Open source software network fingerprint generation method and system, electronic equipment and storage medium

Abstract

The invention relates to the technical field of artificial intelligence, and provides an open source software network fingerprint generation method and system, electronic equipment and a storage medium, and the method comprises the steps: deploying target open source software of a to-be-generated fingerprint based on a large model; when the target open source software is operated, multiple different types of network communication characteristics are extracted based on the large model; the plurality of different types of network communication features at least comprise a network protocol feature, a flow feature and a load feature; aggregating the network communication features to generate an initial fingerprint of the target open source software; and verifying the initial fingerprint to obtain a target fingerprint of the target open source software. According to the open source software network fingerprint generation method provided by the invention, the fingerprint generation process of the target open source software can be efficiently and accurately completed without manual intervention under the multi-modal fusion capability of a large model, the automation level and accuracy of fingerprint generation are effectively improved, the investment of professionals is saved, and the user experience is improved. Therefore, the number and accuracy of fingerprint libraries are quickly improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an open source software network fingerprint generation method, system, electronic device and storage medium. Background Art

[0002] Network mapping fingerprints are a collection of features used to identify network assets (such as servers, network devices, and software applications) during the process of network space mapping. These fingerprints can be unique identifiers based on network protocols, service ports, application behaviors, certificate information, Hypertext Markup Language (HTML) tags, etc., which are conducive to accurately locating and identifying specific network targets in complex network environments. For example, for a web server, the Server field in the Hypertext Transfer Protocol (HTTP) response header returned by it (such as "Server: Apache / 2.4.56") is a simple fingerprint that can indicate that the server uses Apache software and its version is 2.4.56.

[0003] In order to effectively identify network assets, it is necessary to obtain various asset fingerprints in the cyberspace, including open source software fingerprint information. Currently, the generation of open source software fingerprints is done by professionals manually operating packet capture tools to capture network communication data between the software and external servers, extract different features, and manually write fingerprint detection rules and fill in fingerprint rule descriptions based on these features to identify the network behavior of the software. Therefore, the current generation of open source software fingerprints is heavily dependent on manual input, resulting in low efficiency in generating open source software fingerprints. Summary of the invention

[0004] The present invention provides a method, system, electronic device and storage medium for generating a network fingerprint of open source software, so as to solve the problem of low efficiency in generating fingerprint of open source software in the prior art.

[0005] In a first aspect, the present invention provides a method for generating a network fingerprint of an open source software, comprising: Based on the large model, deploy the target open source software to generate fingerprints; When running the target open source software, extracting a plurality of different types of network communication features based on the large model; the plurality of different types of network communication features at least include network protocol features, traffic features and load features; Aggregating the network communication features to generate an initial fingerprint of the target open source software; The initial fingerprint is verified to obtain a target fingerprint of the target open source software.

[0006] In one embodiment, when the target open source software is run, a plurality of different types of network communication features are extracted based on the large model, including: When running the target open source software, capturing target network data packets; Convert the target network data packet into a format understandable by the large model to obtain data to be processed; Generate a first prompt word, a second prompt word and a third prompt word; the first prompt word is used to reflect the demand information for extracting network protocol data from the target network data packet; the second prompt word is used to reflect the demand information for extracting flow data from the target network data packet; the third prompt word is used to reflect the demand information for extracting payload data from the target network data packet; Based on the large model and according to the first prompt word, extracting network protocol features of the data to be processed to obtain network protocol features in the target network data packet; Based on the large model and according to the second prompt word, extracting the flow characteristics of the data to be processed to obtain the flow characteristics in the target network data packet; Based on the large model and according to the third prompt word, load characteristics of the data to be processed are extracted to obtain the load characteristics in the target network data packet.

[0007] In one embodiment, aggregating the network communication features to generate an initial fingerprint of the target open source software includes: Arrange the network communication features in sequence according to a preset sorting rule to obtain a plurality of arranged network communication features; Combining the arranged multiple network communication features into a high-dimensional vector; The high-dimensional vector is encoded to generate an initial fingerprint of the target open source software.

[0008] In one embodiment, the verifying the initial fingerprint to obtain the target fingerprint of the target open source software includes: When running the target open source software, capture sample network data packets; Generating a sample fingerprint of the target open source software according to the sample network data packet; Matching the sample fingerprint with the initial fingerprint; If the match is successful, the initial fingerprint is determined as the target fingerprint of the target open source software; If the match fails, the steps of extracting multiple different types of network communication features based on the large model while running the target open source software are iteratively executed until the match is successful, and the initial fingerprint generated in the latest iteration process is determined as the target fingerprint of the target open source software.

[0009] In one embodiment, the deployment of the target open source software to generate fingerprints based on the large model includes: Based on the big model, monitor the dynamic information of the software development sharing platform; If the large model detects that there is a change in the project address of the open source software to be downloaded, then based on the large model and according to the project information of the open source software to be downloaded on the software development sharing platform, the latest warehouse address of the open source software to be downloaded is tracked; Download the latest version code of the open source software to be downloaded from the latest warehouse address; Based on the large model, a risk assessment is performed on the latest version of the code to obtain a risk assessment result; If the risk assessment result is that the latest version of the code does not have a security risk, then determining the latest version of the code as the target code of the open source software to be downloaded; If the risk assessment result is that the latest version of the code has a security risk, the latest version of the code is replaced with a safe dependent version to obtain the target code of the open source software to be downloaded; Based on the target code, target open source software for generating fingerprints is deployed.

[0010] In one embodiment, deploying the target open source software to generate fingerprints based on the target code includes: According to the target code, install and run the open source software to be downloaded; If errors occur during installation and operation, error messages are generated; Based on the large model and according to the error information, a solution is generated; According to the solution, reinstall and run the open source software to be downloaded to obtain the initial open source software that can run normally; In the operating environment of the initial open source software, a business process is simulated to obtain the target open source software for which fingerprints are to be generated.

[0011] In one embodiment, simulating a business process in the operating environment of the initial open source software to obtain the target open source software for which fingerprints are to be generated includes: Based on the large model, generating a business process according to the functional description of the initial open source software, and generating an automation script according to the business process; In the operating environment of the initial open source software, the automation script is executed to simulate the business process to obtain the target open source software for which fingerprints are to be generated.

[0012] In a second aspect, the present invention further provides an open source software network fingerprint generation system, the open source software network fingerprint generation system comprising a large model processing module, a software download module, an installation and debugging module, a configuration interaction module, a fingerprint generation module and a fingerprint verification module; The software download module is used to obtain the target code of the open source software to be downloaded; The installation and debugging module is used to install and run the open source software to be downloaded according to the target code to obtain the initial open source software that can run normally; The configuration interaction module is used to simulate the business process in the running environment of the initial open source software to obtain the target open source software for which fingerprints are to be generated; The fingerprint generation module is used to extract multiple different types of network communication features based on the big model when running the target open source software; the multiple different types of network communication features at least include network protocol features, traffic features and load features; aggregate the network communication features to generate the initial fingerprint of the target open source software; The fingerprint verification module is used to verify the initial fingerprint to obtain the target fingerprint of the target open source software; The large model processing module is used to provide large model processing capabilities.

[0013] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned methods for generating a network fingerprint of open source software are implemented.

[0014] In a fourth aspect, the present invention further provides a storage medium, comprising a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above-mentioned methods for generating a network fingerprint of open source software are implemented.

[0015] The open source software network fingerprint generation method, system, electronic device and storage medium provided by the present invention can extract various types of network communication features, including network protocol features, traffic features and load features, based on a large model when running the target open source software, and aggregate these network communication features to generate an initial fingerprint of the target open source software, further verify the initial fingerprint, and finally generate a reliable target fingerprint. Under the multimodal fusion capability of the large model, the fingerprint generation process of the target open source software can be completed efficiently and accurately without human intervention, which effectively improves the automation level and accuracy of fingerprint generation, saves professional personnel investment, and thus quickly improves the number and accuracy of fingerprint libraries. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of the open source software network fingerprint generation method provided by the present invention.

[0018] Figure 2 It is a structural schematic diagram of the open source software network fingerprint generation system provided by the present invention.

[0019] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein.

[0022] Combine the following Figure 1-Figure 3 The present invention describes the open source software network fingerprint generation method, system, electronic device and storage medium provided by the present invention.

[0023] It should be noted that the current open source software fingerprint generation process is heavily dependent on manual input. From software download, malicious code detection, version identification, installation and debugging, configuration and use, feature extraction, fingerprint generation and fingerprint verification, professional personnel are required to participate in the operation. Conventional automation scripts can automatically complete these processes. Although conventional automation scripts can improve some efficiency in some links of open source software fingerprint generation, they cannot effectively solve the following problems: when the open source software download address changes, the automation script cannot identify and judge, resulting in the inability to download the open source software; it cannot identify whether the open source software is embedded with malicious code; when errors occur in the installation of open source software, the automation script cannot handle this situation; the automation script cannot quickly adapt to the configuration and use of various open source software, and must rely on professionals to configure the open source software; it cannot automatically identify and extract the network communication features required in the open source software operating environment from the network traffic context; it cannot generate corresponding fingerprint information for the extracted network communication features; it cannot effectively verify the fingerprint information. In other words, conventional automation scripts can complete a series of predefined tasks and complete the functions set by professionals. When the task requirements change, professionals need to change the original scripts many times. This processing method has poor flexibility and low accuracy.

[0024] In order to adapt to the changes in task requirements, a large model is introduced. The large model has strong understanding and generation capabilities, can understand complex language logic and contextual relationships, generate natural, fluent and creative text content, and performs well in natural language processing tasks such as text generation, question-answering systems, and machine translation. At the same time, it has multimodal data fusion capabilities, can comprehensively process data in multiple modes such as text, images, and voice, and provide strong support for various application scenarios. Therefore, the open source software network fingerprint generation method provided in the embodiment of the present invention proposes an open source software network fingerprint generation technology based on large model capabilities. The technology is based on the semantic analysis capability and multimodal fusion capability of the large model, without manual participation, and applies and optimizes the large model capability in multiple steps, automatically completing open source software address identification, malicious embedded code detection, latest version detection, installation error resolution, configuration use, simulated business environment, fingerprint generation and fingerprint verification, and realizing the automatic extraction of open source software network mapping fingerprints, greatly reducing personnel investment, and quickly improving the number and accuracy of fingerprint libraries. Among them, the large model can be a locally deployed large model, and it also supports interaction with the Internet platform large model through the application programming interface, and can realize large model query instructions, file upload, response parsing, data analysis and other functions.

[0025] The open source software network fingerprint generation method provided in the embodiment of the present invention is implemented based on the open source software network fingerprint generation system. The embodiment of the present invention takes the open source software network fingerprint generation system as an example to describe the open source software network fingerprint generation method. The open source software network fingerprint generation system specifically includes a software download module, an installation and debugging module, a configuration interaction module, a fingerprint generation module, a fingerprint verification module and a large model processing module. The software download module is used to execute the process of downloading open source software; the installation and debugging module is used to execute the process of installing and running open source software; the configuration interaction module is used to execute the process of simulating business processes in the open source software operating environment; the fingerprint generation module is used to execute the process of generating open source software network fingerprints; the fingerprint verification module is used to execute the process of verifying the open source software network fingerprint; the large model processing module provides large model processing capabilities for the execution process of each module.

[0026] Reference Figure 1 , Figure 1 It is a flow chart of the open source software network fingerprint generation method provided by the present invention.

[0027] like Figure 1 As shown, the method includes the following: Step 101: deploy the target open source software for generating fingerprints based on the large model; Step 102: when running the target open source software, extracting a plurality of different types of network communication features based on the large model; Step 103: Aggregate the network communication features to generate an initial fingerprint of the target open source software; Step 104: verify the initial fingerprint to obtain a target fingerprint of the target open source software.

[0028] Specifically, complete system initialization. Run the local big model, set the local big model access interface and token, and the system can also be configured to use the Internet big model. Set up the big model configuration prompt document, provide task background information and context, and define execution tasks and goals so that the big model can clearly complete tasks such as open source software address tracking, code review, latest version identification, installation and debugging, configuration interaction, feature extraction, fingerprint generation, and fingerprint verification.

[0029] After completing the system initialization, first obtain the target code of the open source software to be downloaded. Secondly, according to the target code, install and run the open source software to be downloaded to obtain the initial open source software that can run normally. Then, in the running environment of the initial open source software, simulate the business process to obtain the target open source software for generating fingerprints. Under the semantic understanding ability and multimodal fusion ability of the large model, automatically deploy the target open source software and use it as the object of fingerprint generation to automatically generate fingerprint information of the target open source software.

[0030] After the target open source software is deployed, run the target open source software. During this running process, capture multiple network data packets, use one of them as the target network data packet, and the remaining target network data packets as sample network data packets, and then generate corresponding fingerprint information. The fingerprint information generated by the target network data packet is used to match the fingerprint information generated by the target network data packet to achieve fingerprint verification.

[0031] Furthermore, based on the large model, a variety of different types of network communication features are extracted from the captured target network data packets, including network protocol features, traffic features and load features. Of course, they are not limited to these network communication features. This article only describes these three network communication features. Network protocol features refer to the properties and behaviors of network protocols, which define how data is transmitted and exchanged in the network; traffic features describe the behavior and pattern of data flows in the network; load features refer to the actual content of data packets or messages, which can be the effective load in network communication. Network communication features such as network protocol features, traffic features and load features together constitute the unique behavior pattern of open source software communicating in the network. Each software has its own specific way of communicating on the network, which can be reflected in the network protocols they use, the traffic patterns they generate, and the content of the payloads they transmit. Aggregating these features can form a unique fingerprint. Although network conditions may change, the communication characteristics of a specific software usually remain relatively stable, which means that the fingerprint information of the software is consistent over a period of time and can be used to identify the software. Therefore, the fingerprint information generated based on the target network data packet and the fingerprint information generated based on the sample network data packet need to be consistent, which can be used as a fingerprint verification method. If they are consistent, the generated fingerprint is accurate. If they are inconsistent, the generated fingerprint is wrong.

[0032] Furthermore, various types of network communication features extracted from the target network data packet are aggregated to generate an initial fingerprint of the target open source software. At the same time, through the above method, various types of network communication features extracted from the sample network data packet can also be aggregated to generate a sample fingerprint of the target open source software.

[0033] Furthermore, the accuracy of the initial fingerprint of the target open source software is verified through the sample fingerprint of the target open source software, and finally the target fingerprint of the target open source software after successful verification is obtained.

[0034] The open source software network fingerprint generation method provided by the present invention can extract various types of network communication features, including network protocol features, traffic features, load features, etc., based on a large model when running the target open source software, and aggregate these network communication features to generate an initial fingerprint of the target open source software, further verify the initial fingerprint, and finally generate a reliable target fingerprint. Under the multimodal fusion capability of the large model, the fingerprint generation process of the target open source software can be completed efficiently and accurately without human intervention, which effectively improves the automation level and accuracy of fingerprint generation, saves professional personnel investment, and thus quickly improves the number and accuracy of fingerprint libraries.

[0035] In some embodiments, based on step 101, the deploying of the target open source software to generate fingerprints based on the large model includes: Based on the big model, monitor the dynamic information of the software development sharing platform; If the large model detects that there is a change in the project address of the open source software to be downloaded, then based on the large model and according to the project information of the open source software to be downloaded on the software development sharing platform, the latest warehouse address of the open source software to be downloaded is tracked; Download the latest version code of the open source software to be downloaded from the latest warehouse address; Based on the large model, a risk assessment is performed on the latest version of the code to obtain a risk assessment result; If the risk assessment result is that the latest version of the code does not have a security risk, then determining the latest version of the code as the target code of the open source software to be downloaded; If the risk assessment result is that the latest version of the code has a security risk, the latest version of the code is replaced with a safe dependent version to obtain the target code of the open source software to be downloaded; Based on the target code, target open source software for generating fingerprints is deployed.

[0036] It should be noted that open source projects may be migrated to new warehouse addresses for various reasons, such as project reorganization, maintainer changes, project updates, etc., so they need to be monitored. According to the configuration, timing or event triggering can be used to use the code and natural language understanding capabilities of the large model to track the new warehouse address of the open source software, establish a prediction model for address changes, predict possible address changes, and, after tracking the new warehouse address, download the latest version of the open source software code to the local computer, conduct in-depth review and analysis of the open source software code, identify possible malicious code fragments, and take corresponding solutions to malicious code fragments that pose security risks. This process is executed by the software download module in the system.

[0037] Specifically, based on the big model, the dynamic information of the software development sharing platform is monitored. For example, the dynamic information of the GitHub community is monitored in real time based on the big model. The dynamic information of the software development sharing platform includes but is not limited to developers' discussions, project update logs, software description information, historical records, etc. When relevant information about project address changes is mentioned in the software development sharing platform, the big model will capture and process it in a timely manner.

[0038] If the big model detects that the project address of the open source software to be downloaded (i.e., the open source software that needs to be obtained currently) has changed on the software development sharing platform, then based on the big model, according to the project information of the open source software to be downloaded on the software development sharing platform, the latest warehouse address of the open source software to be downloaded is tracked, and the latest version of the open source software to be downloaded is tracked.

[0039] In addition, alternative solutions can also be adopted. The large model can generate alternative related warehouse addresses based on the project name or project description, thereby tracking the latest warehouse address of the open source software to be downloaded and tracking the latest version of the open source software to be downloaded.

[0040] Furthermore, the latest version of the open source software to be downloaded is downloaded from the latest repository address to the local computer. Generally speaking, downloading the latest version of the software can ensure that users get the best functionality, performance, security and support. In one embodiment, the latest version of the open source software is identified and downloaded by combining the context understanding ability of the large model with file naming: such as v1.0.0 or release-2.1; configuration files: such as package.json, setup.py, pom.xml, etc.; document records: such as README, CHANGELOG, Issues or GitHub Releases.

[0041] Furthermore, based on the big model's understanding of the code's syntax, semantics, logic and other dimensions, combined with known malware features and patterns, the latest version of the code is reviewed and analyzed in depth to determine whether there are security risks in the latest version of the code. Specifically, the dependencies of the open source software to be downloaded can be evaluated based on the big model, and the dependencies in the dependent files can be checked for security risks, such as whether they have been tampered with or contain malicious code, and finally the corresponding risk assessment results are generated.

[0042] If the risk assessment result shows that the latest version of the code does not present a security risk, the latest version of the code will be determined as the target code for the open source software to be downloaded.

[0043] If the risk assessment result shows that the latest version of the code has security risks, the latest version of the code is replaced with a safe dependent version to obtain the target code of the open source software to be downloaded.

[0044] Furthermore, based on the target code of the open source software to be downloaded, the target open source software for which the fingerprint is to be generated is deployed.

[0045] The embodiment of the present invention utilizes a large model to monitor the dynamic information of a software development sharing platform, thereby achieving real-time tracking of changes in the address of an open source software project, ensuring that the latest version of the code can be downloaded from the latest warehouse address, and further using the large model to conduct a risk assessment of the latest version of the code, effectively identifying potential security risks, and determining or adjusting the target code accordingly, thereby ensuring the security, reliability, and up-to-dateness of the download and use of open source software.

[0046] According to the above content, the target open source software to be deployed based on the target code includes: According to the target code, install and run the open source software to be downloaded; If errors occur during installation and operation, error messages are generated; Based on the large model and according to the error information, a solution is generated; According to the solution, reinstall and run the open source software to be downloaded to obtain the initial open source software that can run normally; In the operating environment of the initial open source software, a business process is simulated to obtain the target open source software for which fingerprints are to be generated.

[0047] It should be noted that during the installation and debugging of open source software, various expected and unexpected problems may occur, such as the dependency library not being installed, the dependency library version not matching, the operating environment not matching, and other errors. By applying the semantic analysis and image analysis capabilities of large models, multiple solutions can be tried to complete the installation and debugging of the open source software and obtain open source software that can run normally. This process is performed by the installation and debugging module in the system.

[0048] Specifically, according to the target code, the virtual machine VM or Docker container is automatically started to install and run the open source software to be downloaded.

[0049] If there are no errors during the installation and running process, you can get the initial open source software that can run normally.

[0050] If an error occurs during the installation and operation process, an error message will be generated. It can be an error message in text format or in the form of a screenshot. Since the big model has both semantic analysis and image analysis capabilities, the big model can analyze and process the error message in text format or in the form of a screenshot and generate a corresponding solution.

[0051] Furthermore, based on the big model, solutions are generated according to error information. For example, it can automatically diagnose and solve the failure of dependent library installation, analyze version conflicts, automatically solve version conflict problems, replace conflicting libraries or downgrade certain dependencies; provide environmental configuration suggestions, automatically generate configuration files, and solve environmental configuration problems.

[0052] Furthermore, according to the generated solution, the open source software to be downloaded is reinstalled and run. If an error still occurs, continue to generate solutions based on the big model and the error information. Finally, through multiple solutions, the installation and operation of the open source software to be downloaded are successfully completed, and the initial open source software that can run normally is obtained.

[0053] Furthermore, in the running environment of the initial open source software, the business process is simulated to obtain the target open source software for which the fingerprint is to be generated.

[0054] When encountering installation and operation errors, the embodiment of the present invention uses a large model to analyze error information and generate solutions to solve the problems generated during installation and operation, and finally obtains an initial open source software that can run normally, effectively shortening the problem solving cycle and ensuring that the open source software can be smoothly installed and run normally, thereby improving the intelligence level of software deployment.

[0055] According to the above content, in the operating environment of the initial open source software, simulating the business process to obtain the target open source software to generate fingerprints includes: Based on the large model, generating a business process according to the functional description of the initial open source software, and generating an automation script according to the business process; In the operating environment of the initial open source software, the automation script is executed to simulate the business process to obtain the target open source software for which fingerprints are to be generated.

[0056] It should be noted that open source software may need to be quickly adapted to various open source software configurations in the environment configuration. In the past, it had to rely on professionals to manually adapt, but this efficiency is poor and the configuration effect is poor in the case of complex environment configuration. Based on the semantic analysis capability of the large model, choose to use the automated testing framework to simulate people and machines to remotely access the open source software system, generate corresponding automated running scripts, simulate the normal business process of the open source software, and generate normal business traffic. This process is executed by the configuration interaction module in the system.

[0057] Specifically, a functional description of the initial open source software is obtained, which describes the instructions for using the software.

[0058] Furthermore, based on the big model, according to the functional description of the initial open source software, the software usage instructions are analyzed, and the open source software business process is modeled. Specifically, according to the functional description of the initial open source software, the document or interface structure is analyzed, the possible user operation paths are derived, and common business processes are generated. According to the business process, automation scripts (such as Selenium, Playwright) are generated to realize the conversion of user operations into automation scripts.

[0059] Furthermore, in the operating environment of the initial open source software, the automation script is executed to simulate the business process, and the target open source software to generate the fingerprint can be obtained, and the target open source software can normally generate the business traffic pcap data packet. In one embodiment, a Locust user behavior script is generated, the traffic pattern is dynamically adjusted according to the user description, the initial open source software is run, the large model is used to dynamically generate test data, the test process is optimized according to the real-time feedback, and finally the business traffic pcap data packet is generated.

[0060] The embodiment of the present invention utilizes a large model to generate business processes based on the functional description of the initial open source software, and further converts them into automated scripts. By executing these scripts in the running environment, the actual business processes are simulated, thereby realizing the automated configuration of the functions and performance of the open source software, improving the accuracy and efficiency of software testing, and ensuring the reliability and stability of the software in real business scenarios.

[0061] In some embodiments, based on step 102, when running the target open source software, based on the large model, a plurality of different types of network communication features are extracted, including: When running the target open source software, capturing target network data packets; Convert the target network data packet into a format understandable by the large model to obtain data to be processed; Generate a first prompt word, a second prompt word and a third prompt word; the first prompt word is used to reflect the demand information for extracting network protocol data from the target network data packet; the second prompt word is used to reflect the demand information for extracting flow data from the target network data packet; the third prompt word is used to reflect the demand information for extracting payload data from the target network data packet; Based on the large model and according to the first prompt word, extracting network protocol features of the data to be processed to obtain network protocol features in the target network data packet; Based on the large model and according to the second prompt word, extracting the flow characteristics of the data to be processed to obtain the flow characteristics in the target network data packet; Based on the large model and according to the third prompt word, load characteristics of the data to be processed are extracted to obtain the load characteristics in the target network data packet.

[0062] It should be noted that before generating the fingerprint information of the open source software, the network communication features are extracted first. If the script execution method is used to automatically extract features, the features can only be extracted according to the pre-set network communication data. If other network communication data is added as a data source for feature extraction, the script needs to be reset, which is less flexible. Set the generation prompt, based on the semantic analysis capability of the large model, obtain the corresponding network communication data according to user needs, and use it as a data source for feature extraction, which greatly improves flexibility. This process is executed by the fingerprint generation module in the system.

[0063] Specifically, when running the target open source software, you can use network packet capture tools such as Wireshark to collect business traffic to generate multiple network data packets, one of which is used as the target network data packet, and the remaining target network data packets are used as sample network data packets for the fingerprint verification process.

[0064] Furthermore, the target network data packet is converted into a format understandable to the large model, usually into a structured data format, to obtain data to be processed.

[0065] Furthermore, a first prompt word, a second prompt word and a third prompt word are generated, wherein the first prompt word is used to reflect the demand information of which network protocol data is to be extracted from the target network data packet, the second prompt word is used to reflect the demand information of which traffic data is to be extracted from the target network data packet, and the third prompt word is used to reflect the demand information of which payload data is to be extracted from the target network data packet.

[0066] Furthermore, based on the large model and according to the first prompt word, network protocol features are extracted from the data to be processed to obtain network protocol features in the target network data packet.

[0067] In one embodiment, based on the large model, protocol parsing is performed on the data to be processed, and the structure and fields of the target network data packet are parsed layer by layer from the network layer, transport layer to the application layer to determine the protocol type to which the target network data packet belongs, and further extract protocol-related parameters and application-related features. Extraction of protocol-related parameters: Extraction of relevant parameters of the transport layer TCP connection, such as the TCP connection establishment time (three-way handshake time), connection duration, number of bytes of data transmission, round-trip time (RTT) of the data packet, etc. Extraction of application-related features: such as the request method (GET, POST, etc.) in the HTTP protocol, HTTP version number, User-Agent field, Cookie field, etc., user name, password, operation command, etc. in the FTP protocol, certificate information, encryption suite list, handshake data, etc. in the TLS protocol, query domain name, record type, etc. in the DNS protocol.

[0068] At the same time, based on the large model and according to the second prompt word, the flow characteristics of the data to be processed are extracted to obtain the flow characteristics in the target network data packet.

[0069] In one embodiment, based on the large model, the traffic feature extraction of the data to be processed includes the extraction of data such as packet size distribution, packet uplink and downlink distribution, packet arrival time interval, traffic rate change, and behavior pattern of session traffic. Packet size distribution: count the number or proportion of packets of different sizes; packet uplink and downlink distribution: the proportion of uplink and downlink packets; packet arrival time interval: calculate the time interval distribution between adjacent packets; traffic rate change: analyze the traffic rate change of the application during the communication process, and the traffic rate can be obtained by calculating the number of bytes transmitted per unit time, and observing the peak, valley and change trend of the traffic rate; behavior pattern of session traffic (such as the interactive structure of request and response).

[0070] At the same time, based on the large model and according to the third prompt word, the load characteristics of the data to be processed are extracted to obtain the load characteristics in the target network data packet.

[0071] In one embodiment, based on the large model, the payload feature extraction of the data to be processed is performed, including payload content extraction of text applications and payload content extraction of non-text applications. For text applications, keywords in the text content are extracted, lexical analysis and part-of-speech tagging are performed on the text content, and high-frequency keywords in the text are extracted. These keywords can reflect the functions and uses of the application. The format and encoding of the text are analyzed. Different applications may use different text formats (such as HTML format, plain text format) and encoding methods (such as UTF-8, GBK, etc.), and this information can also be used to distinguish applications. For non-text applications (such as multimedia applications): extract the format information of multimedia files, and determine the type of multimedia files (such as MP4, AVI and other video formats, MP3, WAV and other audio formats) by analyzing the file header in the data packet payload or the relevant fields in the protocol. For encrypted multimedia content, extract features related to the encryption protocol, such as encryption algorithm, key length and other information.

[0072] The embodiment of the present invention captures the network data packets when the target open source software is running and converts them into a format that can be understood by the large model, which can facilitate the large model to perform analysis and processing. At the same time, it is also necessary to generate specific prompt words according to the requirements of which network communication data to extract. The specific prompt words are used to guide the large model to extract network protocol features, traffic features and load features from the data to be processed, thereby realizing the automatic extraction of network communication features, improving the flexibility of network communication feature extraction, and providing effective data support for the generation of network fingerprints of open source software.

[0073] In some embodiments, based on step 103, aggregating the network communication features to generate an initial fingerprint of the target open source software includes: Arrange the network communication features in sequence according to a preset sorting rule to obtain a plurality of arranged network communication features; Combining the arranged multiple network communication features into a high-dimensional vector; The high-dimensional vector is encoded to generate an initial fingerprint of the target open source software.

[0074] Specifically, the network communication features are arranged in sequence according to a preset sorting rule to obtain a plurality of arranged network communication features, and the plurality of arranged network communication features are combined into a high-dimensional vector. The preset sorting rule is set according to actual conditions.

[0075] Furthermore, the high-dimensional vector is encoded to generate a representative string as the initial fingerprint of the target open source software.

[0076] In one embodiment, a hash function (such as SHA-3, HMAC, etc.) is used to perform a hash operation on the high-dimensional vector to obtain a hash value of a fixed length as the initial fingerprint of the target open source software.

[0077] The embodiment of the present invention sorts the extracted network communication features according to preset rules and combines them into high-dimensional vectors, and then encodes them to generate the initial fingerprint of the target open source software, thereby realizing the automatic generation of open source software network fingerprints and greatly improving the efficiency and accuracy of fingerprint generation.

[0078] In some embodiments, based on step 104, the verifying the initial fingerprint to obtain the target fingerprint of the target open source software includes: When running the target open source software, capture sample network data packets; Generating a sample fingerprint of the target open source software according to the sample network data packet; Matching the sample fingerprint with the initial fingerprint; If the match is successful, the initial fingerprint is determined as the target fingerprint of the target open source software; If the match fails, the steps of extracting multiple different types of network communication features based on the large model while running the target open source software are iteratively executed until the match is successful, and the initial fingerprint generated in the latest iteration process is determined as the target fingerprint of the target open source software.

[0079] It should be noted that the fingerprint information of the open source software is generated by feature extraction, feature combination, encoding, etc., and is unique and can be used to identify the network behavior of the software. Then, when running the target open source software, the captured target network data packets and sample network data packets are respectively generated by feature extraction, feature combination, encoding, etc., and the initial fingerprint and sample fingerprint of the target open source software are generated. Since the fingerprint is unique, by verifying whether the initial fingerprint and the sample fingerprint are consistent, it can be detected whether the generated fingerprint information is valid. This process is performed by the fingerprint verification module in the system.

[0080] Specifically, when the target open source software is running, sample network data packets are captured, and sample fingerprints of the target open source software are generated through feature extraction, feature combination, encoding, etc.

[0081] Furthermore, the sample fingerprint is matched with the initial fingerprint to verify whether the two are consistent.

[0082] If the sample fingerprint successfully matches the initial fingerprint, the initial fingerprint is determined as the target fingerprint of the target open source software.

[0083] If the sample fingerprint fails to match the initial fingerprint, it means that the generated initial fingerprint is wrong or the accuracy is not high, then the initial fingerprint is marked as being in an optimized state, and the process returns to the step of extracting a plurality of different types of network communication features based on the large model when running the target open source software, iterates the fingerprint generation and fingerprint verification process until a match is successful, and determines the initial fingerprint generated in the latest iteration as the target fingerprint of the target open source software.

[0084] The embodiment of the present invention verifies the initial fingerprint through the sample fingerprint and finally generates a reliable target fingerprint. The fingerprint generation process of the target open source software can be completed efficiently and accurately without human intervention, which effectively improves the automation level and accuracy of fingerprint generation, saves the input of professionals, and thus quickly improves the number and accuracy of fingerprint libraries.

[0085] The open source software network fingerprint generation system provided by the present invention is described below. The open source software network fingerprint generation system described below and the open source software network fingerprint generation method described above can be referenced to each other.

[0086] Reference Figure 2 , Figure 2 It is a structural schematic diagram of the open source software network fingerprint generation system provided by the present invention.

[0087] The open source software network fingerprint generation system includes: The software download module 210 is used to obtain the target code of the open source software to be downloaded; An installation and debugging module 220 is used to install and run the open source software to be downloaded according to the target code to obtain initial open source software that can run normally; Configure an interactive module 230, which is used to simulate a business process in the running environment of the initial open source software to obtain the target open source software for which fingerprints are to be generated; The fingerprint generation module 240 is used to extract multiple different types of network communication features based on the big model when running the target open source software; the multiple different types of network communication features at least include network protocol features, traffic features and load features; aggregate the network communication features to generate an initial fingerprint of the target open source software; A fingerprint verification module 250, used to verify the initial fingerprint to obtain a target fingerprint of the target open source software; The large model processing module 260 is used to provide large model processing capabilities.

[0088] The open source software network fingerprint generation system provided by the present invention can extract various types of network communication features, including network protocol features, traffic features, load features, etc., based on a large model when running the target open source software, and aggregate these network communication features to generate an initial fingerprint of the target open source software, further verify the initial fingerprint, and finally generate a reliable target fingerprint. Under the multimodal fusion capability of the large model, the fingerprint generation process of the target open source software can be completed efficiently and accurately without human intervention, which effectively improves the automation level and accuracy of fingerprint generation, saves professional personnel investment, and thus quickly improves the number and accuracy of fingerprint libraries.

[0089] Furthermore, the software download module 210 is also used for: Based on the big model, monitor the dynamic information of the software development sharing platform; If the large model detects that there is a change in the project address of the open source software to be downloaded, then based on the large model and according to the project information of the open source software to be downloaded on the software development sharing platform, the latest warehouse address of the open source software to be downloaded is tracked; Download the latest version code of the open source software to be downloaded from the latest warehouse address; Based on the large model, a risk assessment is performed on the latest version of the code to obtain a risk assessment result; If the risk assessment result is that the latest version of the code does not have a security risk, then determining the latest version of the code as the target code of the open source software to be downloaded; If the risk assessment result is that the latest version of the code has a security risk, the latest version of the code is replaced with a safe dependent version to obtain the target code of the open source software to be downloaded; Based on the target code, target open source software for generating fingerprints is deployed.

[0090] Furthermore, the installation and debugging module 220 is also used for: According to the target code, install and run the open source software to be downloaded; If errors occur during installation and operation, error messages are generated; Based on the large model and according to the error information, a solution is generated; According to the solution, reinstall and run the open source software to be downloaded to obtain the initial open source software that can run normally; In the operating environment of the initial open source software, a business process is simulated to obtain the target open source software for which fingerprints are to be generated.

[0091] Furthermore, the configuration interaction module 230 is also used for: Based on the large model, generating a business process according to the functional description of the initial open source software, and generating an automation script according to the business process; In the operating environment of the initial open source software, the automation script is executed to simulate the business process to obtain the target open source software for which fingerprints are to be generated.

[0092] Furthermore, the fingerprint generation module 240 is also used for: When running the target open source software, capturing target network data packets; Convert the target network data packet into a format understandable by the large model to obtain data to be processed; Generate a first prompt word, a second prompt word and a third prompt word; the first prompt word is used to reflect the demand information for extracting network protocol data from the target network data packet; the second prompt word is used to reflect the demand information for extracting flow data from the target network data packet; the third prompt word is used to reflect the demand information for extracting payload data from the target network data packet; Based on the large model and according to the first prompt word, extracting network protocol features of the data to be processed to obtain network protocol features in the target network data packet; Based on the large model and according to the second prompt word, extracting the flow characteristics of the data to be processed to obtain the flow characteristics in the target network data packet; Based on the large model and according to the third prompt word, extracting the load characteristics of the data to be processed to obtain the load characteristics in the target network data packet; Arrange the network communication features in sequence according to a preset sorting rule to obtain a plurality of arranged network communication features; Combining the arranged multiple network communication features into a high-dimensional vector; The high-dimensional vector is encoded to generate an initial fingerprint of the target open source software.

[0093] Furthermore, the fingerprint verification module 250 is also used for: When running the target open source software, capture sample network data packets; Generating a sample fingerprint of the target open source software according to the sample network data packet; Matching the sample fingerprint with the initial fingerprint; If the match is successful, the initial fingerprint is determined as the target fingerprint of the target open source software; If the match fails, the steps of extracting multiple different types of network communication features based on the large model while running the target open source software are iteratively executed until the match is successful, and the initial fingerprint generated in the latest iteration process is determined as the target fingerprint of the target open source software.

[0094] Figure 3 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the open source software network fingerprint generation method, which includes: deploying the target open source software to generate fingerprints based on the big model; when running the target open source software, extracting a plurality of different types of network communication features based on the big model; the plurality of different types of network communication features at least include network protocol features, flow features and load features; aggregating the network communication features to generate the initial fingerprint of the target open source software; and verifying the initial fingerprint to obtain the target fingerprint of the target open source software.

[0095] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0096] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the open source software network fingerprint generation method provided in the above embodiments, the method comprising: deploying the target open source software to generate a fingerprint based on a large model; when running the target open source software, extracting a plurality of different types of network communication features based on the large model; the plurality of different types of network communication features at least include network protocol features, traffic features and load features; aggregating each of the network communication features to generate an initial fingerprint of the target open source software; verifying the initial fingerprint to obtain a target fingerprint of the target open source software.

[0097] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the open source software network fingerprint generation method provided in the above-mentioned embodiments, the method comprising: deploying the target open source software to generate a fingerprint based on a large model; when running the target open source software, extracting a plurality of different types of network communication features based on the large model; the plurality of different types of network communication features at least include network protocol features, traffic features and load features; aggregating each of the network communication features to generate an initial fingerprint of the target open source software; and verifying the initial fingerprint to obtain a target fingerprint of the target open source software.

[0098] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present invention without creative effort.

[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating a network fingerprint of an open source software, characterized in that: include: Based on the large model, deploy the target open source software to generate fingerprints; When running the target open source software, extracting a plurality of different types of network communication features based on the large model; The multiple different types of network communication characteristics include at least network protocol characteristics, flow characteristics and load characteristics; Aggregating the network communication features to generate an initial fingerprint of the target open source software; The initial fingerprint is verified to obtain a target fingerprint of the target open source software.

2. The open source software network fingerprint generation method according to claim 1, characterized in that: When the target open source software is run, a plurality of different types of network communication features are extracted based on the large model, including: When running the target open source software, capturing target network data packets; Convert the target network data packet into a format understandable by the large model to obtain data to be processed; Generate a first prompt word, a second prompt word and a third prompt word; the first prompt word is used to reflect the demand information for extracting network protocol data from the target network data packet; the second prompt word is used to reflect the demand information for extracting flow data from the target network data packet; the third prompt word is used to reflect the demand information for extracting payload data from the target network data packet; Based on the large model and according to the first prompt word, extracting network protocol features of the data to be processed to obtain network protocol features in the target network data packet; Based on the large model and according to the second prompt word, extracting the flow characteristics of the data to be processed to obtain the flow characteristics in the target network data packet; Based on the large model and according to the third prompt word, load characteristics of the data to be processed are extracted to obtain the load characteristics in the target network data packet.

3. The open source software network fingerprint generation method according to claim 2, characterized in that: The aggregating the network communication features to generate an initial fingerprint of the target open source software includes: Arrange the network communication features in sequence according to a preset sorting rule to obtain a plurality of arranged network communication features; Combining the arranged multiple network communication features into a high-dimensional vector; The high-dimensional vector is encoded to generate an initial fingerprint of the target open source software.

4. The open source software network fingerprint generation method according to claim 3, characterized in that: The verifying the initial fingerprint to obtain the target fingerprint of the target open source software includes: When running the target open source software, capture sample network data packets; Generating a sample fingerprint of the target open source software according to the sample network data packet; Matching the sample fingerprint with the initial fingerprint; If the match is successful, the initial fingerprint is determined as the target fingerprint of the target open source software; If the match fails, the steps of extracting multiple different types of network communication features based on the large model while running the target open source software are iteratively executed until the match is successful, and the initial fingerprint generated in the latest iteration process is determined as the target fingerprint of the target open source software.

5. The open source software network fingerprint generation method according to claim 1, characterized in that: The target open source software for deploying fingerprints to be generated based on the large model includes: Based on the big model, monitor the dynamic information of the software development sharing platform; If the large model detects that there is a change in the project address of the open source software to be downloaded, then based on the large model and according to the project information of the open source software to be downloaded on the software development sharing platform, the latest warehouse address of the open source software to be downloaded is tracked; Download the latest version code of the open source software to be downloaded from the latest warehouse address; Based on the large model, a risk assessment is performed on the latest version of the code to obtain a risk assessment result; If the risk assessment result is that the latest version of the code does not have a security risk, then determining the latest version of the code as the target code of the open source software to be downloaded; If the risk assessment result is that the latest version of the code has a security risk, the latest version of the code is replaced with a safe dependent version to obtain the target code of the open source software to be downloaded; Based on the target code, target open source software for generating fingerprints is deployed.

6. The open source software network fingerprint generation method according to claim 5, characterized in that: The step of deploying the target open source software to generate fingerprints based on the target code includes: According to the target code, install and run the open source software to be downloaded; If errors occur during installation and operation, error messages are generated; Based on the large model and according to the error information, a solution is generated; According to the solution, reinstall and run the open source software to be downloaded to obtain the initial open source software that can run normally; In the operating environment of the initial open source software, a business process is simulated to obtain the target open source software for which fingerprints are to be generated.

7. The open source software network fingerprint generation method according to claim 6, characterized in that: The process of simulating a business process in the operating environment of the initial open source software to obtain the target open source software to generate fingerprints includes: Based on the large model, generating a business process according to the functional description of the initial open source software, and generating an automation script according to the business process; In the operating environment of the initial open source software, the automation script is executed to simulate the business process to obtain the target open source software for which fingerprints are to be generated.

8. An open source software network fingerprint generation system, characterized in that: The open source software network fingerprint generation system includes a software download module, an installation and debugging module, a configuration interaction module, a fingerprint generation module, a fingerprint verification module and a large model processing module; The software download module is used to obtain the target code of the open source software to be downloaded; The installation and debugging module is used to install and run the open source software to be downloaded according to the target code to obtain the initial open source software that can run normally; The configuration interaction module is used to simulate the business process in the running environment of the initial open source software to obtain the target open source software for which fingerprints are to be generated; The fingerprint generation module is used to extract multiple different types of network communication features based on a large model when running the target open source software; The multiple different types of network communication characteristics include at least network protocol characteristics, flow characteristics and load characteristics; Aggregating the network communication features to generate an initial fingerprint of the target open source software; The fingerprint verification module is used to verify the initial fingerprint to obtain the target fingerprint of the target open source software; The large model processing module is used to provide large model processing capabilities.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the open source software network fingerprint generation method according to any one of claims 1 to 7 are implemented.

10. A storage medium, comprising a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the open source software network fingerprint generation method according to any one of claims 1 to 7 are implemented.

Images