Automatic generation system and method of enterprise IP asset portrait

Abstract

The invention relates to the technical field of asset portraits, and particularly discloses an automatic generation system and method for an enterprise IP asset portray.The method comprises the steps that description data items are collected, and a first description data item and all auxiliary description data items are extracted; performing embedded coding on the first description data item and each auxiliary description data item by using a data analysis and coding mode based on artificial intelligence; and intelligently obtaining an attribute tag of the first description data item based on the first description data item embedding feature and the auxiliary guide semantic enhancement representation between the auxiliary description data item embedding features, and repeating the steps until all description items are identified by the attribute tag. And generating an asset portrait of the enterprise target IP asset according to the set of the description data items and the attribute tags corresponding to the description data items. Therefore, massive and complicated IP asset information can be quickly processed, the time-consuming and labor-consuming problem caused by manual operation is avoided, and the timeliness of the information and the high efficiency of processing are ensured.

Description

Technical Field

[0001] The present application relates to the field of asset portrait technology, and more specifically, to a system and method for automatically generating enterprise IP asset portraits. Background Art

[0002] In today's era of rapid digital development, cyberspace has been deeply integrated into every aspect of corporate operations. As a key support for enterprises to conduct online business and realize intelligent management, the number of various devices or services with unique IP addresses (i.e. IP assets) has exploded. As the network environment becomes increasingly complex, security threats are also increasing. Enterprises urgently need to accurately grasp the detailed status of their IP assets in order to quickly locate and solve potential security issues.

[0003] However, traditional manual combing and analysis methods are unable to cope with the massive and complex IP asset information. On the one hand, manual processing is not only time-consuming and laborious, but also difficult to meet the needs of real-time updates in the face of thousands of devices and services in the enterprise network. As the scale of enterprises expands and the technical environment changes, this inefficient method has become a bottleneck for development. On the other hand, traditional analysis usually stays at the simple classification and recording of surface information, and cannot deeply explore the complex relationships and potential patterns between various descriptive data items. For example, different types of descriptive data items may imply important security risks, but manual analysis often finds it difficult to capture this deep information.

[0004] Therefore, an automatic generation solution for enterprise IP asset portraits is desired, which can help enterprises fully understand and optimize their IP assets and improve security and management efficiency by introducing more efficient, accurate and intelligent solutions. Summary of the invention

[0005] This application provides an automatic generation system and method for enterprise IP asset portraits, which can quickly process massive and complex IP asset information, avoid the time-consuming and labor-intensive problems caused by manual operations, and ensure the timeliness of information and the efficiency of processing. At the same time, this application can reveal the complex relationships and potential connections between the various descriptive data items, providing a more comprehensive and detailed understanding. This is crucial for formulating effective security strategies.

[0006] In a first aspect, a method for automatically generating an enterprise IP asset portrait is provided, comprising: Step 1: obtaining a set of descriptive data items of the enterprise's target IP assets.

[0007] Step 2: extracting a first description data item from the set of description data items and using other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data items.

[0008] Step 3: Embedding-encode the first description data item to obtain an embedded coding vector of the first description data item.

[0009] Step 4: embedding-encode each auxiliary description data item in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding-encoding vectors.

[0010] Step 5: Perform target data item modal prior semantic coding based on auxiliary information on the set of the first description data item embedding coding vector and the auxiliary description data item embedding coding vector to obtain a first description data item enhanced semantic coding vector.

[0011] Step 6: Enhance the semantic coding vector based on the first description data item to obtain an attribute label of the first description data item.

[0012] Step 7: Repeat steps 2 to 6 until all the description data items in the set of description data items are identified by attributes to obtain a set of attribute labels.

[0013] Step 8: Based on the set of descriptive data items of the enterprise target IP assets and the set of attribute tags, generate an asset portrait of the enterprise target IP assets.

[0014] In a second aspect, a system for automatically generating an enterprise IP asset portrait is provided, including: a description data item acquisition module, used to acquire a set of description data items of an enterprise target IP asset; a description data item classification module, used to extract a first description data item from the set of description data items and use other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data items; a first description data item embedding coding module, used to embed code the first description data item to obtain a first description data item embedding coding vector; an auxiliary description data item embedding coding module, used to embed code each auxiliary description data item in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; a target data item modality first module, used to extract a first description data item from the set of description data items and use other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; a target data item modality first module, used to extract a first description data item from the set of description data items and use other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; a target data item modality second ... A priori semantic coding module, used to perform target data item modal prior semantic coding based on auxiliary information on the set of the first description data item embedding coding vector and the auxiliary description data item embedding coding vector to obtain the first description data item enhanced semantic coding vector; a first description data item labeling module, used to obtain the attribute label of the first description data item based on the first description data item enhanced semantic coding vector; an attribute label set acquisition module, used to repeatedly execute steps 2 to 6 until all description data items in the set of description data items are identified by attributes to obtain a set of attribute labels; an asset portrait generation module, used to generate an asset portrait of the enterprise target IP asset based on the set of description data items of the enterprise target IP asset and the set of attribute labels.

[0015] The present application provides a system and method for automatically generating an enterprise IP asset portrait, which obtains a set of descriptive data items of the enterprise's target IP assets, extracts the first descriptive data item and the auxiliary descriptive data item to obtain a set of auxiliary descriptive data items, uses artificial intelligence-based data analysis and coding methods to embed and encode the first descriptive data item and each auxiliary descriptive data item, and then intelligently obtains the attribute label of the first descriptive data item based on the auxiliary guided semantic enhancement representation between the embedded features of the first descriptive data item and the embedded features of each auxiliary descriptive data item, and repeats the above steps until all descriptive items are marked with attribute labels, thereby generating an asset portrait of the enterprise's target IP assets according to the set of each descriptive data item and the attribute label corresponding thereto. The present application can quickly process massive and complex IP asset information, avoid the time-consuming and labor-intensive problems caused by manual operations, and ensure the timeliness of information and the efficiency of processing. At the same time, the present application can reveal the complex relationships and potential connections between the descriptive data items, and provide a more comprehensive and detailed understanding. This is crucial for formulating effective security policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings of the embodiments of the present application are briefly introduced below. Obviously, the drawings described below only relate to some embodiments of the present application, and are not intended to limit the present application.

[0017] Figure 1 This is a schematic flowchart of a method for automatically generating an enterprise IP asset portrait according to an embodiment of the present application.

[0018] Figure 2 A data flow diagram of the method for automatically generating an enterprise IP asset portrait according to an embodiment of the present application.

[0019] Figure 3 This is a schematic flowchart of step S5 in the method for automatically generating an enterprise IP asset portrait according to an embodiment of the present application.

[0020] Figure 4 This is a schematic flowchart of step S52 in the method for automatically generating an enterprise IP asset portrait according to an embodiment of the present application.

[0021] Figure 5 A schematic block diagram of a system for automatically generating an enterprise IP asset portrait according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work also fall within the scope of protection of the present application.

[0023] In view of the above technical problems, the technical concept of the present application is to obtain a set of descriptive data items of the target IP assets of the enterprise, and extract the first descriptive data item and the auxiliary descriptive data item to obtain a set of auxiliary descriptive data items, and use artificial intelligence-based data analysis and coding methods to embed and encode the first descriptive data item and each auxiliary descriptive data item respectively, and then intelligently obtain the attribute label of the first descriptive data item based on the auxiliary guided semantic enhancement representation between the embedded features of the first descriptive data item and the embedded features of each auxiliary descriptive data item, and repeat the above steps until all descriptive items are marked with attribute labels, so as to generate an asset portrait of the target IP assets of the enterprise according to the set of each descriptive data item and the corresponding attribute label. The present application can quickly process massive and complex IP asset information, avoid the time-consuming and labor-intensive problems caused by manual operation, and ensure the timeliness of information and the efficiency of processing. At the same time, the present application can reveal the complex relationships and potential connections between the descriptive data items, and provide a more comprehensive and detailed understanding. This is crucial for formulating effective security policies.

[0024] like Figure 1 and Figure 2 As shown, the method for automatically generating an enterprise IP asset portrait comprises: step 1: obtaining a set of description data items of the enterprise target IP assets; step 2: extracting a first description data item from the set of description data items and using other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data items; step 3: embedding coding the first description data item to obtain a first description data item embedding coding vector; step 4: embedding coding each auxiliary description data item in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; step 5: embedding coding the first description data item; The data item embedding coding vector and the set of auxiliary description data item embedding coding vectors are subjected to modal prior semantic coding of the target data item based on the auxiliary information to obtain an enhanced semantic coding vector of the first description data item; Step 6: Based on the enhanced semantic coding vector of the first description data item, an attribute label of the first description data item is obtained; Step 7: Repeat steps 2 to 6 until all description data items in the set of description data items are identified by attributes to obtain a set of attribute labels; Step 8: Based on the set of description data items of the enterprise target IP assets and the set of attribute labels, an asset portrait of the enterprise target IP assets is generated.

[0025] Exemplarily, in step 1, a set of descriptive data items of the target IP assets of the enterprise is obtained. It should be understood that only by fully understanding the IP asset information of the enterprise can the characteristics, status and potential security risks of these assets be further analyzed and understood. In this application, a set of descriptive data items of the target IP assets of the enterprise is obtained. The set of descriptive data items covers detailed information about each IP asset, such as network configuration, physical location, service type and other multi-dimensional data. By collecting this information, it can be ensured that all key attributes are accurately captured in the subsequent processing process, providing solid data support for generating accurate enterprise IP asset portraits.

[0026] In one embodiment, first, a network scanning tool or asset discovery tool is used to automatically detect all online IP addresses in the entire enterprise network. Such tools can continuously scan the network, identify newly added or deleted devices and services, and record their basic information, such as the IP address itself. Next, in order to gain a deeper understanding of the specific situation of each IP asset, more sophisticated technical means are needed, such as port scanning, service identification, operating system fingerprinting, etc., to obtain more detailed attribute information, including but not limited to geographic location, operator, affiliated unit, open ports, network layer and application layer protocols used, operating system name and version, etc.

[0027] Exemplarily, in step 2, the first description data item is extracted from the set of description data items and other description data items in the set of description data items are used as auxiliary description data items to obtain a set of auxiliary description data items. It should be understood that, considering that the description data items of the target IP assets of an enterprise are numerous and complex, different data items have different description properties, and their corresponding attribute labels are also different. If all data items are processed at the same time, it is easy to fall into confusion and it is difficult to grasp the key points and logical relationships. Therefore, in order to be able to adopt a more detailed and more characteristic analysis for different categories, and to combine other description data items for subsequent auxiliary operations, in the technical solution of the present application, the first description data item is extracted from the set of description data items and other description data items in the set of description data items are used as auxiliary description data items to obtain a set of auxiliary description data items. That is, extracting a first description data item is equivalent to determining a core focus point, and sorting out other related auxiliary description data items around it can carry out subsequent analysis in a more orderly manner and avoid the disorder of information processing.

[0028] Exemplarily, in step 3, the first description data item is embedded and encoded to obtain the first description data item embedded coding vector. It should be understood that, considering that the first description data item is often presented in a conventional format such as text, numerical value, etc. at first, and the computer is better at processing vectors, such as structured data forms, when performing complex data analysis and model operations, and the first description data item contains key characteristics about attribute labels. Based on this, in the present application, the first description data item is embedded and encoded to convert these non-numerical data into vector representations in a continuous space to obtain the first description data item embedded coding vector. In particular, in one embodiment, step 3 includes: embedding and encoding the first description data item using an IP asset description data item embedding matrix to obtain the first description data item embedded coding vector. That is to say, the IP asset description data item embedding matrix is ​​often constructed based on a large amount of prior knowledge or learning and analysis of data related to similar IP assets, and contains information such as commonalities and correlations between different IP asset description data items, and has a clear structure, and it can organize data according to certain rules and dimensions. For the first descriptive data item, embedded coding is achieved by performing interactive operations with this structured matrix, which can integrate these existing knowledge and associations into it, so that the encoded vector not only reflects the surface information of the descriptive data item itself, but also combines the general cognition and related connections in the industry, so as to better characterize the content of the data item.

[0029] Exemplarily, in step 4, each auxiliary description data item in the set of auxiliary description data items is embedded and encoded to obtain a set of auxiliary description data item embedded coding vectors. It should be understood that, considering that each auxiliary description data item itself contains rich information about various aspects of the enterprise's IP assets, but this information is often in a relatively primitive and intuitive text or numerical form, its inherent deep-level features are not easy to be directly discovered and utilized. Based on this, in the technical solution of the present application, each auxiliary description data item in the set of auxiliary description data items is embedded and encoded to mine the hidden features in these auxiliary description data items according to specific encoding rules and algorithms, and quantify and display them in the form of vectors to obtain a set of auxiliary description data item embedded coding vectors. In this way, it is helpful to have a more comprehensive and in-depth understanding of the association of these data items with the entire IP asset and their own unique properties. In particular, in one embodiment, step 4 includes: using the IP asset description data item embedding matrix to embed the auxiliary description data items in the set of auxiliary description data items to obtain a set of auxiliary description data item embedded coding vectors.

[0030] Exemplarily, in step 5, the set of the first description data item embedding coding vector and the auxiliary description data item embedding coding vector is subjected to the target data item modal prior semantic coding based on the auxiliary information to obtain the first description data item enhanced semantic coding vector. It should be understood that, considering that the first description data item embedding coding vector and each auxiliary description data item embedding coding vector respectively represent information of different angles and levels of the IP asset, and there are complex and deep semantic associations between the embedding features of each description data item, it is difficult to fully display these internal connections by relying solely on a simple embedding coding vector. Based on this, in order to be able to utilize the additional information provided by the auxiliary description data item to significantly enhance the expressive power of the first description data item so that it is not limited to surface features but can reflect a deeper semantic structure, the present application introduces a target data item modal prior semantic coding mechanism based on auxiliary information to enhance the first description data item embedding coding vector based on the set of the auxiliary description data item embedding coding vector to obtain the first description data item enhanced semantic coding vector. In this way, even if the first descriptive data item and the auxiliary descriptive data item have different focuses and properties, they can be reasonably compared and associated in the same semantic space, and the intrinsic connections between them that were originally difficult to discover due to modal differences can be excavated, greatly improving the depth and accuracy of their comprehensive analysis, thereby more comprehensively and meticulously excavating the semantic information related to the first descriptive data item.

[0031] In one embodiment, the step 5 includes: step 51: inputting the set of auxiliary description data item embedding coding vectors into the modal kernel feature extraction network to obtain the auxiliary description data item kernel feature coding vector; step 52: based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, clustering the set of auxiliary description data item embedding coding vectors across domains and fine-grained aggregation to obtain the first description data item enhanced semantic coding vector.

[0032] Exemplarily, in step 51, the set of auxiliary description data item embedding coding vectors is input into a modal kernel feature extraction network to obtain an auxiliary description data item kernel feature coding vector. Specifically, the process can be expressed as follows: ;in, is a set of embedding coding vectors of the auxiliary description data items, and are respectively the first, second, and third in the set of the auxiliary description data item embedded coding vectors. , and Auxiliary description data items are embedded in the coding vector, For Perform kernel feature extraction, represents the one-norm of the eigenvector, represents the number of vectors in the set of the auxiliary description data item embedded coding vectors minus one, yes The corresponding auxiliary description data item semantic difference value, Indicated by natural constant The exponential function with base , is the number of vectors in the set of the auxiliary description data items embedded in the coded vector, It is the kernel feature encoding vector that assists in describing the data item.

[0033] Specifically, after scanning all IP assets in the enterprise network, the system will obtain a large number of descriptive data items, including but not limited to device type, operating system, geographic location, port opening status, etc. Although these raw data are rich, they are disorganized and may cause information overload or noise interference if used directly for analysis. Therefore, it is necessary to embed and encode each descriptive data item first, and convert it into a low-dimensional dense vector form for computer processing. However, relying solely on simple embedding coding is not enough to reveal the deep connection between different descriptive data items, especially in the face of complex and changing enterprise network environments, a method that can deeply mine the internal patterns is needed. Therefore, the modal kernel feature extraction network is introduced. This network can not only reduce the dimension of the embedding coding vector of the auxiliary descriptive data item, but more importantly, it can extract the core features hidden under the surface while maintaining key information - the so-called "kernel features". For example, for the descriptive data items of a series of servers, the modal kernel feature extraction network can identify which parameters are closely related to security performance (such as firewall configuration, patch update frequency) and which are factors that affect service efficiency (such as CPU utilization, memory occupancy). By accurately extracting these core features, the system can better understand the unique nature of each IP asset and its role in the network architecture.

[0034] In one embodiment, Figure 3 As shown, the step 52, based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, performs clustering and cross-domain fine-grained aggregation on the set of the auxiliary description data item embedding coding vectors to obtain the first description data item enhanced semantic coding vector, including: step 521: determining the description data item prior clustering center coding vector based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector; step 522: inputting the description data item prior clustering center coding vector and the set of the auxiliary description data item embedding coding vector into the cluster center-based cross-domain fine-grained aggregation descriptor to obtain the first description data item enhanced semantic coding vector.

[0035] In one embodiment, the step 521, based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, determines the description data item prior cluster center coding vector, including: cascading the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, and performing a linear transformation on the cascaded first-auxiliary description data item embedding coding vector to obtain the description data item prior cluster center coding vector. Specifically, the process can be expressed as follows: ;in, For cascade operation, is the weight transformation matrix, is the bias vector, is a vector describing the prior cluster center encoding of the data item.

[0036] Specifically, after obtaining the embedding coding vector of the first descriptive data item, by introducing the kernel feature coding vector of the auxiliary descriptive data item, the system can more comprehensively understand the role and function of these descriptive data items in the entire enterprise network environment. When the data vectors from these two sources are cascaded, a multi-dimensional feature space is actually created, where each dimension represents a unique perspective or attribute, which helps to more carefully depict the unique fingerprint of each IP asset. Subsequently, by performing a linear transformation on the cascaded vector, the importance weights of each feature in this multi-dimensional space are further adjusted, so that the final descriptive data item prior cluster center coding vector can better reflect the actual distribution of IP assets in the real world and their internal connections.

[0037] In one embodiment, Figure 4 As shown, the step 522, inputting the set of the description data item prior cluster center encoding vector and the auxiliary description data item embedded encoding vector into the cross-domain fine-grained aggregation descriptor based on the cluster center to obtain the first description data item enhanced semantic encoding vector, includes: step 5221: using the semantic measurement module of the inverse hyperbolic cosine function to measure the semantic distance between each auxiliary description data item embedded encoding vector in the set of the auxiliary description data item embedded encoding vector and the description data item prior cluster center encoding vector to obtain a set of first-auxiliary description data item semantic measurement coefficients. Specifically, the process can be expressed as follows: ;in, is the square of the vector length, is the inverse hyperbolic cosine function, for and The first-auxiliary description data item semantic metric coefficient between them.

[0038] Step 5222: Use a binary function to perform clustering judgment on the set of semantic metric coefficients of the first auxiliary description data items to obtain a set of semantic clustering coefficients of the first auxiliary description data items. Specifically, the process can be expressed as follows: ;in, is the first auxiliary description data item in the set of semantic clustering coefficients The semantic clustering coefficient of the first-auxiliary description data item, is the preset threshold.

[0039] Step 5223: Based on the set of semantic clustering coefficients of the first-auxiliary description data items, the set of prior clustering center encoding vectors of the description data items and the set of embedded encoding vectors of the auxiliary description data items are aggregated to obtain the enhanced semantic encoding vector of the first description data item. Specifically, the process can be expressed by the formula: ;in, is the first auxiliary description data item in the set of semantic clustering coefficients The semantic clustering coefficient of the first-auxiliary description data item, It is the enhanced semantic coding vector of the first description data item.

[0040] Specifically, first, the semantic measurement module of the inverse hyperbolic cosine function (acosh) is used to measure the semantic distance. This is a nonlinear measurement method that can more accurately capture the similarity or difference between two vectors in high-dimensional space. For each auxiliary description data item embedding encoding vector, the semantic distance between it and the description data item prior cluster center encoding vector is calculated to form a set of measurement coefficients. These coefficients reflect the importance of each auxiliary description data item relative to the core description data item and its semantic proximity. Such a measurement method helps to identify the auxiliary information that is most relevant to the core description data item, providing a basis for subsequent fine-grained aggregation. Then, in order to further screen and organize these semantic measurement coefficients, a binary function is introduced to perform clustering judgment. This step converts the original continuous measurement coefficient into a discrete classification label, that is, the first-auxiliary description data item semantic clustering coefficient set. By setting a predefined threshold, it is possible to distinguish which auxiliary description data items are closely related core members and which are relatively independent or marginalized. This classification not only simplifies the data structure for subsequent processing, but also enhances the interpretability and operability of the system, making it easier for us to understand which auxiliary information really affects the properties of the core description data items. Finally, based on the set of semantic clustering coefficients after clustering judgment, the system performs an aggregation operation on the prior cluster center encoding vector of the description data item and the embedded encoding vector of all auxiliary description data items. This aggregation process is not just a simple superposition, but through weighted fusion, different weights are assigned according to the importance of each auxiliary description data item to ensure that more relevant and supportive information can occupy a larger proportion in the final enhanced semantic encoding vector. The resulting enhanced semantic encoding vector of the first description data item not only inherits the basic characteristics of the original description data item, but also incorporates rich semantic information from multiple auxiliary description data items, forming a more comprehensive and detailed new representation.

[0041] Exemplarily, in step 6, based on the enhanced semantic coding vector of the first descriptive data item, the attribute label of the first descriptive data item is obtained. In one embodiment, step 6 includes: inputting the enhanced semantic coding vector of the first descriptive data item into an attribute identification module based on a classifier to obtain the attribute label of the first descriptive data item. That is, the enhanced semantic coding vector of the first descriptive data item obtained by auxiliary coding using the set of the first descriptive data item embedded coding vector and the auxiliary descriptive data item embedded coding vector is classified, thereby utilizing the powerful discrimination ability of the classifier, which can intelligently obtain the attribute label of the first descriptive data item based on the various feature information contained in the vector and through the learned classification rules and patterns.

[0042] In one embodiment, the classifier-based attribute identification module can use a support vector machine (SVM) as a specific classifier. SVM is a powerful supervised learning model that is particularly good at processing data in high-dimensional space and can provide good generalization capabilities in the case of limited samples. It distinguishes data points of different categories by finding the optimal hyperplane, thereby assigning the most appropriate attribute label to each enhanced semantic coding vector. The attribute labels include the geographical location of the IP address, operator, affiliated unit, port / network layer protocol / application layer protocol, and operating system name type version.

[0043] Preferably, considering that the set of the first description data item embedding coding vector and the auxiliary description data item embedding coding vector respectively represent the embedding coding features of the first description data item and each auxiliary description data item, when performing modal prior semantic encoding of the target data item based on auxiliary information, the complexity of the embedding coding modal prior mechanism of the full sample domain relative to the single sample domain will lead to insufficient long-distance cross-domain fine-grained aggregation representation of the first description data item enhanced semantic coding vector, thereby reducing the expression effect of the first description data item enhanced semantic coding vector and affecting the accuracy of the attribute label of the first description data item obtained by its input into the classifier-based attribute identification module.

[0044] Thus, in one example, when the first description data item enhanced semantic coding vector is input into a classifier-based attribute identification module, the first description data item enhanced semantic coding vector is optimized, and the optimization includes the following steps: arranging the respective feature values ​​of the first description data item enhanced semantic coding vector in ascending order as a first description data item enhanced semantic sequential coding vector; The eigenvalue and The absolute value of the difference between the eigenvalues ​​is less than or equal to the distance difference hyperparameter , calculate the The eigenvalues ​​are similar to the The weighted sum between the eigenvalues ​​is the optimized Eigenvalue ,in, and respectively represent the first description data item enhanced semantic sequence encoding vector Eigenvalues ​​and Eigenvalues, and They represent different weight hyperparameters respectively.

[0045] In response to the first description data item enhancing the semantic order encoding vector The eigenvalue and The absolute value of the difference between the eigenvalues ​​is greater than the distance difference hyperparameter .

[0046] Calculate the square root of the sum of squares of all eigenvalues ​​of the enhanced semantic coding vector of the first description data item, multiply the square root by 2, and then divide it by the square of the length of the enhanced semantic coding vector of the first description data item to obtain the enhanced semantic space primitive value of the first description data item .

[0047] The first description data item is enhanced with a semantic space primitive value Multiply by the After the eigenvalue, calculate the product with the first The weighted reduction between the eigenvalues ​​is the optimized Eigenvalue , and They represent different weight hyperparameters respectively.

[0048] Combining the first description data item with the optimized semantic order encoding vector The eigenvalue is used to obtain an optimized first description data item enhanced semantic coding vector, wherein the first eigenvalue of the first description data item enhanced semantic sequential coding vector remains unchanged.

[0049] In this way, in order to address the problem of insufficient global cross-domain fine-grained aggregation representation capability of the feature set of the first descriptive data item enhanced semantic coding vector under a predetermined eigenvalue sequential distribution due to a long distance exceeding a predetermined local distribution interval threshold, the high-dimensional feature space primitive representation of the first descriptive data item enhanced semantic coding vector based on self-inner product fusion is used to capture the complex structure of the global network interaction of its eigenvalues, thereby reconstructing the cross-domain fine-grained aggregation relationship between the eigenvalues ​​of the first descriptive data item enhanced semantic coding vector by simulating scale-based high-dimensional feature space latent primitives, so as to achieve coding reconstruction of the real sequence distribution behavior of the first descriptive data item enhanced semantic coding vector under long distance, improve the coding expression effect of the first descriptive data item enhanced semantic coding vector, and improve the accuracy of the attribute label of the first descriptive data item obtained by inputting it into the classifier-based attribute identification module.

[0050] Exemplarily, in step 7, steps 2 to 6 are repeatedly performed until all the descriptive data items in the set of descriptive data items are identified by attributes to obtain a set of attribute labels. It should be understood that, considering that the set of descriptive data items of an enterprise's IP assets contains information that reflects the characteristics of the asset in many aspects, each data item plays an indispensable role in fully describing the IP assets. Only attribute identification of some descriptive data items cannot fully present the overall appearance of the IP assets. Therefore, in the technical solution of the present application, steps 2 to 6 are repeatedly performed until all the descriptive data items in the set of descriptive data items are identified by attributes to obtain a set of attribute labels. In this way, the entire set of descriptive data items can be traversed, and each data item is processed according to the corresponding process to ensure that no key information is omitted, and the analysis and attribute definition of all data items are realized, thereby laying the foundation for building a comprehensive and accurate IP asset portrait.

[0051] Exemplarily, in step 8, an asset portrait of the target IP assets of the enterprise is generated based on the set of descriptive data items of the target IP assets of the enterprise and the set of attribute labels. It should be understood that, considering that the set of descriptive data items of the target IP assets of the enterprise covers the original information of various aspects of the IP assets, including but not limited to network configuration, physical location, service type and other dimensions, it is a comprehensive and detailed description material of the IP assets. The attribute label set is a classification and definition of the attributes corresponding to each descriptive data item after a series of analysis and processing, which provides basic data for network security protection. Therefore, in order to comprehensively grasp the IP asset situation from multiple dimensions and generate a complete and accurate asset portrait based on this, the present application generates an asset portrait of the target IP assets of the enterprise based on the set of descriptive data items of the target IP assets of the enterprise and the set of attribute labels. In this way, the obtained asset portrait not only reflects the current asset status, but can also be used to analyze historical data and development trends, so as to quickly locate and solve potential security problems for enterprises.

[0052] Specifically, based on all descriptive data items and their corresponding attribute tags, the system begins to build an IP asset portrait of the enterprise. This process is not just a simple listing of the information of each asset, but to create a multi-dimensional visual representation so that users can intuitively understand the status of the entire network environment. In one embodiment, a map-like display is provided to show the location distribution of all known assets and the connection relationship between them. Alternatively, users can view more detailed information by clicking on a specific area or node. All assets in the enterprise are classified and summarized according to factors such as device type, operating system version, and service status, and presented in the form of a chart. For example, you can see how many Linux servers and how many Windows servers there are; which servers are under high load and which are idle. Combined with the latest security intelligence and vulnerability library, the security status of each asset is analyzed to identify potential risks. For example, a server is at risk of a known vulnerability due to failure to update patches in time. Tracking the change trend of assets over time helps administrators understand the evolution history of the system. For example, observe how many devices have been added over a period of time, or the change trajectory of certain key performance indicators. For a single asset, not only basic information is listed, but other related information is also displayed in association, such as domain name registration details, ICP filing information, etc. In addition, the detailed response package information after the asset request can also be displayed to provide more clues for troubleshooting.

[0053] In summary, the automatic generation method of the enterprise IP asset portrait according to the embodiment of the present application is explained, which obtains a set of descriptive data items of the enterprise target IP assets, and extracts the first descriptive data item and the auxiliary descriptive data item to obtain a set of auxiliary descriptive data items, uses artificial intelligence-based data analysis and encoding methods to embed and encode the first descriptive data item and each auxiliary descriptive data item respectively, and then intelligently obtains the attribute label of the first descriptive data item based on the auxiliary guided semantic enhancement representation between the embedded features of the first descriptive data item and the embedded features of each auxiliary descriptive data item, and repeats the above steps until all descriptive items are marked with attribute labels, thereby generating an asset portrait of the enterprise target IP asset according to the set of each descriptive data item and the attribute label corresponding thereto. The present application can quickly process massive and complex IP asset information, avoid the time-consuming and labor-intensive problems caused by manual operation, and ensure the timeliness of information and the efficiency of processing. At the same time, the present application can reveal the complex relationships and potential connections between the descriptive data items, and provide a more comprehensive and detailed understanding. This is crucial for formulating effective security policies.

[0054] Figure 5 Schematic block diagram of the automatic generation system of enterprise IP asset portrait according to the embodiment of the present application. Figure 5As shown, the automatic generation system 100 of the enterprise IP asset portrait includes: a description data item acquisition module 110, which is used to obtain a set of description data items of the enterprise target IP assets; a description data item classification module 120, which is used to extract a first description data item from the set of description data items and use other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data items; a first description data item embedding coding module 130, which is used to embed the first description data item to obtain a first description data item embedding coding vector; an auxiliary description data item embedding coding module 140, which is used to embed the respective auxiliary description data items in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; a target data item modal prior The semantic coding module 150 is used to perform target data item modal prior semantic coding based on auxiliary information on the set of the first description data item embedded coding vector and the auxiliary description data item embedded coding vector to obtain an enhanced semantic coding vector for the first description data item; the first description data item labeling module 160 is used to obtain an attribute label of the first description data item based on the enhanced semantic coding vector of the first description data item; the attribute label set acquisition module 170 is used to repeatedly execute steps 2 to 6 until all description data items in the set of description data items are identified by attributes to obtain a set of attribute labels; the asset portrait generation module 180 is used to generate an asset portrait of the enterprise target IP asset based on the set of description data items of the enterprise target IP asset and the set of attribute labels.

[0055] In one embodiment, the first description data item embedding coding module is used to: use the IP asset description data item embedding matrix to embed the first description data item to obtain the first description data item embedding coding vector.

[0056] Here, those skilled in the art can understand that the specific operations of each module and unit in the above-mentioned automatic generation system of enterprise IP asset portrait have been described in the above reference. Figures 1 to 4 The method for automatically generating an enterprise IP asset portrait has been described in detail in the description of the method, and therefore, its repeated description will be omitted.

[0057] An embodiment of the present application further provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer implements the methods in the above embodiments of the present application.

[0058] An embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer implements the methods in the above embodiments of the present application.

[0059] An embodiment of the present application also provides a chip, including a circuit, for executing the methods in the above embodiments of the present application.

[0060] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0061] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is a kind of association relationship that describes associated objects, indicating that three relationships can exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In this application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0062] The prefixes such as "first" and "second" used in the embodiments of the present application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers used to distinguish description objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0063] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0064] In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0065] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0066] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0067] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for automatically generating an enterprise IP asset portrait, characterized in that: The method comprises: step 1: obtaining a set of description data items of the target IP assets of an enterprise; step 2: extracting a first description data item from the set of description data items and using other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data items; step 3: embedding and coding the first description data item to obtain a first description data item embedding coding vector; step 4: embedding and coding each auxiliary description data item in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; step 5: performing target data item modal prior semantic coding based on auxiliary information on the first description data item embedding coding vector and the set of auxiliary description data item embedding coding vectors to obtain a first description data item enhanced semantic coding vector; step 6: obtaining an attribute label of the first description data item based on the enhanced semantic coding vector of the first description data item; step 7: repeating steps 2 to 6 until all description data items in the set of description data items are identified by attributes to obtain a set of attribute labels; step 8: generating an asset portrait of the target IP assets of the enterprise based on the set of description data items of the target IP assets of the enterprise and the set of attribute labels.

2. The method for automatically generating an enterprise IP asset portrait according to claim 1, characterized in that: The step 3 includes: using the IP asset description data item embedding matrix to embed the first description data item to obtain the first description data item embedding coding vector.

3. The method for automatically generating an enterprise IP asset portrait according to claim 2, characterized in that: The step 4 includes: using the IP asset description data item embedding matrix to embed code each auxiliary description data item in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors.

4. The method for automatically generating an enterprise IP asset portrait according to claim 3, characterized in that: The step 5 includes: inputting the set of auxiliary description data item embedding coding vectors into a modal kernel feature extraction network to obtain an auxiliary description data item kernel feature coding vector; based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, clustering the set of auxiliary description data item embedding coding vectors through cross-domain fine-grained aggregation to obtain the first description data item enhanced semantic coding vector.

5. The method for automatically generating an enterprise IP asset portrait according to claim 4, characterized in that: Based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, clustering and cross-domain fine-grained aggregation are performed on the set of the auxiliary description data item embedding coding vectors to obtain the first description data item enhanced semantic coding vector, including: determining the description data item prior clustering center coding vector based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector; inputting the description data item prior clustering center coding vector and the set of the auxiliary description data item embedding coding vector into a cross-domain fine-grained aggregation descriptor based on the cluster center to obtain the first description data item enhanced semantic coding vector.

6. The method for automatically generating an enterprise IP asset portrait according to claim 5, characterized in that: Based on the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, determining the description data item prior cluster center coding vector, including: cascading the first description data item embedding coding vector and the auxiliary description data item kernel feature coding vector, and performing a linear transformation on the cascaded first-auxiliary description data item embedding coding vector to obtain the description data item prior cluster center coding vector.

7. The method for automatically generating an enterprise IP asset portrait according to claim 6, characterized in that: The set of the prior cluster center encoding vectors of the description data items and the embedded encoding vectors of the auxiliary description data items are input into a cross-domain fine-grained aggregation descriptor based on the cluster center to obtain the enhanced semantic encoding vector of the first description data item, including: using a semantic measurement module of an inverse hyperbolic cosine function to perform semantic distance measurement on each auxiliary description data item embedded encoding vector in the set of auxiliary description data item embedded encoding vectors and the prior cluster center encoding vector of the description data item to obtain a set of first-auxiliary description data item semantic measurement coefficients; using a binary function to perform clustering judgment on the set of the first-auxiliary description data item semantic measurement coefficients to obtain a set of first-auxiliary description data item semantic clustering coefficients; based on the set of the first-auxiliary description data item semantic clustering coefficients, the set of the prior cluster center encoding vectors of the description data items and the embedded encoding vectors of the auxiliary description data items are aggregated to obtain the enhanced semantic encoding vector of the first description data item.

8. The method for automatically generating an enterprise IP asset portrait according to claim 7, characterized in that: The step 6 includes: inputting the enhanced semantic coding vector of the first description data item into a classifier-based attribute identification module to obtain an attribute label of the first description data item.

9. An automatic generation system for an enterprise IP asset portrait, comprising: A description data item acquisition module, used to acquire a set of description data items of the target IP assets of the enterprise; a description data item classification module, used to extract a first description data item from the set of description data items and use other description data items in the set of description data items as auxiliary description data items to obtain a set of auxiliary description data items; a first description data item embedding coding module, used to embed the first description data item to obtain a first description data item embedding coding vector; an auxiliary description data item embedding coding module, used to embed the respective auxiliary description data items in the set of auxiliary description data items to obtain a set of auxiliary description data item embedding coding vectors; a target data item modal prior semantic coding module, used to embed the first description data item embedding coding vector and the auxiliary description data item embedding coding vector; A set of auxiliary description data item embedding coding vectors is used to perform modal prior semantic coding of the target data item based on the auxiliary information to obtain an enhanced semantic coding vector of the first description data item; a first description data item labeling module is used to obtain an attribute label of the first description data item based on the enhanced semantic coding vector of the first description data item; an attribute label set acquisition module is used to repeatedly execute steps 2 to 6 until all description data items in the set of description data items are identified by attributes to obtain a set of attribute labels; an asset portrait generation module is used to generate an asset portrait of the enterprise target IP asset based on the set of description data items of the enterprise target IP asset and the set of attribute labels.

10. The automatic generation system of enterprise IP asset portrait according to claim 9 is characterized in that: The first description data item embedding coding module is used to: use the IP asset description data item embedding matrix to embed the first description data item to obtain the first description data item embedding coding vector.

Images