Asset portrait generation method and device, equipment and storage medium

Abstract

The invention discloses an asset portrait generation method and device, equipment and a storage medium, and belongs to the field of asset management. The method comprises the following steps: acquiring attribute data and risk data of computer assets of at least one organization structure from a plurality of data sources; the attribute data is used for describing features of the computer assets, and the risk data is used for describing security risks of the computer assets; constructing or updating an asset portrait of the computer asset according to the attribute data, wherein the asset portrait is used for describing the attribute data of at least one computer device owned by the organizational structure; and constructing or updating risk mapping of the asset portrait according to the risk data, wherein the risk mapping is used for describing the security risk of at least one computer device owned by the organizational structure. According to the method and the device, the attribute data and the risk data of the computer assets are acquired from the plurality of data sources, so that relatively comprehensive asset portraits and risk mapping are formed.

Description

Technical Field

[0001] The present application relates to the field of asset management, and in particular to a method, device, equipment and storage medium for generating an asset portrait. Background Art

[0002] With the acceleration of enterprise digital transformation, the number of computer assets is growing rapidly. It is an important technology to integrate computer assets and form asset portraits and risk mapping.

[0003] In related technologies, enterprises generally input computer asset information by manual sorting, identify computer assets, and form asset portraits for display.

[0004] However, the manual combing method has poor real-time performance, making it difficult to grasp computer assets from multiple data sources in a short period of time, and it is impossible to associate computer assets with security risks. Summary of the invention

[0005] The embodiment of the present application provides a method, device, equipment and storage medium for generating an asset portrait. The technical solution is as follows:

[0006] On the one hand, an embodiment of the present application provides a method for generating an asset portrait, the method comprising:

[0007] Acquire attribute data and risk data of computer assets of at least one organizational structure from multiple data sources; the attribute data is used to describe the characteristics of the computer assets, and the risk data is used to describe the security risks existing in the computer assets;

[0008] Building or updating an asset profile of the computer asset according to the attribute data, the asset profile being used to describe attribute data of at least one computer device owned by the organizational structure;

[0009] A risk map of the asset portrait is constructed or updated based on the risk data, where the risk map is used to describe the security risk of at least one computer device owned by the organizational structure.

[0010] In another aspect, an embodiment of the present application provides a device for generating an asset portrait, the device comprising: an acquisition module and a description module;

[0011] The acquisition module is configured to acquire attribute data and risk data of computer assets of at least one organizational structure from multiple data sources; the attribute data is used to describe the characteristics of the computer assets, and the risk data is used to describe the security risks existing in the computer assets;

[0012] The updating module is configured to construct or update an asset profile of the computer asset according to the attribute data, wherein the asset profile is used to describe the attribute data of at least one computer device owned by the organizational structure;

[0013] The update module is configured to construct or update a risk map of the asset portrait based on the risk data, wherein the risk map is used to describe the security risk of at least one computer device owned by the organizational structure.

[0014] On the other hand, an embodiment of the present application provides a computer device, which includes a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the above-mentioned method for generating an asset portrait.

[0015] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is executed by a processor to implement the above-mentioned method for generating an asset portrait.

[0016] On the other hand, an embodiment of the present application provides a computer program product, including a computer program, which is executed by a processor to implement the above-mentioned method for generating an asset portrait.

[0017] The technical solution provided in the embodiments of the present application can bring the following beneficial effects:

[0018] When combing computer assets from multiple data sources, we obtain the attribute data of computer assets, and build or update the asset portrait of computer assets through the attribute data; we obtain the risk data of computer assets, and build or update the risk mapping of asset portraits through the risk data. We associate computer assets with security risks to form a more comprehensive asset portrait and risk mapping. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A schematic diagram of a computer system provided by an exemplary embodiment of the present application is shown;

[0021] Figure 2 A schematic diagram showing a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0022] Figure 3A schematic diagram showing a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0023] Figure 4 A schematic diagram showing the asset portrait execution priority provided by an exemplary embodiment of the present application is shown;

[0024] Figure 5 A schematic diagram showing a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0025] Figure 6 A schematic diagram showing a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0026] Figure 7 A schematic diagram showing a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0027] Figure 8 A schematic diagram showing a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0028] Fig. 9 A flowchart of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0029] Fig.10 A structural block diagram of a device for generating an asset portrait provided by an exemplary embodiment of the present application is shown;

[0030] Fig.11 A schematic diagram of the structure of a computer device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0032] First, the relevant terms involved in this application are introduced:

[0033] Computer assets: refers to tangible or intangible assets related to computer hardware and software. These assets are various computing resources used by enterprises to process information, solve problems or support business operations.

[0034] Asset profiling: is a method of comprehensively analyzing and describing computer assets, which can help enterprises better understand, manage and optimize computer assets.

[0035] Attribute characteristic value: refers to a set of values ​​used to describe the characteristics of a computer device.

[0036] Middleware: It is an independent system software service program that sits between the operating system and application programs of a computer device, managing computing resources and network communications.

[0037] Figure 1 A schematic diagram of a computer system provided by an exemplary embodiment of the present application is shown. The system architecture of the solution may include: a user terminal 101, a management server 102 and a database 103. These devices are connected via a network.

[0038] The user terminal 101 is an electronic device with an Internet access function, which may be a smart phone, a tablet computer, or a personal computer, etc. The user terminal 101 is installed with an application program that can view computer assets. After the user logs in to the application program of computer assets with an account and password, the computer assets can be viewed.

[0039] The management server 102 is a single server, or it may be a server cluster or distributed system composed of multiple servers. It may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms.

[0040] In some embodiments, the management server 102 is a software or hardware device that provides services to other devices in the network. The management server 102 manages multiple computer devices, and the management server 102 supports the function of managing computer assets for multiple computer devices at the same time. For example, the management server 102 can perform a computer asset synchronization task to synchronize the asset data in the computer device to the management server 102 so that the user terminal 101 can view it. The management server 102 and the computer device can communicate through the network. It should be noted that Figure 1 The first computer device, the second computer device, the third computer device, the fourth computer device and the fifth computer device may be different computers or the same computer.

[0041] The database 103 may be a relational database, such as a structured query language database (Structured Query Language, MySQL), a lightweight database (SQLite), a structured query language server database (Structured Query Language Server, SQL Server), etc. A relational database is more suitable for storing data with a relatively stable data structure. The database 103 may be used to store attribute data of computer assets, risk data, configuration information of synchronization tasks, detailed information of synchronization history records, etc.

[0042] Below, the method for generating an asset portrait provided in an embodiment of the present application is described.

[0043] Figure 2 A schematic diagram of a method for generating an asset portrait provided in some embodiments of the present application is shown. The method includes at least some of the following steps:

[0044] Step 210: Obtain attribute data and risk data of computer assets of at least one organizational structure from multiple data sources;

[0045] Among them, the attribute data is used to describe the characteristics of computer assets, and the attribute data includes at least one attribute characteristic value of the name of the computer asset, the name of the asset, the person in charge, the email address and phone number of the person in charge, the database type, version, vulnerability information, and port range.

[0046] The risk data is used to describe the security risks existing in the computer assets, such as at least one of vulnerabilities, compliance and weak passwords existing in the computer assets.

[0047] Step 220: construct or update an asset profile of the computer asset based on the attribute data;

[0048] Among them, the asset portrait is used to describe the attribute data of at least one computer device owned by the organizational structure.

[0049] In some embodiments, the asset portrait covers the physical and technical characteristics of the computer equipment, and also includes information such as the operating system, applications, network configuration, etc. Through the asset portrait, users can better manage computer assets, including monitoring changes, updates and replacements of hardware and software in computer equipment to ensure that the computer equipment is kept up to date.

[0050] In some embodiments, an asset portrait of a computer asset is constructed or updated based on the acquired attribute data, and a more detailed description of the computer equipment owned by the organization can be provided to better manage and protect these computer assets.

[0051] Step 230: Construct or update a risk map of the asset profile based on the risk data.

[0052] Among them, risk mapping is used to describe the security risk of at least one computer device owned by the organizational structure. Risk mapping is the process of matching and associating risk data with asset portraits.

[0053] In some embodiments, asset profiling not only helps understand the characteristics of computer devices, but can also be used to identify potential security risks. By understanding the configuration and vulnerability of each computer device, users can take appropriate measures to strengthen security and reduce potential attack risks.

[0054] To summarize, the method provided in this embodiment obtains attribute data and risk data of computer assets from multiple data sources, constructs or updates asset portraits of computer assets based on the attribute data, constructs or updates risk mapping of asset portraits based on risk data, associates computer assets with security risks, and forms a more comprehensive asset portrait and risk mapping.

[0055] Based on Figure 2 In an optional embodiment, Figure 3 A schematic diagram of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown. In this embodiment, step 220 is replaced by steps 221 and 222:

[0056] Step 221: When the data source of the updated attribute data is a single data source, the corresponding attribute feature value in the first computer device is overwritten with the new attribute feature value in the updated attribute data;

[0057] The attribute characteristic value refers to a set of values ​​used to describe the characteristics of the first computer device.

[0058] Attribute data refers to information used to describe the characteristics of the first computer device, and updating attribute data refers to obtaining the latest information from the computer device to update the attribute characteristic value of the asset portrait.

[0059] The new attribute characteristic value refers to the latest attribute characteristic value obtained from the updated attribute data. When the attribute information of the first computer device changes, the new attribute characteristic value will contain the latest data to reflect the current state of the first computer device.

[0060] In some embodiments, the source of the attribute data includes a single data source. When the data source of the updated attribute data is a single data source, the new attribute feature value in the updated attribute data will overwrite the attribute feature value corresponding to the first computer device. This operation can ensure that the asset portrait of the computer assets remains accurate and up-to-date.

[0061] Step 222: When the data sources of the updated attribute data are multiple data sources, compare the priorities between the first data source corresponding to the updated attribute data and the second data source corresponding to the attribute data.

[0062] In the case where the priority of the first data source is higher than the priority of the second data source, the new attribute characteristic value in the updated attribute data is used to overwrite the corresponding attribute characteristic value in the first computer device.

[0063] The first data source is the data source corresponding to the updated attribute data, and the second data source is the data source corresponding to the current attribute data. The priorities of the first data source and the second data source are compared, and whether to update the attribute feature value in the attribute data is determined based on the priorities.

[0064] In some embodiments, the attribute data of computer assets may have a single data source or multiple data sources. Since the attribute data between multiple data sources may be repeated or conflicting, in order to allow the attribute data between multiple data sources to complement each other and more accurately portray the asset portrait, priorities can be set in the case of multiple data sources.

[0065] In an optional example, the data sources include: at least two of: manual entry, active detection, vulnerability scanning, and third-party system integration; wherein the priority of manual entry is greater than the priority of active detection, the priority of active detection is greater than the priority of vulnerability scanning, and the priority of vulnerability scanning is greater than the priority of third-party system integration.

[0066] In some embodiments, manual data entry refers to manual data entry by offline personnel; manual data entry has a higher priority because manual modification is more timely and efficient. For example, offline personnel provide data by inputting data into the first computer device through a keyboard or filling out a form. Active detection is an automated method in which the first computer device actively detects and obtains data. For example, a network scanning tool can check computer devices regularly. Vulnerability scanning refers to a security detection behavior that detects the security vulnerabilities of the first computer device based on a vulnerability database by scanning and other means to discover exploitable vulnerabilities. Third-party system integration refers to the integration of data from an external system into the current system, which can be automatic acquisition of data from other applications or services.

[0067] Exemplary, with reference to Figure 4 Here, a computer device is used as an example. The operating system version and application information are the attribute characteristic values ​​of the computer device, and the vulnerability information is the risk data of the computer device. In the manually entered computer asset information, the operating system is Windows 7 version, the application information is tomcat, the port number is 8080, and no vulnerability is detected. When using full vulnerability scanning, the operating system is Windows 10 version, the application information is RDP, the port number is 3389, and the vulnerability information is MS17-010. Since the priority of manual entry is higher than vulnerability scanning, the attribute characteristic value Windows 7 will cover Windows 10, and the attribute characteristic values ​​RDP, 3389 and tomcat, 8080 will be combined and merged, and the risk data will be updated to MS17-010.

[0068] In summary, the method provided in this embodiment divides the data source of the updated attribute data into a single data source and multiple data sources. When the data source of the updated attribute data is a single data source, the new attribute feature value is used to overwrite the attribute feature value in the first computer device; when the data source of the updated attribute data is multiple data sources, by comparing the priority between the first data source and the second data source, it is selected whether to use the new attribute feature value to overwrite the corresponding attribute feature value in the first computer device. This method can ensure that the asset portrait of the computer asset always maintains the latest and most accurate feature information.

[0069] Based on Figure 2 In an optional embodiment, Figure 5 A schematic diagram of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown. In this embodiment, step 230 is replaced by steps 231, 232, 233, 234 and 235:

[0070] Step 231: When the first vulnerability exists in the updated risk data of the current scan, and the first vulnerability exists in the preset scanning range, and the first vulnerability does not exist in the existing vulnerabilities, the first vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the first vulnerability is marked as newly added;

[0071] The risk data constructs or updates the risk map of the asset portrait, the risk data includes the updated risk data of the second computer device obtained from the current scan, and the risk map includes the vulnerability set of the second computer device and the updated risk data.

[0072] The vulnerability set refers to a set of vulnerabilities existing in the second computer device. A vulnerability refers to a security weakness or defect existing in the system or software of the second computer device, which may be exploited by an attacker.

[0073] The updated risk data refers to the risk data of the second computer device obtained by the current scan. The updated risk data may include newly discovered vulnerabilities, fixed vulnerabilities, or other security risk information.

[0074] In some embodiments, the first vulnerability refers to a vulnerability detected in this scan. If the scan finds that the second computer device has the first vulnerability, and the first vulnerability is also within the preset scanning range, and the vulnerability set of the second computer device does not have the first vulnerability, then the first vulnerability is added to the vulnerability set of the second computer device, and the rectification status of the first vulnerability is marked as newly added.

[0075] Step 232: When the second vulnerability exists in the updated risk data of the current scan, the second vulnerability exists in the preset scan range, and the second vulnerability exists in the existing vulnerabilities, the second vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the second vulnerability is marked as unrectified;

[0076] In some embodiments, the second vulnerability refers to another vulnerability detected in this scan. If the scan finds that the second computer device has a second vulnerability, and the second vulnerability is also within the preset scanning range, and the second vulnerability also exists in the vulnerability set of the second computer device, then the second vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the second vulnerability is marked as unrectified.

[0077] Step 233: When the third vulnerability exists in the updated risk data of the current scan, and the third vulnerability does not exist in the preset scan range, and the third vulnerability exists in the existing vulnerabilities, the third vulnerability is updated to the vulnerability set of the second computer device, the rectification status of the third vulnerability is marked as unrectified, and a prompt message that the preset scan range is incomplete is generated;

[0078] In some embodiments, the third vulnerability refers to another vulnerability detected in this scan. If the scan finds that the third vulnerability exists and the third vulnerability is not within the preset scan range, it is updated to the vulnerability set of the second computer device, and the rectification status of the third vulnerability is marked as unrectified. At the same time, a prompt message is generated indicating that the preset scan range is incomplete.

[0079] Step 234: when the fourth vulnerability does not exist in the updated risk data of the current scan, the fourth vulnerability exists in the preset scanning range, and the fourth vulnerability does not exist in the existing vulnerabilities, no processing is performed;

[0080] In some embodiments, the fourth vulnerability refers to another vulnerability within the preset scanning range, but is not detected in this scan. If the fourth vulnerability is not detected in the risk data of this scan, but it exists within the preset scanning range and is not recorded in the vulnerability set, then no processing is required.

[0081] Step 235: When the fifth vulnerability does not exist in the updated risk data of this scan, and the fifth vulnerability exists in the preset scan range, and the fifth vulnerability exists in the existing vulnerabilities, the fifth vulnerability is updated to non-existent in the vulnerability set of the second computer device, and the rectification status of the fifth vulnerability is marked as rectified.

[0082] In some embodiments, the fifth vulnerability refers to another vulnerability within the preset scanning range and is detected in this scanning but has been rectified. If the scanning finds that the second computer device does not have the fifth vulnerability, but the fifth vulnerability is within the preset scanning range and the fifth vulnerability also exists in the vulnerability set of the second computer device, the vulnerability set of the second computer device is updated and the rectification status of the fifth vulnerability is marked as rectified.

[0083] In summary, the method provided in this embodiment shows the process of updating the risk mapping of the asset portrait according to the updated risk data. Through the different situations and processing methods of vulnerability information, the asset portrait can be updated in time to accurately reflect the vulnerability situation and rectification status of the computer equipment, so as to carry out risk assessment and management.

[0084] Based on Figure 2 In an optional embodiment, Figure 6 A schematic diagram of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown. In this embodiment, step 230 is replaced by step 236 and step 237:

[0085] Step 236: when the first check item exists in the update risk data of the current scan and the first check item does not exist in the existing check items, the first check item is updated to the check item set of the third computer device;

[0086] The risk map includes a compliance set of the third computer device. The compliance set refers to a set of existing check items used to evaluate whether the third computer device meets a specific compliance standard. Exemplarily, the compliance set may include check items such as password strength, firewall settings, and operating system updates.

[0087] In some embodiments, the first check item refers to a check item in this scan. If the first check item exists in the updated risk data of this scan and does not exist in the existing check items, then the first check item is added to the check item set of the third computer device.

[0088] Exemplarily, a new check item, such as "mandatory access control", is found in the update risk data, and the check item has not appeared in the existing check items, so the check item is added to the check item set of the third computer device.

[0089] Step 237: When the second inspection item exists in the updated risk data of this scan and the second inspection item exists in the existing inspection items, the rectification status of the second inspection item is updated.

[0090] In some embodiments, the second check item refers to another check item in this scan. If the second check item is found in the updated risk data of this scan, and the check item exists in the existing check items, then the rectification status of the second check item will be updated. The rectification status indicates the status of the improvement or repair required for the check item.

[0091] For example, if an existing check item, such as "password complexity", is found in the updated risk data, and the check item also exists in the existing check items, the rectification status of the check item will be updated, such as marking it as "fixed" or "pending".

[0092] In summary, the method provided in this embodiment shows the process of updating the risk mapping of the asset portrait according to the updated risk data. Through the different situations and processing methods existing in the compliance set, the asset portrait can be updated in time to accurately reflect the inspection items and rectification status of the computer equipment for risk assessment and management.

[0093] Based on Figure 2 In an optional embodiment, Figure 7 A schematic diagram of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown. In this embodiment, step 230 is replaced by step 238 and step 239:

[0094] Step 238: When weak password data corresponding to the first protocol exists in the updated risk data of this scan, and the weak password data set corresponding to the first protocol does not exist in the existing weak password data set, a new weak password data set corresponding to the first protocol is created in the weak password set of the fourth computer device, and the weak password data corresponding to the first protocol is added to the weak password data set corresponding to the first protocol;

[0095] The risk map includes a weak password set of the fourth computer device. The weak password set refers to a set of existing weak password data, which is used to evaluate whether the fourth computer device has vulnerable weak passwords. Exemplarily, the weak password set may include common weak passwords, default user names and passwords, etc.

[0096] In some embodiments, if weak password data corresponding to the first protocol is found in the updated risk data of this scan, and the weak password data does not exist in the existing weak password data set, then a new weak password data set corresponding to the first protocol will be created in the weak password set of the fourth computer device, and the weak password data corresponding to the first protocol will be added to the set.

[0097] For example, if a new weak password data set is found in the updated risk data, such as a weak password data set corresponding to the Secure Shell (SSH) protocol, and this data set has never appeared in the existing weak password data set, then a new weak password data set corresponding to the SSH protocol will be created in the weak password set of the fourth computer device, and the weak password data corresponding to the SSH protocol will be added to this set.

[0098] Step 239: When there is weak password data corresponding to the second protocol in the updated risk data of this scan, and there is a weak password data set corresponding to the second protocol in the existing weak password data set, the weak password data corresponding to the second protocol in the updated risk data is used to overwrite the weak password data set corresponding to the second protocol in the existing weak password data set.

[0099] In some embodiments, if weak password data corresponding to the second protocol is found in the updated risk data of this scan, and the weak password data exists in an existing weak password data set, then the weak password data corresponding to the second protocol in the updated risk data will be used to overwrite the weak password data set corresponding to the second protocol in the existing weak password data set.

[0100] For example, if an existing weak password data set is found in the update risk data, such as the weak password data set corresponding to the File Transfer Protocol (FTP), and this data set also exists in the existing weak password data set, then the weak password data corresponding to the FTP protocol in the update risk data will be used to overwrite the weak password data set corresponding to the FTP protocol in the existing weak password data set.

[0101] In summary, the method provided in this embodiment shows the process of updating the risk mapping of the asset portrait according to the updated risk data. The weak password set and asset portrait of the fourth computer device are updated according to the latest scan results to ensure the security and compliance of the fourth computer device. At the same time, the weak password problem can be discovered and repaired in time, improving the security and protection capabilities of the fourth computer device.

[0102] Based on Figure 2 In an optional embodiment, Figure 8 A schematic diagram of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown. In this embodiment, the following steps are also included:

[0103] Step 240: Merge other data sets with the same attribute feature value into the existing data set with the same attribute feature value according to the priority of the data source.

[0104] The data in the existing data set and other data sets are derived from the same or different data domains.

[0105] The existing data set refers to the data set about the same attribute characteristic value of the fifth computer device that has been collected, and these data may have different data sources. The other data set refers to other data sets containing the same attribute characteristic value, and these data may come from different data domains.

[0106] In an optional example, the same attribute feature value includes at least one of service information, middleware information, and application information.

[0107] Optionally, when the same attribute characteristic value is service information, it is grouped by port number, with the service type as the primary key within the group, and other data sets of service information are merged into the existing data set according to the priority definition of the data source; when the same attribute characteristic value is middleware information, it is grouped by middleware type, with the middleware version as the primary key within the group, and other data sets of middleware information are merged into the existing data set according to the priority definition of the data source; when the same attribute characteristic value is application information, the application's complete uniform resource locator is the primary key, and other data sets of application information are merged into the existing data set according to the priority definition of the data source.

[0108] For example, if the same attribute characteristic value is middleware (WebLogic), the middleware type is grouped, the current middleware set of the computer asset is obtained, and the data in other data sets and existing data sets are compared one by one with the middleware version as the primary key, and the sets are merged according to the priority principle. This ensures that data from different sources are fully utilized to depict a more comprehensive asset portrait.

[0109] In an optional example, when the priority of the data source corresponding to the first set element is higher than the priority of the data source corresponding to the second set element, the first set element is used to cover the second set element; when the priority of the data source corresponding to the first set element is lower than the priority of the data source corresponding to the second set element, the second set element is retained;

[0110] The first set elements are elements of other data sets, and the second set elements are elements of the existing data sets.

[0111] Optionally, in the case where the priority of the data source corresponding to the first set element is higher than the data source corresponding to the second set element, the first set element is used to overwrite the second set element. The data in the data source with a higher priority is used to replace the data of the attribute feature value in the existing data set. In the case where the priority of the data source corresponding to the first set element is lower than the data source corresponding to the second set element, the second set element will be retained. The data in the data source with a higher priority in the existing data set will be retained without using the first set element.

[0112] The relevant contents of the priority of the data source are introduced in detail in step 222 and will not be repeated here.

[0113] In summary, the method provided in this embodiment merges other data sets of the same attribute characteristic value into the existing data set of the same attribute characteristic value according to the priority of the data source; and performs asset profiling and management on the fifth computer device. By collecting and integrating data from different data sources, the asset profile of the computer assets can be more comprehensively understood.

[0114] Fig. 9 A flowchart of a method for generating an asset portrait provided by an exemplary embodiment of the present application is shown. The method includes:

[0115] Step 801: Clean the completed data;

[0116] In some embodiments, the received attribute data or risk data is cleaned and converted by the update adapter, and then calculated according to the calculation rules to confirm the update method of the attribute data or risk data. Finally, the updated attribute data or risk data is stored in the database to complete the creation or update of the asset profile and risk mapping.

[0117] Step 802: Apply attribute calculation rules;

[0118] In some embodiments, the calculation rules include updating through the data source of the attribute data. When the data source of the attribute data is multiple data sources, updating is performed by comparing the attribute data and updating the priority of the attribute data; risk data is updated through vulnerability sets, compliance sets, and weak password sets; attribute data also merges data sets of the same attribute feature values ​​through the priority of the data source.

[0119] Step 803: Target data grouping;

[0120] Among them, target data includes attribute data and risk data.

[0121] Step 804: Storing attribute data;

[0122] Among them, the attribute data storage includes storage operations on the target of attribute data and the source of attribute data. Exemplarily, the attribute data includes characteristic information such as asset information, responsible person, operating system, database, middleware, service, etc.

[0123] The target storage of attribute data is used to store updated attribute data. The characteristic information contained in the attribute data describes the details of the computer assets so as to manage and monitor the computer assets more effectively.

[0124] The source storage of attribute data is used to record the source of attribute data. By recording the source of attribute data, the accuracy of attribute data can be ensured.

[0125] Step 805: Save attribute data update history;

[0126] In the computer device, a history record of the attribute characteristic value of the attribute data being overwritten by the new attribute characteristic value of the updated attribute data is saved.

[0127] Step 806: Build / update asset profile;

[0128] In some embodiments, an asset profile of a computer asset is constructed or updated based on the attribute data, where the asset profile is used to describe the attribute data of at least one computer device owned by the organizational structure.

[0129] Step 807: storing risk data;

[0130] In some embodiments, the risk data storage includes storage operations on a vulnerability set, a compliance set, and a weak password set of risk data.

[0131] Step 808: Save risk data update history;

[0132] In the computer device, a history of updating the risk data and overwriting the risk data is saved.

[0133] Step 809: Build / update risk map;

[0134] In some embodiments, a risk map of an asset portrait is constructed or updated based on the risk data, and the risk map is used to describe the security risk of at least one computer device owned by the organizational structure.

[0135] Step 810: Matching the Internet interconnection protocol with the organization;

[0136] In some embodiments, the Internet Protocol (IP) is matched with an organization. First, the registered organizations in the computer system and their corresponding IP address ranges are obtained, the organization corresponding to the current computer asset IP is searched, the relationship between the current computer asset IP and the corresponding organization is stored in a database, an association is established, the ownership of the computer asset is determined, and it is recorded in the corresponding database.

[0137] Step 811: Build / update object attribution.

[0138] In some embodiments, the ownership of the computer assets is updated based on matching the computer asset IP with the corresponding organization.

[0139] The following are device embodiments of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0140] Please refer to Fig.10 , which shows a structural block diagram of an asset portrait generation device provided by an embodiment of the present application. The device has the function of implementing the above-mentioned asset portrait generation method example, and the function can be implemented by hardware, or by hardware executing corresponding software. The device can be the server introduced above, or it can be set in the server. Fig.10 As shown, the device 900 may include: an acquisition module 910 and an update module 920;

[0141] An acquisition module 910 is used to acquire attribute data and risk data of computer assets of at least one organizational structure from multiple data sources; the attribute data is used to describe the characteristics of the computer assets, and the risk data is used to describe the security risks existing in the computer assets;

[0142] An updating module 920, configured to construct or update an asset profile of a computer asset based on the attribute data, wherein the asset profile is used to describe the attribute data of at least one computer device owned by the organizational structure;

[0143] The update module 920 is used to construct or update the risk map of the asset portrait based on the risk data, and the risk map is used to describe the security risk of at least one computer device owned by the organizational structure.

[0144] In an optional embodiment, the updating module 920 is used to overwrite the corresponding attribute characteristic values ​​in the first computer device with the new attribute characteristic values ​​in the updated attribute data when the data source of the updated attribute data is a single data source.

[0145] In an optional embodiment, the updating module 920 is used to compare the priority between the first data source corresponding to the updated attribute data and the second data source corresponding to the attribute data when the data source of the updated attribute data is multiple data sources;

[0146] In the case where the priority of the first data source is higher than the priority of the second data source, the new attribute feature value in the updated attribute data is used to overwrite the corresponding attribute feature value in the first computer device.

[0147] In an optional embodiment, the data sources include: at least two of: manual entry, active detection, vulnerability scanning, and third-party system integration; wherein the priority of manual entry is greater than the priority of active detection, the priority of active detection is greater than the priority of vulnerability scanning, and the priority of vulnerability scanning is greater than the priority of third-party system integration.

[0148] In an optional embodiment, the update module 920 is used to update the first vulnerability to the vulnerability set of the second computer device and mark the rectification status of the first vulnerability as newly added when the first vulnerability exists in the updated risk data of the current scan, the first vulnerability exists in the preset scanning range, and the first vulnerability does not exist in the existing vulnerabilities;

[0149] When the second vulnerability exists in the updated risk data of the current scan, the second vulnerability exists in the preset scan range, and the second vulnerability exists in the existing vulnerabilities, the second vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the second vulnerability is marked as unrectified;

[0150] When the third vulnerability exists in the updated risk data of the current scan, and the third vulnerability does not exist in the preset scan range, and the third vulnerability exists in the existing vulnerabilities, the third vulnerability is updated to the vulnerability set of the second computer device, the rectification status of the third vulnerability is marked as unrectified, and a prompt message that the preset scan range is incomplete is generated;

[0151] If the fourth vulnerability does not exist in the updated risk data of this scan, and the fourth vulnerability exists in the preset scan range, and the fourth vulnerability does not exist in the existing vulnerabilities, no processing is performed;

[0152] When the fifth vulnerability does not exist in the updated risk data of this scan, and the fifth vulnerability exists in the preset scan range, and the fifth vulnerability exists in the existing vulnerabilities, the fifth vulnerability is updated in the vulnerability set of the second computer device, and the rectification status of the fifth vulnerability is marked as rectified.

[0153] In an optional embodiment, the update module 920 updates the first check item to the check item set of the third computer device when the first check item exists in the update risk data of the current scan and the first check item does not exist in the existing check items;

[0154] When the second inspection item exists in the updated risk data of this scan and the second inspection item exists in the existing inspection items, the rectification status of the second inspection item is updated.

[0155] In some optional embodiments, the device 900 further includes an adding module 930 and a covering module 940 .

[0156] In an optional embodiment, the adding module 930 is used to, when there is weak password data corresponding to the first protocol in the updated risk data of this scan, and there is no weak password data set corresponding to the first protocol in the existing weak password data set, create a new weak password data set corresponding to the first protocol in the weak password set of the fourth computer device, and add the weak password data corresponding to the first protocol to the weak password data set corresponding to the first protocol;

[0157] The overwriting module 940 is used to use the weak password data corresponding to the second protocol in the updated risk data to overwrite the weak password data set corresponding to the second protocol in the existing weak password data set when there is weak password data corresponding to the second protocol in the updated risk data of this scan and there is a weak password data set corresponding to the second protocol in the existing weak password data set.

[0158] In some optional embodiments, the device 900 also includes a merging module 950.

[0159] In an optional embodiment, the merging module 950 is used to merge other data sets of the same attribute feature value into the existing data set of the same attribute feature value according to the priority of the data source;

[0160] The data in the existing data set and other data sets are from the same or different data domains.

[0161] In some optional embodiments, the device 900 also includes a retention module 960.

[0162] In an optional embodiment, the overwriting module 940 is configured to overwrite the second set element with the first set element when the priority of the data source corresponding to the first set element is higher than the priority of the data source corresponding to the second set element;

[0163] A retaining module 960, configured to retain the second set element when the priority of the data source corresponding to the first set element is lower than the priority of the data source corresponding to the second set element;

[0164] The first set elements are elements of other data sets, and the second set elements are elements of the existing data sets.

[0165] In an optional embodiment, the same attribute characteristic value includes at least one of service information, middleware information, and application information.

[0166] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0167] Please refer to Fig.11 , which shows a block diagram of a computer device provided in one embodiment of the present application. The terminal device can be used to implement the wireless signal-based data transmission method provided in the above embodiment. Specifically:

[0168] The computer device 1000 includes a central processing unit (CPU) 1001, a system memory 1004 including a random access memory (RAM) 1002 and a read-only memory (ROM) 1003, and a system bus 1005 connecting the system memory 1004 and the central processing unit 1001. The computer device 1000 also includes a basic input / output system (I / O system) 1006 for facilitating information transmission between various components in the computer device, and a large-capacity storage device 1007 for storing an operating system 1013, application programs 1014, and other program modules 1015.

[0169] The basic input / output system 1006 includes a display 1008 for displaying information and an input device 1009 such as a mouse and a keyboard for user inputting information. The display 1008 and the input device 1009 are connected to the central processing unit 1001 through an input / output controller 1010 connected to the system bus 1005. The basic input / output system 1006 may also include an input / output controller 1010 for receiving and processing inputs from a plurality of other devices such as a keyboard, a mouse, or an electronic stylus. Similarly, the input / output controller 1010 also provides output to a display screen, a printer, or other types of output devices.

[0170] The mass storage device 1007 is connected to the central processing unit 1001 via a mass storage controller (not shown) connected to the system bus 1005. The mass storage device 1007 and its associated computer readable storage medium provide non-volatile storage for the computer device 1000. That is, the mass storage device 1007 may include a computer readable storage medium (not shown) such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0171] Without loss of generality, the computer-readable storage medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable storage instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, Erasable Programmable Read Only Memory (EPROM), Electronically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other solid-state storage technology, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, cassette, tape, disk storage or other magnetic storage devices. Of course, those skilled in the art will know that the computer storage medium is not limited to the above. The above-mentioned system memory 1004 and mass storage device 1007 can be collectively referred to as memory.

[0172] The memory stores one or more programs, and the one or more programs are configured to be executed by one or more central processing units 1001. The one or more programs contain instructions for implementing the above-mentioned method embodiments. The central processing unit 1001 executes the one or more programs to implement the methods provided by the above-mentioned various method embodiments.

[0173] According to various embodiments of the present application, the computer device 1000 can also be connected to a remote computer device on a network through a network such as the Internet. That is, the computer device 1000 can be connected to the network 1012 through the network interface unit 1011 connected to the system bus 1005, or the network interface unit 1011 can be used to connect to other types of networks or remote computer device systems (not shown).

[0174] The memory also includes one or more programs, which are stored in the memory and include steps executed by a computer device in the method provided in the embodiment of the present application.

[0175] In an exemplary embodiment, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, the method for generating an asset portrait is implemented.

[0176] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by a processor, it is used to implement the above-mentioned method for generating an asset portrait.

[0177] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application are not limited to this.

[0178] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for generating an asset portrait, characterized in that: The method comprises: Acquire attribute data and risk data of computer assets of at least one organizational structure from multiple data sources; the attribute data is used to describe the characteristics of the computer assets, and the risk data is used to describe the security risks existing in the computer assets; Building or updating an asset profile of the computer asset according to the attribute data, the asset profile being used to describe attribute data of at least one computer device owned by the organizational structure; A risk map of the asset portrait is constructed or updated based on the risk data, where the risk map is used to describe the security risk of at least one computer device owned by the organizational structure.

2. The method according to claim 1, characterized in that The asset portrait includes: at least one attribute characteristic value of the first computer device, and the attribute data includes: updated attribute data of the first computer device; The updating of the asset profile of the computer asset according to the attribute data includes: In the case where the data source of the updated attribute data is a single data source, the new attribute characteristic value in the updated attribute data is used to overwrite the corresponding attribute characteristic value in the first computer device.

3. The method according to claim 1, characterized in that The asset portrait includes: at least one attribute characteristic value of the first computer device, and the attribute data includes: updated attribute data of the first computer device; The updating of the asset profile of the computer asset according to the attribute data includes: In the case where the data source of the updated attribute data is multiple data sources, comparing the priority between a first data source corresponding to the updated attribute data and a second data source corresponding to the attribute data; In the case where the priority of the first data source is higher than the priority of the second data source, the new attribute feature value in the updated attribute data is used to overwrite the corresponding attribute feature value in the first computer device.

4. The method according to claim 3, characterized in that The data sources include: at least two of: manual entry, active detection, vulnerability scanning, and third-party system integration; Among them, the priority of the manual entry is higher than the priority of the active detection, the priority of the active detection is higher than the priority of the vulnerability scanning, and the priority of the vulnerability scanning is higher than the priority of the third-party system integration.

5. The method according to claim 1, characterized in that The risk map includes: a vulnerability set of the second computer device, the vulnerability set including at least one existing vulnerability; the risk data includes: updated risk data of the second computer device obtained from the current scan; The updating of the risk mapping of the asset portrait according to the risk data includes at least one of the following: When a first vulnerability exists in the updated risk data of the current scan, and the first vulnerability exists in the preset scanning range, and the first vulnerability does not exist in the existing vulnerabilities, the first vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the first vulnerability is marked as newly added; When a second vulnerability exists in the updated risk data of the current scan, and the second vulnerability exists in the preset scanning range, and the second vulnerability exists in the existing vulnerabilities, the second vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the second vulnerability is marked as unrectified; When a third vulnerability exists in the updated risk data of the current scan, and the third vulnerability does not exist in the preset scan range, and the third vulnerability exists in the existing vulnerabilities, the third vulnerability is updated to the vulnerability set of the second computer device, the rectification status of the third vulnerability is marked as unrectified, and prompt information that the preset scan range is incomplete is generated; When the fourth vulnerability does not exist in the updated risk data of the current scan, the fourth vulnerability exists in the preset scanning range, and the fourth vulnerability does not exist in the existing vulnerabilities, no processing is performed; When the fifth vulnerability does not exist in the updated risk data of the current scan, and the fifth vulnerability exists in the preset scanning range, and the fifth vulnerability exists in the existing vulnerabilities, the fifth vulnerability is updated to the vulnerability set of the second computer device, and the rectification status of the fifth vulnerability is marked as rectified.

6. The method according to claim 1, characterized in that The risk map includes: a compliance set of a third computer device, the compliance set including at least one existing check item; the risk data includes: updated risk data of the third computer device obtained by this scan; The updating of the risk mapping of the asset portrait according to the risk data includes at least one of the following: When the first check item exists in the update risk data of the current scan and the first check item does not exist in the existing check items, updating the first check item to the check item set of the third computer device; When the second inspection item exists in the update risk data of the current scan and the second inspection item exists in the existing inspection items, the rectification status of the second inspection item is updated.

7. The method according to claim 1, characterized in that The risk map includes: a weak password set of a fourth computer device, the weak password set including at least one existing weak password data set; the risk data includes: updated risk data of the fourth computer device obtained by this scan; The updating of the risk mapping of the asset portrait according to the risk data includes at least one of the following: When weak password data corresponding to the first protocol exists in the updated risk data of the current scan, and a weak password data set corresponding to the first protocol does not exist in the existing weak password data set, a new weak password data set corresponding to the first protocol is created in the weak password set of the fourth computer device, and the weak password data corresponding to the first protocol is added to the weak password data set corresponding to the first protocol; When weak password data corresponding to the second protocol exists in the updated risk data of the current scan, and a weak password data set corresponding to the second protocol exists in the existing weak password data set, the weak password data corresponding to the second protocol in the updated risk data is used to overwrite the weak password data set corresponding to the second protocol in the existing weak password data set.

8. The method according to any one of claims 1 to 7, characterized in that: The asset portrait further includes: an existing data set of the same attribute characteristic value of the fifth computer device, and the attribute data includes: other data sets of the same attribute characteristic value of the fifth computer device; the method further includes: Merge other data sets of the same attribute characteristic value into the existing data set of the same attribute characteristic value according to the priority of the data sources; The data in the existing data set and the data in the other data set are from the same or different data domains.

9. The method according to claim 8, characterized in that The step of merging other data sets of the same attribute characteristic value into the existing data set of the same attribute characteristic value according to the priority of the data sources includes: When the priority of the data source corresponding to the first set element is higher than the priority of the data source corresponding to the second set element, the first set element is used to cover the second set element; In the case where the priority of the data source corresponding to the first set element is lower than the priority of the data source corresponding to the second set element, retaining the second set element; The first set elements are elements of the other data set, and the second set elements are elements of the existing data set.

10. The method according to claim 8, characterized in that The same attribute characteristic value includes: at least one of service information, middleware information, and application information.

11. A device for generating an asset portrait, characterized in that: The device comprises: an acquisition module and a description module; The acquisition module is configured to acquire attribute data and risk data of computer assets of at least one organizational structure from multiple data sources; the attribute data is used to describe the characteristics of the computer assets, and the risk data is used to describe the security risks existing in the computer assets; The updating module is configured to construct or update an asset profile of the computer asset according to the attribute data, wherein the asset profile is used to describe the attribute data of at least one computer device owned by the organizational structure; The update module is configured to construct or update a risk map of the asset portrait based on the risk data, wherein the risk map is used to describe the security risk of at least one computer device owned by the organizational structure.

12. A computer device, characterized in that: The computer device includes a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the method for generating an asset portrait as described in any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program stored therein, characterized in that: When the computer program is executed by a processor, the method for generating an asset portrait as described in any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the method for generating an asset portrait as described in any one of claims 1 to 10.

Images