Asset surveying and mapping method and device suitable for rail transit comprehensive monitoring system

Abstract

The embodiment of the invention discloses an asset surveying and mapping method and device suitable for a rail transit comprehensive monitoring system. The method comprises the following steps: acquiring flow data from a network of the rail transit comprehensive monitoring system through a mirror image flow technology; analyzing the flow data to obtain network information of assets; and performing active scanning and asset information identification of assets according to the network information, and outputting the asset information. By means of the mode, more comprehensive and rich data can be obtained without disturbance, network fluctuation is reduced, and blind whole-network-segment and whole-port scanning is avoided.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of asset management technology, and specifically to an asset mapping method and device suitable for a rail transit integrated monitoring system. Background Art

[0002] With the continuous advancement of urbanization, rail transit has become an important part of modern urban transportation. However, the operation management and safety assurance of rail transit face many challenges. How to improve operational efficiency and ensure traffic safety has become an important issue facing urban rail transit projects. The widespread application of rail transit integrated monitoring system has opened a door for urban rail transit projects. Rail transit integrated monitoring system refers to the unified collection, processing and management of various monitoring data through computer technology, communication technology, sensor technology and other technical means to provide decision makers with real, detailed and accurate information. In urban rail transit projects, rail transit integrated monitoring system mainly covers ticket management, train operation management, platform management, equipment management, security management and other aspects.

[0003] In the rail transit integrated monitoring system, since there are many devices connected to the monitored system and the communication protocols used by the devices are also diverse, it is difficult to manually discover and manage the detailed intelligence of all devices. How to discover asset information in the network environment with low interference, quickly and accurately becomes the key to the asset mapping function.

[0004] The traditional method is to scan all ports and all IP addresses in the entire network space, which results in a large amount of network resources being occupied and the equipment cannot operate normally. At the same time, due to the low processing performance of some industrial equipment in the integrated monitoring network, the large number of detection messages in the traditional method will cause the downtime and jamming of related equipment. Summary of the invention

[0005] In view of the above problems, an embodiment of the present invention provides an asset mapping method and device applicable to a rail transit integrated monitoring system, which overcomes the above problems or at least partially solves the above problems.

[0006] According to one aspect of an embodiment of the present invention, there is provided an asset mapping method applicable to a rail transit integrated monitoring system, the method comprising: obtaining flow data from the network of the rail transit integrated monitoring system by means of mirror flow technology; parsing the flow data to obtain network information of assets; actively scanning assets and identifying asset information according to the network information, and outputting the asset information.

[0007] Optionally, the obtaining of flow data from the network of the rail transit integrated monitoring system by using the mirrored flow technology includes: mirroring the flow in the network of the rail transit integrated monitoring system by using a flow audit engine to obtain the flow data.

[0008] Optionally, parsing the traffic data to obtain network information of the asset includes: parsing traffic packets in the traffic data to directly obtain asset information therefrom, and identifying network information of the asset to obtain the network information of the asset.

[0009] In an optional manner, the network information includes an IP address and port information, and the active scanning of assets and asset information identification based on the network information, and output of the asset information, include: actively scanning assets based on the IP address and the port information to obtain accurate asset information; performing asset identification on the asset information, and updating the asset fingerprint map.

[0010] Optionally, the asset information includes but is not limited to manufacturer, model, IP address, Mac address, and operating system.

[0011] Optionally, the asset identification of the asset information includes: using the Mac address to query the IP address through an arp request; if the queried IP address is consistent with the IP address in the asset information, the SN information identifier is recorded as 1; if the queried IP address is inconsistent with the IP address in the asset information, the SN information identifier is recorded as 0; if no returned IP address is received, the SN information identifier is recorded as uncertain.

[0012] Optionally, the updating of the asset fingerprint map includes: forming an asset fingerprint based on the acquired asset information; comparing the formed asset fingerprint with the asset fingerprint map in the asset type library; if there is an unregistered asset fingerprint in the asset fingerprint map, updating the asset fingerprint map.

[0013] Based on the same inventive concept, an asset mapping device suitable for a rail transit integrated monitoring system is provided, comprising: a data acquisition unit, used to acquire flow data from the network of the rail transit integrated monitoring system through mirror flow technology; an information parsing unit, used to parse the flow data to acquire network information of assets; an asset mapping unit, used to actively scan assets and identify asset information based on the network information, and output asset information.

[0014] Based on the same inventive concept, an embodiment of the present invention further proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method when executing the program.

[0015] Based on the same inventive concept, an embodiment of the present invention further proposes a computer storage medium, in which at least one executable instruction is stored, and the executable instruction enables a processor to execute the aforementioned method.

[0016] The embodiment of the present invention obtains flow data from the network of the rail transit integrated monitoring system through the mirror flow technology; parses the flow data to obtain network information of assets; actively scans assets and identifies asset information based on the network information, and outputs the asset information, thereby being able to obtain more comprehensive and rich data without disturbance, reduce network fluctuations, and avoid blind scanning of the entire network segment and all ports.

[0017] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0019] Figure 1 A schematic flow chart of an asset mapping method applicable to a rail transit integrated monitoring system provided by an embodiment of the present invention is shown;

[0020] Figure 2 A schematic diagram of the structure of an asset surveying and mapping device applicable to a rail transit integrated monitoring system provided by an embodiment of the present invention is shown;

[0021] Figure 3 A schematic diagram of an electronic device in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0022] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0023] Figure 1 FIG. 1 is a flow chart showing an asset mapping method applicable to a rail transit integrated monitoring system provided by an embodiment of the present invention. Figure 1 As shown, the asset mapping method applicable to the rail transit integrated monitoring system is applied to the server, including:

[0024] Step S11: Obtaining flow data from the network of the rail transit integrated monitoring system through the mirror flow technology.

[0025] Network traffic refers to the data content transmitted by devices in the environment through the network. The bypass monitoring device (TAA) can copy and analyze these traffic flows. The copied traffic flow without affecting normal network communication is called mirror traffic. In an embodiment of the present invention, optionally, the traffic flow in the network of the rail transit integrated monitoring system is mirrored by the traffic audit engine (TAA) to obtain traffic data.

[0026] Step S12: parse the traffic data to obtain network information of the asset.

[0027] In step S12, the flow packets in the flow data are parsed to directly obtain asset information, and the network information of the asset is identified to obtain the network information of the asset. The network information includes but is not limited to IP address and port information.

[0028] Step S13: Actively scan assets and identify asset information based on the network information, and output the asset information.

[0029] In the embodiment of the present invention, optionally, the asset is actively scanned according to the IP address and the port information to obtain accurate asset information; the asset information is identified and the asset fingerprint is updated, which can reduce network fluctuations, avoid blind scanning of the entire network segment and all ports, and obtain more comprehensive and rich data without disturbance. Among them, the asset information includes but is not limited to information such as manufacturer, model, port, IP address, Mac address, operating system, protocol, etc.

[0030] The asset information is organized in JSON format. The asset information format is IP+Mac unique identification. Because there may be protocol data without IP in the network, an asset object uses IP+Mac as a unique identification, for example, "1.1.1.1+00:11:22:33:44:55", "+" is a separator. When there is no IP or Mac, the left or right side of the separator is empty, such as "1.1.1.1+", "+00:11:22:33:44:55".

[0031] When performing active scanning, you can query the port and / or IP through SNMP to obtain asset information; you can also actively request the port and / or IP to obtain asset information. Specifically, you can first query the port and / or IP through SNMP to obtain asset information. If the corresponding asset information is not found, send an active request to the port and / or IP to obtain asset information.

[0032] There may be devices that forward Mac addresses in the network environment, so the Mac address and IP address in the traffic packet may not be truly corresponding. In an embodiment of the present invention, an SN information identifier can be introduced to identify the relationship: 0 indicates an unreal correspondence, 1 indicates a true correspondence, and 2 indicates uncertainty. After the server receives the asset information uploaded by the port, it may edit the IP address and Mac address in the asset information, so that the upper and lower data cannot be unified, so a special SN information identifier is set. The information identifier is generated and issued by the server to identify the asset. Optionally, the Address Resolution Protocol (arp) is used to request the use of the Mac address to query the IP address; if the queried IP address is consistent with the IP address in the asset information, the SN information identifier is recorded as 1; if the queried IP address is inconsistent with the IP address in the asset information, the SN information identifier is recorded as 0; if the returned IP address is not received, the SN information identifier is recorded as uncertain. In this way, the embodiment of the present invention can effectively determine whether there is false information.

[0033] After asset identification is performed on the asset information, an asset fingerprint is formed according to the acquired asset information; the formed asset fingerprint is compared with the asset fingerprint map in the asset type library; if there is an unregistered asset fingerprint in the asset fingerprint map, the asset fingerprint map is updated. The embodiment of the present invention adopts the deep analysis technology of mirror traffic, and simultaneously adopts a combination of active and passive methods to perform asset scanning. Through passive analysis, the IP node and open port information of the network space are improved, and then these information are sent to the active scanning module. The active scanning module performs targeted scanning according to the IP and port, avoiding blind scanning of the entire network space IP segment and full port scanning. At the same time, the asset active scanning technology is deeply applied to the application layer, and the asset fingerprints of many manufacturers and equipment models are deeply accumulated. When performing active scanning, the detection message for obtaining the manufacturer, model, and version information is accurately sent, and no other irrelevant scanning actions are performed to reduce the impact on the rail transit integrated monitoring system, and the accuracy can be guaranteed. Each time an active scan is performed, a comparison of the asset fingerprint map is performed. If there is an unregistered fingerprint in the map, the asset fingerprint map is updated.

[0034] Currently, asset fingerprints of multiple general and special industrial products and multiple industrial communication protocols have been accumulated. Therefore, compared with other traditional methods, the asset mapping method for rail transit integrated monitoring system in the embodiment of the present invention can obtain more comprehensive and rich data without disturbance, better understand and identify all devices, applications and their operating status, and is more suitable for asset mapping of specific large networks. For example: asset mapping in the subway integrated monitoring system network.

[0035] The asset mapping method applicable to the rail transit integrated monitoring system of the embodiment of the present invention can quickly identify network assets without causing major fluctuations in the network environment, allowing users to quickly obtain all assets in the entire network, classify and save the scanned relevant asset information, produce complete equipment asset information, and format and output it to facilitate related management.

[0036] To sum up, the asset mapping method applicable to the rail transit integrated monitoring system of the embodiment of the present invention obtains flow data from the network of the rail transit integrated monitoring system through the mirror flow technology; parses the flow data to obtain the network information of the asset; actively scans the asset and identifies the asset information according to the network information, and outputs the asset information, so as to obtain more comprehensive and rich data without disturbance, reduce network fluctuations, and avoid blind scanning of the entire network segment and all ports.

[0037] The above specific embodiments of the present invention are described. In some cases, the actions or steps recorded in the embodiments of the present invention can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0038] Based on the same concept, the embodiment of the present invention also provides an asset mapping device suitable for a rail transit integrated monitoring system. Applied to a server. Figure 2 As shown, the asset mapping device applicable to the rail transit integrated monitoring system includes: a data acquisition unit, an information analysis unit and an asset mapping unit.

[0039] A data acquisition unit, used to acquire flow data from the network of the rail transit integrated monitoring system through mirror flow technology;

[0040] An information parsing unit, used to parse the traffic data and obtain network information of the asset;

[0041] The asset mapping unit is used to actively scan assets and identify asset information based on the network information, and output the asset information.

[0042] For the convenience of description, the above device is described as various modules according to their functions. Of course, when implementing the embodiment of the present invention, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0043] The device of the above embodiment is applied to the corresponding method in the above embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0044] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in any one of the above embodiments is implemented.

[0045] An embodiment of the present invention provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the method described in any of the above embodiments.

[0046] Figure 3 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 301, a memory 302, an input / output interface 303, a communication interface 304, and a bus 305. The processor 301, the memory 302, the input / output interface 303, and the communication interface 304 are connected to each other in communication within the device through the bus 305.

[0047] The processor 301 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solution provided by the method embodiment of the present invention.

[0048] The memory 302 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 302 can store an operating system and other application programs. When the technical solution provided by the method embodiment of the present invention is implemented by software or firmware, the relevant program code is stored in the memory 302 and called and executed by the processor 301.

[0049] The input / output interface 303 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0050] The communication interface 304 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0051] The bus 305 comprises a pathway for transmitting information between the various components of the device (eg, the processor 301 , the memory 302 , the input / output interface 303 , and the communication interface 304 ).

[0052] It should be noted that, although the above device only shows the processor 301, the memory 302, the input / output interface 303, the communication interface 304 and the bus 305, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present invention, and does not necessarily include all the components shown in the figure.

[0053] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0054] This application is intended to cover all such substitutions, modifications and variations that fall within the broad scope of all embodiments. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the scope of protection of this disclosure.

Claims

1. An asset mapping method suitable for a rail transit integrated monitoring system, characterized in that: The asset mapping method comprises: Obtain traffic data from the rail transit integrated monitoring system network through mirror traffic technology; Parsing the traffic data to obtain network information of the asset; Active asset scanning and asset information identification are performed based on the network information, and the asset information is output.

2. The method according to claim 1, characterized in that The method of obtaining flow data from the network of the rail transit integrated monitoring system by using the mirror flow technology includes: The traffic audit engine is used to mirror the traffic in the rail transit integrated monitoring system network and obtain traffic data.

3. The method according to claim 1, characterized in that The parsing of the traffic data to obtain network information of the asset includes: The traffic packets in the traffic data are parsed to directly obtain asset information therefrom, and network information of the assets is identified to obtain network information of the assets.

4. The method according to claim 1, characterized in that: The network information includes IP addresses and port information, and the active asset scanning and asset information identification are performed according to the network information, and the asset information is output, including: Actively scan the assets according to the IP address and the port information to obtain accurate asset information; Perform asset identification on the asset information and update the asset fingerprint map.

5. The method according to any one of claims 1 to 4, characterized in that The asset information includes but is not limited to manufacturer, model, IP address, Mac address, and operating system.

6. The method according to claim 5, characterized in that The performing asset identification on the asset information includes: Using the Mac address to query the IP address via an arp request; If the queried IP address is consistent with the IP address in the asset information, the SN information identifier is recorded as 1; If the queried IP address is inconsistent with the IP address in the asset information, the SN information identifier is recorded as 0; If no returned IP address is received, the SN information is marked as uncertain.

7. The method according to claim 4, characterized in that The updating of the asset fingerprint map includes: Forming an asset fingerprint based on the acquired asset information; Compare the generated asset fingerprint with the asset fingerprint map in the asset type library; If there is an unregistered asset fingerprint in the asset fingerprint map, the asset fingerprint map is updated.

8. An asset mapping device suitable for a rail transit integrated monitoring system, characterized in that: The device comprises: A data acquisition unit, used to acquire flow data from the network of the rail transit integrated monitoring system through mirror flow technology; An information parsing unit, used to parse the traffic data and obtain network information of the asset; The asset mapping unit is used to actively scan assets and identify asset information based on the network information, and output the asset information.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A computer storage medium, characterized in that: The storage medium stores at least one executable instruction, and the executable instruction enables the processor to execute the method according to any one of claims 1 to 7.

Images