Network space asset surveying and mapping system based on Pipeline architecture

Abstract

The invention discloses a network space asset surveying and mapping system based on a Pipeline architecture, by constructing the Pipeline architecture, the system can efficiently connect all working modules in series, an ordered data processing flow is formed, the overall processing efficiency is improved, the system covers the whole flow from data acquisition to data display, and the system has the advantages of being high in practicability and easy to popularize. The network space asset surveying and mapping system can comprehensively perform network space asset surveying and mapping and achieve comprehensive surveying and mapping of network space assets, the system can automatically complete all links such as data acquisition, analysis, storage and display, manual intervention is reduced, working efficiency is improved, meanwhile, human errors can be reduced, the accuracy and reliability of data are improved, and the network space asset surveying and mapping system is suitable for popularization and application. The system can display the collected and analyzed data in a visual and understandable manner through the data display module, so that a user can quickly know the condition of network space assets, and the system can timely discover potential security risks by carrying out analysis processing such as vulnerability detection and sensitive information extraction.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace asset mapping, and in particular to a cyberspace asset mapping system based on a Pipeline architecture. Background Art

[0002] With the rapid development of network technology, the types and number of assets in cyberspace have increased dramatically, which has brought new challenges to the security management and protection of cyberspace. Traditional methods of cyberspace asset mapping mostly rely on manual operations and scattered tool sets, and have problems such as low efficiency, prone to errors, and difficulty in systematization. Specifically, these methods are often unable to fully and accurately obtain cyberspace asset information, and at the same time, they are also unable to conduct in-depth analysis of asset information and discover potential security risks. Summary of the invention

[0003] In view of this, the present invention proposes a cyberspace asset mapping system based on the Pipeline architecture, which can solve the defects of the prior art in terms of low efficiency, inability to comprehensively and accurately obtain cyberspace asset information, and inability to discover potential security risks.

[0004] The technical solution of the present invention is achieved in this way:

[0005] A network space asset mapping system based on Pipeline architecture, specifically including:

[0006] Building modules for building Pipeline architecture;

[0007] Integration module, used to connect the work modules of cyberspace asset mapping in series according to the Pipeline architecture;

[0008] The working modules of cyberspace asset mapping include:

[0009] Data collection module, used to obtain relevant IP addresses based on given domain names or ICP filing information, and perform port scanning and service identification;

[0010] Data analysis module, used to analyze and process the collected data, including password enumeration, Web service information detection, vulnerability detection, sensitive information extraction, code leakage risk analysis, file leakage risk analysis, mobile terminal asset collection, supplier service provider information collection and mailbox data collection;

[0011] A data storage module, used to store collected and analyzed data;

[0012] The data display module is used to display the collected and analyzed data.

[0013] As a further optional solution of the Pipeline architecture-based cyberspace asset mapping system, the working module of the cyberspace asset mapping also includes:

[0014] Task scheduling module, used to schedule the execution order of data acquisition module and data analysis module;

[0015] The plug-in management module is used to manage and load different types of data collection plug-ins and data analysis plug-ins.

[0016] A network space asset mapping method based on Pipeline architecture, the method is based on the network space asset mapping system based on Pipeline architecture, and specifically includes:

[0017] Step S1, obtaining IP addresses, port scanning and identifying service types of open ports based on the data acquisition module;

[0018] Step S2: performing data analysis based on the data analysis module, specifically:

[0019] Step S21: When the identified service type is a database or a message queue, password enumeration is used to detect whether there is a default password, thereby determining whether there is a security risk in the target asset;

[0020] Step S22: when the identified service type is a Web service, obtain Web service information;

[0021] Step S23: Performing an in-depth security test on the Web service information obtained in step S5 based on vulnerability exploitation programs and vulnerability scanning tools to determine whether there are related vulnerabilities;

[0022] Step S24: According to the Web service information obtained in step S22, the domain name information in the URL is obtained, and the historical archived URLs under the domain name are obtained, and sensitive information is identified by using regular expression matching and machine learning models;

[0023] Step S25: extracting software code keywords based on the Web service information obtained in step S22, searching for related suspected code leakage data in the code hosting platform based on the software code keywords, and using code analysis tools to analyze the code in the code hosting platform to identify potential code leakage risks;

[0024] Step S26: extract file keywords based on the Web service information obtained in step S22, search for relevant file leakage risks on the cloud disk search platform, analyze the file content using a file analysis tool, and identify potential file leakage risks;

[0025] Step S27: Collect relevant mobile terminal assets from the enterprise search platform and analyze the security risks of mobile terminal applications;

[0026] Step S28: Use the customized dictionary to match sensitive information in the URL, and use the file analysis tool to analyze the file content to identify the file leakage risk associated with the URL;

[0027] Step S29: Collect relevant information about external suppliers and service providers of the enterprise and analyze supply chain security risks;

[0028] Step S210: extracting domain name data according to the Web service information obtained in step S22, using a mailbox collection tool to collect mailbox data related to the domain name, and using a mailbox analysis tool to analyze the mailbox data to identify potential mailbox leakage risks;

[0029] Step S3: store and display the data analysis results of the data analysis module.

[0030] As a further optional solution of the Pipeline-based cyberspace asset mapping method, the data acquisition module is used to obtain IP addresses, scan ports, and identify the service types of open ports, specifically including:

[0031] Step S11: According to the given domain name or ICP filing information, obtain the relevant IP address through DNS resolution, WHOIS query and web crawler;

[0032] Step S12: Perform port scanning on the acquired IP address to identify open ports;

[0033] Step S13: using a variety of port detection packets to identify the service type of the open port.

[0034] As a further optional solution of the network space asset mapping method based on the Pipeline architecture, when the identified service type is a Web service, obtaining Web service information specifically includes:

[0035] Step S221: Send a request using the HTTP protocol to obtain response information of the Web service;

[0036] Step S222: Establish a connection using the SSL / TLS protocol to obtain TLS certificate information of the Web service, wherein the TLS certificate information includes the certificate issuing authority and the certificate validity period;

[0037] Step S223: using a fingerprint recognition tool to identify fingerprint information of the Web service, where the fingerprint information of the Web service includes a server type, an operating system, and a Web framework;

[0038] Step S224: Detecting domain name information, where the domain name information includes a domain name and a subdomain name;

[0039] Step S225, detecting the monitoring port information;

[0040] Step S226: Analyze the returned message information, including the HTTP response header and response body;

[0041] Step S227, record the size of the returned packet;

[0042] Step S228: extract certificate fingerprint information.

[0043] As a further optional solution of the network space asset mapping method based on the Pipeline architecture, the in-depth security test of the Web service information obtained in step S5 based on the vulnerability exploitation program and vulnerability scanning tool detection to determine whether there are relevant vulnerabilities specifically includes:

[0044] Obtain the type and fingerprint information of the target service from the Web service information;

[0045] According to the type and fingerprint information of the target service, select the corresponding vulnerability exploit from the vulnerability database;

[0046] Execute the selected vulnerability exploit on the target asset and perform a comprehensive scan of the target asset using vulnerability scanning tools;

[0047] Analyze the results of vulnerability exploit execution and the scan results of vulnerability scanning tools.

[0048] As a further optional solution of the network space asset mapping method based on the Pipeline architecture, the software code keywords are extracted according to the Web service information obtained in step S22, and related suspected code leakage data are searched in the code hosting platform according to the software code keywords, and the code in the code hosting platform is analyzed by using a code analysis tool to identify potential code leakage risks, which specifically includes:

[0049] According to the Web service information obtained in step S22, obtain the domain name and URL information;

[0050] Use text analysis technology to extract software code keywords from domain name and URL information;

[0051] Determine the code hosting platform to search;

[0052] Construct corresponding search query statements based on software code keywords and the code hosting platform to be searched;

[0053] Perform a search query on the selected code hosting platform to obtain a list of code repositories related to the software code keywords;

[0054] Use code analysis tools to analyze the searched code base and identify potential code leakage risks.

[0055] As a further optional solution of the network space asset mapping method based on the Pipeline architecture, the Web service information obtained in step S22 is used to extract file keywords, search for relevant file leakage risks on the cloud disk search platform, and use file analysis tools to analyze file contents and identify potential file leakage risks, which specifically includes:

[0056] According to the Web service information obtained in step S22, obtain the domain name and URL information;

[0057] Use text analysis technology to extract file keywords from domain name and URL information;

[0058] Use the extracted file keywords to construct query statements for the cloud disk search platform;

[0059] Submit the constructed query statement to the cloud disk search platform to perform the search operation and filter out files related to the file keywords;

[0060] Use file analysis tools to conduct in-depth analysis of collected files to identify sensitive information or leakage risks that may be contained in them.

[0061] A computing device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned Pipeline architecture-based cyberspace asset mapping method are implemented.

[0062] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned method for network space asset mapping based on the Pipeline architecture.

[0063] The beneficial effects of the present invention are as follows: by constructing the Pipeline architecture, the system can efficiently connect various working modules in series to form an orderly data processing flow. This architecture enables seamless connection of various links such as data collection, analysis, storage and display, thereby improving the overall processing efficiency. The system adopts a modular design concept, and subdivides the work of cyberspace asset mapping into multiple independent modules, such as data collection module, data analysis module, etc. This design not only facilitates the maintenance and expansion of the system, but also enables each module to be optimized independently, further improving the system performance. The system covers the entire process from data collection to data display, and can comprehensively map cyberspace assets. Through the data collection module, the system can obtain relevant IP addresses, port information and service types, etc. Through the data analysis module, the system can further perform password enumeration. The system can automatically complete various links such as data collection, analysis, storage and display, reduce human intervention and improve work efficiency. At the same time, automated data processing can also reduce human errors and improve data accuracy and reliability. The system can display the collected and analyzed data in an intuitive and easy-to-understand way through the data display module, so that users can quickly understand the status of cyberspace assets. This flexible data display method helps users make better decisions and plans. The system can timely discover potential security risks and take corresponding measures to prevent them by performing analysis and processing such as vulnerability detection and sensitive information extraction. This enhanced security helps protect cyberspace assets from threats such as attacks and leaks. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0065] Figure 1 A schematic diagram of the composition of a network space asset mapping system based on the Pipeline architecture provided by an embodiment of the present invention;

[0066] Figure 2 A flowchart of a method for mapping cyberspace assets based on a Pipeline architecture is provided in accordance with an embodiment of the present invention. DETAILED DESCRIPTION

[0067] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] refer to Figure 1 to Figure 2 , a network space asset mapping system based on Pipeline architecture, specifically including:

[0069] Building modules for building Pipeline architecture;

[0070] Integration module, used to connect the work modules of cyberspace asset mapping in series according to the Pipeline architecture;

[0071] The working modules of cyberspace asset mapping include:

[0072] Data collection module, used to obtain relevant IP addresses based on given domain names or ICP filing information, and perform port scanning and service identification;

[0073] Data analysis module, used to analyze and process the collected data, including password enumeration, Web service information detection, vulnerability detection, sensitive information extraction, code leakage risk analysis, file leakage risk analysis, mobile terminal asset collection, supplier service provider information collection and mailbox data collection;

[0074] A data storage module, used to store collected and analyzed data;

[0075] The data display module is used to display the collected and analyzed data.

[0076] In this embodiment, by constructing a Pipeline architecture, the system can efficiently connect various working modules in series to form an orderly data processing flow. This architecture enables seamless connection of various links such as data collection, analysis, storage and display, thereby improving the overall processing efficiency. The system adopts a modular design concept and subdivides the work of cyberspace asset mapping into multiple independent modules, such as data collection module, data analysis module, etc. This design not only facilitates the maintenance and expansion of the system, but also enables each module to be optimized independently, further improving system performance. The system covers the entire process from data collection to data display, and can comprehensively perform cyberspace asset mapping. Through the data collection module, the system can obtain relevant IP addresses, port information and service types, etc. Through the data analysis module, the system can further perform password enumeration. , Web service information detection, vulnerability detection and other analysis and processing, so as to realize the comprehensive mapping of cyberspace assets. The system can automatically complete various links such as data collection, analysis, storage and display, reduce human intervention and improve work efficiency. At the same time, automated data processing can also reduce human errors and improve data accuracy and reliability. The system can display the collected and analyzed data in an intuitive and easy-to-understand way through the data display module, so that users can quickly understand the situation of cyberspace assets. This flexible data display method helps users to make better decisions and plans. The system can timely discover potential security risks and take corresponding measures to prevent them by performing analysis and processing such as vulnerability detection and sensitive information extraction. This enhanced security helps protect cyberspace assets from threats such as attacks and leaks.

[0077] Preferably, the working module of the cyberspace asset mapping further includes:

[0078] Task scheduling module, used to schedule the execution order of data acquisition module and data analysis module;

[0079] The plug-in management module is used to manage and load different types of data collection plug-ins and data analysis plug-ins.

[0080] In this embodiment, the task scheduling module allows the system to dynamically allocate and execute resources, and adjust the execution order of the data acquisition module and the data analysis module according to actual needs, which ensures that key tasks can be processed in a timely manner, thereby improving the overall data processing efficiency. Through reasonable task scheduling, the system can avoid overload during peak processing periods, optimize resource utilization, and maintain system stability and reliability; the plug-in management module enables the system to easily manage and load different types of plug-ins, such as data acquisition plug-ins, data analysis plug-ins, etc., which not only increases the functionality of the system, but also allows users to quickly customize and expand system functions according to actual needs. Through the plug-in approach, the various functional modules of the system are relatively independent, reducing the coupling between modules, which makes the system easier to maintain and upgrade, and reduces the risk of system crashes due to changes in core code.

[0081] A network space asset mapping method based on Pipeline architecture, the method is based on the network space asset mapping system based on Pipeline architecture, and specifically includes:

[0082] Step S1, obtaining IP addresses, port scanning and identifying service types of open ports based on the data acquisition module;

[0083] Step S2: performing data analysis based on the data analysis module, specifically:

[0084] Step S21: When the identified service type is a database or a message queue, password enumeration is used to detect whether there is a default password, thereby determining whether there is a security risk in the target asset;

[0085] Step S22: when the identified service type is a Web service, obtain Web service information;

[0086] Step S23: Performing an in-depth security test on the Web service information obtained in step S5 based on vulnerability exploitation programs and vulnerability scanning tools to determine whether there are related vulnerabilities;

[0087] Step S24: According to the Web service information obtained in step S22, the domain name information in the URL is obtained, and the historical archived URLs under the domain name are obtained, and sensitive information is identified by using regular expression matching and machine learning models;

[0088] Step S25: extracting software code keywords based on the Web service information obtained in step S22, searching for related suspected code leakage data in the code hosting platform based on the software code keywords, and using code analysis tools to analyze the code in the code hosting platform to identify potential code leakage risks;

[0089] Step S26: extract file keywords based on the Web service information obtained in step S22, search for relevant file leakage risks on the cloud disk search platform, analyze the file content using a file analysis tool, and identify potential file leakage risks;

[0090] Step S27: Collect relevant mobile terminal assets from the enterprise search platform and analyze the security risks of mobile terminal applications;

[0091] Step S28: Use the customized dictionary to match sensitive information in the URL, and use the file analysis tool to analyze the file content to identify the file leakage risk associated with the URL;

[0092] Step S29: Collect relevant information about external suppliers and service providers of the enterprise and analyze supply chain security risks;

[0093] Step S210: extracting domain name data according to the Web service information obtained in step S22, using a mailbox collection tool to collect mailbox data related to the domain name, and using a mailbox analysis tool to analyze the mailbox data to identify potential mailbox leakage risks;

[0094] Step S3: store and display the data analysis results of the data analysis module.

[0095] Preferably, the data acquisition module is used to obtain IP addresses, scan ports, and identify the service types of open ports, specifically including:

[0096] Step S11: According to the given domain name or ICP filing information, obtain the relevant IP address through DNS resolution, WHOIS query and web crawler;

[0097] Step S12: Perform port scanning on the acquired IP address to identify open ports;

[0098] Step S13: using a variety of port detection packets to identify the service type of the open port.

[0099] In this embodiment, a variety of means (DNS resolution, WHOIS query, web crawler) are combined to obtain IP addresses, ensuring the comprehensiveness and accuracy of IP address information, automatically collecting data from multiple sources, improving the efficiency of data collection, being able to cope with different network environments and domain name information, and increasing the flexibility of the mapping method; through port scanning, potential attack entrances can be discovered, providing a basis for subsequent security analysis and protection, and identifying open ports helps to further understand the network structure and service configuration of the target system, providing important information for subsequent detailed mapping, and automated scanning reduces manual intervention, improving the efficiency and accuracy of mapping; through professional port detection packages, the specific service type of the open port can be more accurately identified, providing a detailed basis for subsequent security assessments, and after understanding the service type, subsequent security testing and analysis can be more targeted, such as vulnerability scanning and attack simulation for specific services, and different security policies are formulated for different service types, thereby enhancing the overall security of cyberspace assets.

[0100] Preferably, when the identified service type is a Web service, obtaining Web service information specifically includes:

[0101] Step S221: Send a request using the HTTP protocol to obtain response information of the Web service;

[0102] Step S222: Establish a connection using the SSL / TLS protocol to obtain TLS certificate information of the Web service, wherein the TLS certificate information includes the certificate issuing authority and the certificate validity period;

[0103] Step S223: using a fingerprint recognition tool to identify fingerprint information of the Web service, where the fingerprint information of the Web service includes a server type, an operating system, and a Web framework;

[0104] Step S224: Detecting domain name information, where the domain name information includes a domain name and a subdomain name;

[0105] Step S225, detecting the monitoring port information;

[0106] Step S226: Analyze the returned message information, including the HTTP response header and response body;

[0107] Step S227, record the size of the returned packet;

[0108] Step S228: extract certificate fingerprint information.

[0109] In this embodiment, by sending a request using the HTTP protocol, the real-time response information of the Web service can be directly obtained to ensure the accuracy and real-time nature of the information. At the same time, by establishing a connection in combination with the SSL / TLS protocol, the TLS certificate information is obtained, which further verifies the security of the Web service, including the certificate authority and the validity period of the certificate, which helps to evaluate the trust and security of the service; the fingerprint recognition tool is used to deeply identify the Web service, including key information such as the server type, operating system, and Web framework. This information is crucial for understanding the architecture, performance, and potential security risks of the Web service, and provides an important basis for subsequent security assessment and optimization; by detecting domain name information and listening port information, It can fully understand the network topology and communication methods of Web services, which is of great significance for discovering potential security risks such as domain name hijacking and port scanning, and also provides a target range for subsequent vulnerability scanning and penetration testing; analyzing the returned message information, including HTTP response header, response body, etc., helps to understand the response speed, content quality and potential sensitive information leakage risks of Web services. At the same time, recording the size of the returned package can provide a reference for evaluating network bandwidth consumption and performance optimization; extracting certificate fingerprint information provides an important basis for the identity authentication and certificate management of Web services. By comparing certificate fingerprints, the risk of certificate tampering or forgery can be discovered in a timely manner, thereby ensuring the legitimacy and security of Web services.

[0110] Preferably, the in-depth security test of the Web service information obtained in step S5 based on the vulnerability exploitation program and the vulnerability scanning tool to determine whether there are relevant vulnerabilities specifically includes:

[0111] Obtain the type and fingerprint information of the target service from the Web service information;

[0112] According to the type and fingerprint information of the target service, select the corresponding vulnerability exploit from the vulnerability database;

[0113] Execute the selected vulnerability exploit on the target asset and perform a comprehensive scan of the target asset using vulnerability scanning tools;

[0114] Analyze the results of vulnerability exploit execution and the scan results of vulnerability scanning tools.

[0115] In this embodiment, by first obtaining the type and fingerprint information of the target service, the specific characteristics and possible weaknesses of the target asset can be accurately located, providing a clear direction for subsequent vulnerability detection; according to the type and fingerprint information of the target service, the corresponding vulnerability exploit is selected from the vulnerability database. This targeted selection greatly improves the efficiency of vulnerability detection and avoids unnecessary extensive attempts; combining the execution of the vulnerability exploit and the comprehensive scan of the vulnerability scanning tool, it can cover a variety of vulnerability types that may exist in the target asset, ensuring the comprehensiveness and accuracy of the security test; through in-depth analysis of the execution results of the vulnerability exploit and the scanning results of the vulnerability scanning tool, not only known vulnerabilities can be discovered, but also new and not widely reported security issues may be discovered, further enhancing the value of security testing; timely analysis results can provide enterprises with immediate security feedback, help enterprises quickly respond to and deal with discovered security issues, and reduce potential security risks.

[0116] Preferably, extracting software code keywords according to the Web service information obtained in step S22, searching for related suspected code leakage data in the code hosting platform according to the software code keywords, analyzing the code in the code hosting platform using a code analysis tool, and identifying potential code leakage risks specifically include:

[0117] According to the Web service information obtained in step S22, obtain the domain name and URL information;

[0118] Use text analysis technology to extract software code keywords from domain name and URL information;

[0119] Determine the code hosting platform to search;

[0120] Construct corresponding search query statements based on software code keywords and the code hosting platform to be searched;

[0121] Perform a search query on the selected code hosting platform to obtain a list of code repositories related to the software code keywords;

[0122] Use code analysis tools to analyze the searched code base and identify potential code leakage risks.

[0123] In this embodiment, the software code keywords extracted from the Web service information using text analysis technology can more accurately reflect the software composition of the target asset, which is helpful for subsequent accurate search on the code hosting platform; constructing search query statements based on the extracted software code keywords can quickly locate the relevant code base in the code hosting platform (such as GitHub, GitLab, SearchCode, etc.), improving the search efficiency and accuracy; using code analysis tools to conduct in-depth analysis of the searched code base can identify potential code leakage risks, such as unprotected sensitive information, unauthorized code disclosure, etc., thereby providing an important basis for enterprises to take protective measures in a timely manner; this technical solution not only focuses on the security of the Web service itself, but also enhances the security protection capabilities of the entire information system through the identification and response of code leakage risks, and reduces the risk of security incidents caused by code leakage. It should be noted that the software code keywords include project name, technology stack, developer information, etc.

[0124] Preferably, the method of extracting file keywords based on the Web service information obtained in step S22, searching for relevant file leakage risks on the cloud disk search platform, analyzing the file content using a file analysis tool, and identifying potential file leakage risks specifically includes:

[0125] According to the Web service information obtained in step S22, obtain the domain name and URL information;

[0126] Use text analysis technology to extract file keywords from domain name and URL information;

[0127] Use the extracted file keywords to construct query statements for the cloud disk search platform;

[0128] Submit the constructed query statement to the cloud disk search platform to perform the search operation and filter out files related to the file keywords;

[0129] Use file analysis tools to conduct in-depth analysis of collected files to identify sensitive information or leakage risks that may be contained in them.

[0130] In this embodiment, through text analysis technology, file keywords are accurately extracted from the domain name and URL information obtained from the Web service information. These keywords can accurately reflect the content and type of the file and provide effective guidance for subsequent searches; query statements are constructed using the extracted file keywords, and search operations are performed on the cloud disk search platform. This keyword-based search method can quickly locate files related to potential leakage risks, significantly improving search efficiency and accuracy; the collected files are deeply analyzed through file analysis tools to identify sensitive information or leakage risks that may be contained therein. This process is not limited to simple text matching, but also includes comprehensive considerations of file content, structure, metadata, etc. to ensure that potential leakage risks can be fully discovered; once a file leakage risk is discovered, the technical solution can issue an early warning in a timely manner and provide corresponding countermeasures, which helps enterprises or organizations take remedial measures in a timely manner to prevent the further spread of sensitive information and reduce losses caused by leakage incidents; the entire process from keyword extraction, search query, file analysis to risk warning has achieved automation and intelligent processing, which greatly improves work efficiency, reduces manual burden, and also reduces the possibility of human error. It should be noted that the file keywords include company name, project name, file name suffix, etc.

[0131] A computing device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned Pipeline architecture-based cyberspace asset mapping method are implemented.

[0132] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned method for network space asset mapping based on the Pipeline architecture.

[0133] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0134] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network space asset mapping system based on Pipeline architecture, characterized in that: Specifically include: Building modules for building Pipeline architecture; Integration module, used to connect the work modules of cyberspace asset mapping in series according to the Pipeline architecture; The working modules of cyberspace asset mapping include: Data collection module, used to obtain relevant IP addresses based on given domain names or ICP filing information, and perform port scanning and service identification; Data analysis module, used to analyze and process the collected data, including password enumeration, Web service information detection, vulnerability detection, sensitive information extraction, code leakage risk analysis, file leakage risk analysis, mobile terminal asset collection, supplier service provider information collection and mailbox data collection; A data storage module, used to store collected and analyzed data; The data display module is used to display the collected and analyzed data.

2. According to the Pipeline architecture-based cyberspace asset mapping system of claim 1, it is characterized in that: The working module of the cyberspace asset mapping also includes: Task scheduling module, used to schedule the execution order of data acquisition module and data analysis module; The plug-in management module is used to manage and load different types of data collection plug-ins and data analysis plug-ins.

3. A network space asset mapping method based on Pipeline architecture, characterized in that: The method is based on the Pipeline architecture-based cyberspace asset mapping system according to any one of claims 1-2, and specifically includes: Step S1, obtaining IP addresses, port scanning and identifying service types of open ports based on the data acquisition module; Step S2: performing data analysis based on the data analysis module, specifically: Step S21: When the identified service type is a database or a message queue, password enumeration is used to detect whether there is a default password, thereby determining whether there is a security risk in the target asset; Step S22: when the identified service type is a Web service, obtain Web service information; Step S23: Performing an in-depth security test on the Web service information obtained in step S5 based on vulnerability exploitation programs and vulnerability scanning tools to determine whether there are related vulnerabilities; Step S24: According to the Web service information obtained in step S22, the domain name information in the URL is obtained, and the historical archived URLs under the domain name are obtained, and sensitive information is identified by using regular expression matching and machine learning models; Step S25: extracting software code keywords based on the Web service information obtained in step S22, searching for related suspected code leakage data in the code hosting platform based on the software code keywords, and using code analysis tools to analyze the code in the code hosting platform to identify potential code leakage risks; Step S26: extract file keywords based on the Web service information obtained in step S22, search for relevant file leakage risks on the cloud disk search platform, analyze the file content using a file analysis tool, and identify potential file leakage risks; Step S27: Collect relevant mobile terminal assets from the enterprise search platform and analyze the security risks of mobile terminal applications; Step S28: Use the customized dictionary to match sensitive information in the URL, and use the file analysis tool to analyze the file content to identify the file leakage risk associated with the URL; Step S29: Collect relevant information about external suppliers and service providers of the enterprise and analyze supply chain security risks; Step S210: extracting domain name data according to the Web service information obtained in step S22, using a mailbox collection tool to collect mailbox data related to the domain name, and using a mailbox analysis tool to analyze the mailbox data to identify potential mailbox leakage risks; Step S3: store and display the data analysis results of the data analysis module.

4. According to the Pipeline architecture-based cyberspace asset mapping method of claim 3, it is characterized in that: The data acquisition module is used to obtain IP addresses, scan ports, and identify the service types of open ports, specifically including: Step S11: According to the given domain name or ICP filing information, obtain the relevant IP address through DNS resolution, WHOIS query and web crawler; Step S12: Perform port scanning on the acquired IP address to identify open ports; Step S13: using a variety of port detection packets to identify the service type of the open port.

5. According to the Pipeline architecture-based cyberspace asset mapping method of claim 4, it is characterized in that: When the identified service type is a Web service, obtaining Web service information specifically includes: Step S221: Send a request using the HTTP protocol to obtain response information of the Web service; Step S222: Establish a connection using the SSL / TLS protocol to obtain TLS certificate information of the Web service, wherein the TLS certificate information includes the certificate issuing authority and the certificate validity period; Step S223: using a fingerprint recognition tool to identify fingerprint information of the Web service, where the fingerprint information of the Web service includes a server type, an operating system, and a Web framework; Step S224: Detecting domain name information, where the domain name information includes a domain name and a subdomain name; Step S225, detecting the monitoring port information; Step S226: Analyze the returned message information, including the HTTP response header and response body; Step S227, record the size of the returned packet; Step S228: extract certificate fingerprint information.

6. According to the Pipeline architecture-based cyberspace asset mapping method of claim 5, it is characterized in that: The in-depth security test of the Web service information obtained in step S5 based on the vulnerability exploitation program and the vulnerability scanning tool to detect whether there are relevant vulnerabilities specifically includes: Obtain the type and fingerprint information of the target service from the Web service information; According to the type and fingerprint information of the target service, select the corresponding vulnerability exploit from the vulnerability database; Execute the selected vulnerability exploit on the target asset and perform a comprehensive scan of the target asset using vulnerability scanning tools; Analyze the results of vulnerability exploit execution and the scan results of vulnerability scanning tools.

7. The method for mapping cyberspace assets based on Pipeline architecture according to claim 6 is characterized in that: The method of extracting software code keywords based on the Web service information obtained in step S22, searching for related suspected code leakage data in the code hosting platform based on the software code keywords, and using code analysis tools to analyze the code in the code hosting platform to identify potential code leakage risks specifically includes: According to the Web service information obtained in step S22, obtain the domain name and URL information; Use text analysis technology to extract software code keywords from domain name and URL information; Determine the code hosting platform to search; Construct corresponding search query statements based on software code keywords and the code hosting platform to be searched; Perform a search query on the selected code hosting platform to obtain a list of code repositories related to the software code keywords; Use code analysis tools to analyze the searched code base and identify potential code leakage risks.

8. The method for mapping cyberspace assets based on Pipeline architecture according to claim 7 is characterized in that: The method of extracting file keywords based on the Web service information obtained in step S22, searching for relevant file leakage risks on the cloud disk search platform, and using file analysis tools to analyze file contents and identify potential file leakage risks specifically includes: According to the Web service information obtained in step S22, obtain the domain name and URL information; Use text analysis technology to extract file keywords from domain name and URL information; Use the extracted file keywords to construct query statements for the cloud disk search platform; Submit the constructed query statement to the cloud disk search platform to perform the search operation and filter out files related to the file keywords; Use file analysis tools to conduct in-depth analysis of collected files to identify sensitive information or leakage risks that may be contained in them.

9. A computing device, characterized in that The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for network space asset mapping based on the Pipeline architecture described in claim 3 are implemented.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the Pipeline architecture-based cyberspace asset mapping method described in claim 3.

Images