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referenced to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A network asset mapping method, characterized in that: The method comprises: Use traffic probes to capture data traffic in network communications; Analyze the captured data traffic to extract network asset feature information; The network asset feature information is stored in a graph database in the form of a graph; the graph database is used to characterize the association and dependency relationship between network assets; The graph database is used to map network assets.

2. The network asset mapping method according to claim 1, characterized in that: Analyze the captured data traffic and extract network asset feature information, including: Analyze the flow direction of the captured data flow, and obtain the flow belonging to the network asset according to the analysis result; Feature extraction is performed on the acquired traffic belonging to the network assets to obtain network asset feature information.

3. The network asset mapping method according to claim 1, characterized in that: While extracting network asset feature information, it also includes: Define suspected attackers; Extracting features of the suspected attacker to obtain the attack path and confidence level of the suspected attacker; Accordingly, while storing the network asset feature information in the form of a graph in a graph database, it also includes: The attack path and confidence level of the suspected attacker are stored in a graph database in the form of a graph.

4. The network asset mapping method according to claim 1, characterized in that: Storing the network asset feature information in a graph database in the form of a graph includes: Classifying the network asset feature information by device to obtain network asset feature data corresponding to different devices; Each device is used as a node in the graph in the graph database, and the connection relationship between devices is used as an edge, so that the graph database stores network asset feature data corresponding to different devices.

5. The network asset mapping method according to claim 4, characterized in that: Storing the network asset feature information in a graph database in the form of a graph, further comprising: Performing behavior classification on the network asset characteristic information to obtain network asset characteristic data corresponding to different asset behaviors; Each asset behavior is used as a node in the graph in the graph database, and the connection relationship between asset behaviors is used as an edge, so that the graph database stores network asset feature data corresponding to different asset behaviors.

6. The network asset mapping method according to claim 1, characterized in that: The graph database is used to map network assets, including: Utilizing the graph structure of the graph database, obtaining network asset information, as well as associations and dependencies between network assets through a query language; Based on the acquired network asset information, as well as the associations and dependencies between network assets, a network topology map containing a portrait of the network assets is obtained through mapping.

7. The network asset mapping method according to claim 1, characterized in that: Also includes: Based on the network topology map obtained through surveying and mapping, determine whether the network asset profile is complete; If the network asset profile is incomplete, redeploy the traffic probe; If the network asset portrait is complete, it is determined that the mapping of the network assets has been completed.

8. A network asset mapping device, characterized in that: The device comprises: A traffic capture module, used to capture data traffic in network communication using a traffic probe; A feature extraction module, used to analyze the captured data traffic and extract network asset feature information; An information storage module, used to store the network asset feature information in the form of a graph in a graph database; the graph database is used to characterize the association and dependency relationship between network assets; The asset mapping module is used to map network assets using the graph database.

9. A network asset mapping device, characterized in that: The device comprises: Memory for storing computer programs; A processor, configured to implement the steps of the network asset mapping method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the network asset mapping method according to any one of claims 1 to 7 are implemented.

Images