Method for discovering and identifying computer terminal network service

Abstract

The invention discloses a method for discovering and identifying network services at a computer end, which is characterized by comprising the following steps: S100: constructing a network service mapping table for screening various network services at the computer end, the fields of the network service mapping table comprising service names, process names and executable file names; s200, constructing a computer end process information table for storing all process information of a computer end; s300, constructing a computer terminal network service table for storing all network service information of a computer terminal; s400, judging whether a running process exists in the computer end or not, if yes, executing the step S500, and if not, executing the step S700; s500, acquiring process names, process ids and executable file names of all running processes of the computer end, and adding the process names, the process ids and the executable file names to the process information table; s600, acquiring network process information of a computer end and adding the network process information to the network service table; and S700, outputting the network service table, wherein the network service table comprises all network service information of the computer end.

Description

Technical Field

[0001] The invention belongs to the field of network security and relates to a method for discovering and identifying computer-side network services. Background Art

[0002] In computer networks, network services refer to various services provided on the network, such as Web services, database services, file sharing services, etc. The discovery and identification of network services is one of the important functions of network management. In the prior art, it can be achieved in the following ways:

[0003] 1. Manual configuration: The network administrator manually configures the network service information, such as service name, IP address, port number, etc. This method is more intuitive, but requires manual operation, is prone to errors, and is not suitable for large-scale network environments.

[0004] 2. Use the network service discovery protocol: The network service discovery protocol is a protocol used to automatically discover network services, such as Bonjour, Zeroconf, DNS-SD, etc. This method can automatically discover network services, but the network services need to support the corresponding protocol.

[0005] 3. Use network scanning tools: Network scanning tools can scan all devices and services in the network and identify the network services. This method can discover all network services, but the scanning process may occupy a lot of client / server resources and network resources. Summary of the invention

[0006] The present invention aims at the deficiencies of the prior art and provides a method for discovering and identifying network services on a computer side. By executing system commands and combining process and service information, the network services running on the computer side are accurately discovered and identified, thereby improving the efficiency of network management and security monitoring. The method comprises the following steps:

[0007] S100: constructing a network service mapping table to screen various network services on the computer, wherein the fields of the network service mapping table include service name, process name, and executable file name;

[0008] S200: constructing a computer-side process information table to store all process information on the computer, wherein the fields of the process information table include a process name, a process ID, an executable file name, and an initial value of each field is empty;

[0009] S300: constructing a computer-side network service table to store all network service information on the computer, wherein the fields of the network service table include service name, process name, process ID, executable file name, and the initial value of each field is empty;

[0010] S400: Determine whether there is a running process on the computer, if yes, execute step S500, otherwise, execute step S700;

[0011] S500: Obtain the process names, process IDs, and executable file names of all running processes on the computer and add them to the process information table;

[0012] S600: Obtaining the network process information of the computer and adding it to the network service table, including:

[0013] Create a storage object;

[0014] Traversing the process information table and appending the process information of the computer end to the storage object;

[0015] Find and filter the processes with TCP / UDP in the storage object;

[0016] Using the network service mapping table, identify and obtain all network service information on the computer;

[0017] S700: Output the network service table, which includes all network service information on the computer.

[0018] Preferably, step S600 includes the following steps:

[0019] S601: creating a storage object for storing temporary data, wherein the fields of the storage object include a service name, a process name, a process ID, an executable file name, and the initial value of each field is empty;

[0020] S602: traverse the process information table and determine whether the current traversal is completed. If so, execute step S700; otherwise, execute step S603;

[0021] S603: Obtain the process name, process ID, and executable file name of the process information table and store them in the storage object;

[0022] S604: Obtain the process ID of the current process in the storage object, and determine whether the first column of the current process ID has a TCP / UDP identifier. If so, execute step S606; otherwise, execute step S605:

[0023] S605: Obtain the process ID of the next process in the process information table, and continue to execute step S602 to traverse;

[0024] S606: for the current process ID in the storage object, using a system command, query and obtain the service name, display name, and status corresponding to the current process ID;

[0025] S607: storing the service name obtained in step S606 into the value of the service name field corresponding to the current process ID in the storage object;

[0026] S608: Using the network service mapping table, identify and obtain all network service information on the computer.

[0027] Preferably, step S608 includes the following steps:

[0028] S6081: traverse the network service mapping table to determine whether the traversal is completed, if so, execute step S602, otherwise, execute step S6082;

[0029] S6082: Obtain the current service name, process name, and executable file name of the network service mapping table row by row;

[0030] S6083: Determine whether the current service name in the network service mapping table is the same as the current service name in the storage object, if yes, execute step S6086, otherwise, execute step S6084;

[0031] S6084: Determine whether the current process name in the network service mapping table is the same as the current process name in the storage object, if yes, execute step S6086, otherwise, execute step S6085;

[0032] S6085: Determine whether the current executable file name in the network service mapping table is the same as the current executable file name in the storage object. If yes, execute step S6086; otherwise, continue to execute step S6081 for traversal;

[0033] S6086: Add the current service name, process name, and executable file name in the storage object to the network service table, and execute step S602.

[0034] The beneficial effects of the present invention are:

[0035] 1. Versatility: The technical solution provided by the present invention is a universal service discovery mechanism that can be applied in various environments and scenarios, providing a flexible and efficient network service management method.

[0036] 2. No need for manual configuration: Network services can be discovered automatically without manual configuration of network service information.

[0037] 3. Less resource occupation: It uses an efficient network service discovery method, which can quickly and accurately identify network services running on the local machine. It occupies less resources, does not affect network performance, and improves the system's response speed.

[0038] 4. Scalability: It has good scalability and can be flexibly expanded and customized according to actual needs to meet different scenarios.

[0039] 5. Reliability: It has high reliability and stability, can run continuously and stably, and ensure the normal use of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 is a flow chart of the present invention;

[0041] Figure 2 A flowchart of obtaining network process information on a computer in an embodiment of the present invention;

[0042] Figure 3 The present invention is a flowchart for identifying and obtaining all network service information on a computer in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0044] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0045] S100: construct a network service mapping table to screen various network services on the computer side. The fields of the network service mapping table include service name, process name, and executable file name.

[0046] The services in the constructed network service mapping table are all network services, which contain service names, process names, and executable file names in each row. Taking the network services in the network service mapping table as the standard, the services corresponding to each process on the computer are compared to determine whether the computer has network services and which network services are included.

[0047] In this embodiment, the network service mapping table used is shown in Table 1 below, which shows the service name, process name, and executable file name in each row.

[0048] It should be understood that the network service mapping table shown in Table 1 is only an example and does not include all network services in the prior art. It is only an example listed for the convenience of description.

[0049] Table 1: Network service mapping table

[0050]

[0051] S200: Construct a computer-side process information table to store all process information on the computer. The fields of the process information table include process name, process ID, and executable file name, and the initial value of each field is empty.

[0052] The initial values ​​of each field in this table are empty. In the subsequent steps, all the processes on the computer side obtained will be added to the table one by one in a tail-add manner.

[0053] S300: Constructing a computer-side network service table to store all network service information on the computer side. The fields of the network service table include service name, process name, process ID, executable file name, and the initial value of each field is empty.

[0054] Similarly, the initial values ​​of each field in the table are empty. In the subsequent steps, the service name, process name, process ID, executable file name, etc. of the network service on the computer side will be added to the table one by one in a tail-adding manner.

[0055] S400: Determine whether there is a running process on the computer. If so, execute step S500; otherwise, execute step S700.

[0056] In this embodiment, the system command tasklist / FI "STATUS eq RUNNING" / FO "CSV" / NH is used to search for all process information on the computer. Through the search method, services that are not registered as system services can be found, and omissions can be avoided and accuracy can be improved.

[0057] S500: Obtain the process name, process ID, and executable file name of all running processes on the computer and add them to the process information table;

[0058] S600: Obtain the network process information of the computer and add it to the network service table, including:

[0059] Create a storage object;

[0060] Traverse the process information table and add the computer's process information to the storage object;

[0061] Find and filter processes with TCP / UDP in storage objects;

[0062] Use the network service mapping table to identify and obtain all network service information on the computer.

[0063] It is worth noting that since the data in the process information table comes from all process information on the computer, there may be many non-network services, such as system management services, file system services, etc. Therefore, non-network services need to be excluded.

[0064] Figure 2 A flow chart of obtaining network process information on a computer terminal in an embodiment of the present invention is shown.

[0065] like Figure 2 As shown, step S600 includes the following steps:

[0066] S601: Create a storage object to store temporary data. The fields of the storage object include service name, process name, process ID, executable file name, and the initial value of each field is empty.

[0067] S602: traverse the process information table and determine whether the current traversal is completed. If so, execute step S700; otherwise, execute step S603;

[0068] S603: Obtain the process name, process ID, and executable file name in the process information table and store them in the storage object;

[0069] S604: Get the process ID of the current process in the storage object, and determine whether the first column of the current process ID has a TCP / UDP identifier. If yes, execute step S606; otherwise, execute step S605;

[0070] In this embodiment, the process ID in the storage object is obtained, and the process ID is used as a condition to find the connection information of TCP / IP on the computer. The first column is analyzed row by row to see if there is a protocol type of the TCP or UDP network transport layer. The protocol is used to establish data communication between the sending end and the receiving end. The protocol type is used to determine whether it is a network process. When a process ID is associated with TCP or UDP network connection information, it usually means that the process is running as some kind of network service because it is listening to or establishing a network socket connection. Therefore, as long as the first column of any row has a protocol type of the TCP or UDP network transport layer, it indicates that the process is a network process.

[0071] S605: Obtain the process ID of the next process in the process information table, and continue to execute step S602 to traverse;

[0072] S606: For the current process ID in the storage object, use system commands to query and obtain the service name, display name, and status corresponding to the current process ID.

[0073] In this embodiment, wmic service where ProcessId=process_id get / format:list is used to obtain the service name corresponding to the process id, wherein process_id represents the process id.

[0074] S607: Store the service name obtained in step S606 into the value of the service name field corresponding to the current process ID in the storage object;

[0075] S608: Using the network service mapping table, identify and obtain all network service information on the computer.

[0076] It is worth noting that in most cases the service name and the process name are the same.

[0077] For example, the process name of a service named Apache2.4 is also Apache2.4.

[0078] However, in some cases, the service name and the process name may be different.

[0079] For example: a customized service name, that is, a service name customized by the user when installing the network service software, for example, a service name customized by the user when using the MySQL service.

[0080] Another example is that there are multiple service instances. For example, if multiple MySQL service instances are installed, the service name, process name, and executable file name of each instance may be different.

[0081] Another example is some special configurations. That is, in some special configurations, for example, when the mysqld_safe script is used to start the mysql service, the process name may be different from the executable file name.

[0082] Therefore, there may be multiple processes for the same service. In this case, each process name is different, or a service may use the same executable file to start different processes. In this case, each process name may be different from the executable file name but the same as the service name.

[0083] Here are some examples:

[0084] For Apache 2.4 services, the process name will be different from the name of the executable, but will be the same as the service name:

[0085] Service name:Apache2.4

[0086] Process name: Apache2.4

[0087] Executable file: httpd.exe

[0088] For MySQL, the service name, process name, and executable file name are all the same

[0089] Service name:mysql

[0090] Process name:mysqld

[0091] Executable file:mysqld.exe

[0092] In this case, it is not enough to judge whether a process is a network service process based on the network service mapping table alone, because it is possible to miss some network services due to the above reasons. Therefore, it is also necessary to use the following method to identify and obtain the process information of the computer side, so as to finally determine, discover and identify all network services on the computer side.

[0093] Figure 3 A flow chart of identifying and acquiring all network service information on a computer terminal in an embodiment of the present invention is shown.

[0094] like Figure 3 As shown, step S608 includes the following steps:

[0095] S6081: traverse the network service mapping table to determine whether the traversal is completed. If so, execute step S602; otherwise, execute step S6082;

[0096] S6082: Obtain the current service name, process name, and executable file name of the network service mapping table row by row;

[0097] S6083: Determine whether the current service name in the network service mapping table is the same as the current service name in the storage object. If yes, execute step S6086; otherwise, execute step S6084.

[0098] S6084: Determine whether the current process name in the network service mapping table is the same as the current process name in the storage object. If yes, execute step S6086; otherwise, execute step S6085.

[0099] S6085: Determine whether the current executable file name in the network service mapping table is the same as the current executable file name in the storage object. If yes, execute step S6086; otherwise, continue to execute step S6081 for traversal;

[0100] S6086: Add the current service name, process name, and executable file name in the storage object to the network service table, and execute step S602.

[0101] S700: Outputting a network service table, which includes all network service information on the computer.

[0102] The method provided by the present invention solves the technical problem that there is no method for discovering and identifying computer-side network services in the prior art.

[0103] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for discovering and identifying computer-side network services, characterized in that The following steps are involved: S100: constructing a network service mapping table to screen various network services on the computer, wherein the fields of the network service mapping table include service name, process name, and executable file name; S200: constructing a computer-side process information table to store all process information on the computer, wherein the fields of the process information table include a process name, a process ID, an executable file name, and an initial value of each field is empty; S300: constructing a computer-side network service table to store all network service information on the computer, wherein the fields of the network service table include service name, process name, process ID, executable file name, and the initial value of each field is empty; S400: Determine whether there is a running process on the computer, if yes, execute step S500, otherwise, execute step S700; S5 00: Get the process name, process ID, and executable file name of all running processes on the computer and add them to the process information table; S600: Obtaining the network process information of the computer and adding it to the network service table, including: Create a storage object; Traversing the process information table and appending the process information of the computer end to the storage object; Find and filter the processes with TCP / UDP in the storage object; Using the network service mapping table, identify and obtain all network service information on the computer; S700: Output the network service table, which includes all network service information on the computer.

2. A method for discovering and identifying computer-side network services according to claim 1, characterized in that: Step S600 includes the following steps: S601: creating a storage object for storing temporary data, wherein the fields of the storage object include a service name, a process name, a process ID, an executable file name, and the initial value of each field is empty; S602: traverse the process information table and determine whether the current traversal is completed. If so, execute step S700; otherwise, execute step S603; S603: Obtain the process name, process ID, and executable file name of the process information table and store them in the storage object; S604: Obtain the process ID of the current process in the storage object, and determine whether the first column of the current process ID has a TCP / UDP identifier. If yes, execute step S606; otherwise, execute step S605; S605: Obtain the process ID of the next process in the process information table, and continue to execute step S602 to traverse; S606: for the current process ID in the storage object, using a system command, query and obtain the service name, display name, and status corresponding to the current process ID; S607: storing the service name obtained in step S606 into the value of the service name field corresponding to the current process ID in the storage object; S608: Using the network service mapping table, identify and obtain all network service information on the computer.

3. A method for discovering and identifying computer-side network services according to claim 2, characterized in that: Step S608 includes the following steps: S6081: traverse the network service mapping table to determine whether the traversal is completed, if so, execute step S602, otherwise, execute step S6082; S6082: Obtain the current service name, process name, and executable file name of the network service mapping table row by row; S6083: Determine whether the current service name in the network service mapping table is the same as the current service name in the storage object, if yes, execute step S6086, otherwise, execute step S6084; S6084: Determine whether the current process name in the network service mapping table is the same as the current process name in the storage object, if yes, execute step S6086, otherwise, execute step S6085; S6085: Determine whether the current executable file name in the network service mapping table is the same as the current executable file name in the storage object. If yes, execute step S6086; otherwise, continue to execute step S6081 for traversal; S6086: Add the current service name, process name, and executable file name in the storage object to the network service table, and execute step S602.

Images