Object scanning methods, apparatus and related equipment

Abstract

A method, apparatus, and related devices for object scanning are disclosed, relating to the field of object scanning technology. In response to an object scanning request, multiple types of objects to be scanned are determined, with multiple objects of each type, such as ports, operating systems, etc. Then, multiple scanning tools are used to scan the multiple types of objects, obtaining scan results. Each of the multiple scanning tools uses a single thread or a single process to scan one type of object at a time. Finally, the scan results are output. Because the scanning tool uses only a single process or thread for each type of object, concurrent scanning traffic for the same type of object is avoided. This prevents interference between the receiving scan traffic, minimizing errors or omissions in the final scan results and thus improving the accuracy of object scanning.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an object scanning method, apparatus and related equipment. Background Technology

[0002] In real-world applications, there is often a need to scan multiple objects. For example, large enterprises may possess a vast number of network assets, such as ports, IP addresses, domain names, and applications. The number of ports may reach tens of billions. Furthermore, these network assets typically need to be scanned to ensure their security, such as by scanning and patching vulnerabilities in network assets to prevent hacker attacks.

[0003] Currently, scanning devices typically use multiple threads or processes to scan multiple objects concurrently in order to improve scanning efficiency. However, this method of concurrently scanning multiple objects is prone to interference between the generated scanning traffic, leading to errors or omissions in the scanning results, thus resulting in lower object scanning accuracy. Summary of the Invention

[0004] This application provides an object scanning method to improve the accuracy of object scanning while maintaining a high level of efficiency. Furthermore, this application also provides an object scanning apparatus, a computing device, a computer-readable storage medium, and a computer program product.

[0005] Firstly, this application provides an object scanning method, which can be executed by a corresponding object scanning device. Specifically, in response to an object scanning request, such as an object scanning request sent by a user through a client, the object scanning device determines multiple types of objects to be scanned, with multiple objects of each type. These objects may be, for example, ports, operating systems, etc. Then, the object scanning device uses multiple scanning tools to scan the multiple types of objects and obtains scanning results. Each of the multiple scanning tools uses a single thread or a single process to scan one type of object at a time, and the object scanning device finally outputs the scanning results.

[0006] Because the scanning tool utilizes only a single process or thread for each object type, concurrent scanning traffic for the same object type is avoided. This prevents interference between the scanning devices when receiving scan traffic, minimizing errors or omissions in the final scan results and thus improving the accuracy of object scanning. Furthermore, using multiple scanning tools to concurrently scan various object types ensures high overall scanning efficiency. Additionally, since each object type can be scanned using a single thread / process, the excessive scan traffic received by the object scanning device within the same time period prevents it from missing some scan traffic (which is discarded due to timeout), further reducing the chance of omissions and improving overall accuracy.

[0007] In one possible implementation, the multiple scanning tools include a first scanning tool and a second scanning tool, wherein the first scanning tool includes a first thread and a second thread, and the second scanning tool includes a third thread and a fourth thread; then, when the object scanning device uses the multiple scanning tools to scan multiple types of objects, specifically, in response to a first scanning command, the object scanning device uses the first thread in the first scanning tool to scan a first object belonging to a first type among the multiple types of objects; and, in response to the first scanning command, after the object scanning device finishes scanning the first object using the first thread, it uses the third thread in the second scanning tool to scan a third object belonging to a second type among the multiple types of objects, and in response to the second scanning command, it uses the second thread in the first scanning tool to scan a second object belonging to the first type among the multiple types of objects; after the object scanning device finishes scanning the third object using the third thread, the object scanning device then uses the fourth thread in the second scanning tool to scan a fourth object belonging to the second type among the multiple types of objects, where the multiple types include both the first type and the second type. In this way, for multiple threads in the scanning tool, the object scanning device controls the next thread to execute the object scanning process only after determining that the currently running thread has completed the scan. This can effectively avoid multiple threads concurrently scanning multiple objects of the same type at the same time, thereby improving the accuracy of scanning objects of that type.

[0008] In one possible implementation, the object scanning device can further detect whether the first thread has finished scanning the first object before using the second thread to scan the second object. During the period when the first thread has not finished scanning the first object, the second thread is in a dormant state. In this way, by controlling the threads in the scanning tool to be in a dormant state, the object scanning device can effectively avoid multiple threads concurrently scanning multiple objects of the same type at the same time, thereby improving the accuracy of scanning that type of object.

[0009] In one possible implementation, the scanned object may include any one or more of the following: operating system, port, interface, protocol, fingerprint feature, software, software vulnerability, network topology.

[0010] In one possible implementation, the scanned object is specifically the network topology corresponding to a local area network (LAN). When the object scanning device uses multiple scanning tools to scan various types of objects, it can specifically use one of these tools to scan devices within the LAN, obtaining routing information for those devices. During each scan, a thread / process within that scanning tool scans the routing information on the devices, thereby generating the LAN's network topology based on the obtained routing information. In this way, the object scanning device can obtain the desired LAN network topology by scanning the routing information of devices within the LAN.

[0011] In one possible implementation, when the object scanning device determines multiple types of objects to be scanned in response to an object scanning request, it may specifically parse out the identifiers of multiple types from the object scanning request and determine multiple objects belonging to multiple types based on the identifiers of multiple types, so that the multiple objects of multiple types can be accurately scanned using corresponding multiple scanning tools.

[0012] In one possible implementation, the object scanning device may also provide an interactive interface and generate an object scanning request in response to a user's selection of various types of identifiers on the interface. This allows the user to specify which types of objects to scan, thereby improving the flexibility and efficiency of object scanning; that is, the object scanning device may not need to scan objects of a type that the user has not selected.

[0013] In a second aspect, this application provides an object scanning apparatus, which includes modules for performing the object scanning method in the first aspect or any possible implementation of the first aspect.

[0014] Thirdly, this application provides a computing device including a processor and a memory. The processor and the memory communicate with each other. The processor executes instructions stored in the memory to cause the computing device to perform an object scanning method as described in the first aspect or any implementation thereof. It should be noted that the memory may be integrated into the processor or may be independent of the processor. The computing device may also include a bus. The processor is connected to the memory via the bus. The memory may include readable storage and random access memory.

[0015] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a computing device, cause the computing device to perform the operation steps of the object scanning method described in the first aspect or any implementation thereof.

[0016] Fifthly, this application provides a computer program product containing instructions that, when run on a computing device, causes the computing device to perform the operation steps of the object scanning method described in the first aspect or any implementation thereof.

[0017] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0018] Figure 1 A schematic diagram of the structure of an exemplary data processing system provided in this application;

[0019] Figure 2 A flowchart illustrating an object scanning method provided in this application;

[0020] Figure 3 This is a diagram illustrating the use of multiple threads to concurrently scan multiple types of objects;

[0021] Figure 4 A schematic diagram of the structure of an object scanning device provided in this application;

[0022] Figure 5 This is a schematic diagram of the hardware structure of a computing device provided in this application. Detailed Implementation

[0023] To improve the accuracy of object scanning while maintaining high efficiency, this application provides an object scanning method that uses only a single process or thread to scan each type of object, thus avoiding interference caused by concurrent scanning traffic for the same type of object and improving the accuracy of object scanning. At the same time, multiple processes or threads are used to scan multiple types of objects concurrently to ensure that the overall efficiency of object scanning remains at a high level.

[0024] The technical solutions in this application will now be described with reference to the accompanying drawings in the embodiments of this application.

[0025] See Figure 1 This is a schematic diagram of the structure of an exemplary data processing system according to Embodiment 1 of this application. Figure 1 As shown, the data processing system 10 includes a device cluster 100 and an object scanning device 200.

[0026] Device cluster 100 may include multiple devices. Figure 1 The example described uses devices 101, 102, 103, and 104 as examples. In actual applications, the number of devices included in the device cluster 100 is not limited to... Figure 1 The example shown. Devices in device cluster 100 can be computing devices (such as servers), storage devices (such as hard drives), or data forwarding devices (such as routers and switches), and there is no limitation on which. Multiple devices included in device cluster 100 can be of the same type or different types.

[0027] Furthermore, the multiple devices in the device cluster 100 can include various types of objects, such as the operating system running on each device, the ports on each device, and port protocols.

[0028] The object scanning device 200 is used to scan various types of objects on devices 101 to 104 and generate corresponding scan results. The object scanning device 200 can be configured with multiple scanning tools, such as... Figure 1 The scanning tools 201, 202, 203, and 204 shown are used to scan a specific type of object within the device cluster 100. For example, scanning tool 201 scans the operating system running on the device, scanning tool 202 scans ports on the device, scanning tool 203 scans the communication protocols used by the ports on the device, and scanning tool 204 scans the software on the device. Exemplarily, each scanning tool may include one or more processes, or one or more threads; and the scanning tool may be implemented using processes or threads, or in other ways including processes or threads.

[0029] During the scanning of objects in device cluster 100, object scanning device 200 responds to an object scanning request by first identifying multiple types of objects to be scanned. This object scanning request may be generated based on user instructions, and there may be multiple objects of each type. Then, object scanning device 200 uses multiple scanning tools to scan the identified multiple types of objects. Specifically, this can be done by interacting with devices 101 to 104 to complete the scan and obtain corresponding scan results. Each scanning tool uses a single thread / process to scan one type of object at a time. Finally, object scanning device 200 outputs the scan results, such as presenting the scan results to the user on an interactive interface.

[0030] Because the object scanning device 200 uses only a single process or thread for each scanning tool to scan each type of object during the scanning process of the device cluster 100, concurrent scanning traffic for the same type of object is avoided. This prevents interference between the object scanning device 200 and the receiving scanning traffic, minimizing errors or omissions in the final scan results and thus improving the accuracy of object scanning. Furthermore, the object scanning device 200 utilizes multiple scanning tools to perform concurrent scanning of various object types, ensuring a high overall efficiency for object scanning.

[0031] In addition, since each type of object is scanned using a single thread / process, this can effectively prevent the object scanning device 200 from receiving too much scanning traffic in the same time period, which would cause the object scanning device 200 to miss some scanning traffic in time (this part of the scanning traffic is discarded due to reception timeout). This can further prevent the omission of scanning results and thus further improve the accuracy of object scanning.

[0032] For example, the object scanning device 200 described above can be implemented by software or hardware.

[0033] In the first example, when implemented in software, the object scanning device 200 can be implemented through at least one of a virtual machine, container, or application. Furthermore, the object scanning device 200 can be deployed on a single device within the device cluster 100, or it can be deployed on a physical device independent of the device cluster 100; there is no limitation on this.

[0034] In the second example, when implemented in hardware, the object scanning device 200 can be implemented using at least one physical device including a processor, such as a server. The processor can be a central processing unit (CPU), or any combination of an application-specific integrated circuit (ASIC), a programmable logic device (PLD), a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), a system-on-chip (SoC), a software-defined infrastructure (SDI) chip, an artificial intelligence (AI) chip, and a data processing unit (DPU). Furthermore, the object scanning device 200 can include one or more processors, and the types of processors can be one or more. The specific number and types of processors can be determined according to the actual application's business requirements; this embodiment does not impose such limitations. Furthermore, the object scanning device 200 can be a device in the device cluster 100, or it can be a physical device independent of the device cluster 100, and there is no limitation on this.

[0035] It is worth noting that the above Figure 1 The data processing system 10 shown is merely an illustrative example and is not intended to limit the scope of the system. For instance, other possible data processing systems 10 may include other devices, such as devices for recording object scan logs or devices for interacting with users. Alternatively, in other possible data processing systems 10, the object scanning device 200 may not integrate multiple scanning tools, allowing the object scanning device 200 to scan various types of objects in the device cluster 100 by invoking these multiple scanning tools. Alternatively, in other possible data processing systems 10, the objects scanned by the object scanning device 200 may reside in one or more virtual machines / containers on the device, meaning that the virtual machines / containers in the device cluster 100 can be treated as individual devices within the device cluster 100. This application does not limit the specific architecture of the data processing system 10.

[0036] For ease of understanding, embodiments of the object scanning method provided in this application will be described below with reference to the accompanying drawings.

[0037] See Figure 2 , Figure 2 This is a flowchart illustrating an object scanning method provided in an embodiment of this application. This method can be applied to... Figure 1 The data processing system 10 described above can also be applied to other applicable data processing systems. For ease of explanation, this embodiment applies to... Figure 1 The data processing system 10 shown is used as an example for illustration.

[0038] in, Figure 2 The object scanning method shown may specifically include:

[0039] S201: In response to an object scanning request, the object scanning device 200 determines multiple types of objects to be scanned, and the number of each type of object is multiple.

[0040] In this embodiment, the object scanning device 200 can start the scanning process for various types of objects in the device cluster 100 when triggered by an object scanning request.

[0041] As examples, device cluster 100 includes various types of objects, such as operating systems running on devices within device cluster 100, ports on devices, interfaces on devices, protocols used by ports on devices, fingerprints on devices (such as webpage fingerprints), software on devices (such as malware), software vulnerabilities, any combination of objects in the network topology of device cluster 100, or other types of objects, without limitation. Furthermore, the number of each type of object in device cluster 100 can be multiple; for example, each device may include multiple ports or run multiple software programs.

[0042] In a first possible implementation, when a user (such as an operations and maintenance personnel) needs to scan objects in the device cluster 100, they can generate an object scanning request through a user-side terminal device or client, and send the object scanning request to the object scanning device 200 through the terminal device or client.

[0043] For example, the object scanning device 200 can present an interactive interface to the user through a client or user-side terminal device. This interface displays various types of identifiers (such as type names), which indicate the type of objects that can be scanned in the device cluster 100. The user can then select from these identifiers on the interface. The selected type can be the type of all scannable objects in the device cluster 100, or it can be the type of some scannable objects. Specifically, the user can select some or all types of identifiers on the interface based on the actual application requirements. In this way, the user-side terminal device or client can generate an object scanning request containing multiple identifiers based on the user's selection of identifiers on the interface. Each identifier indicates a type. The terminal device or client can then send the object scanning request to the object scanning device 200, so that the object scanning device 200 can execute the corresponding object scanning process upon triggering the object scanning request.

[0044] In a second possible implementation, the object scanning device 200 can directly interact with users (such as maintenance personnel). Specifically, it can use its display module to present an interactive interface to the user, displaying various types of icons so that the user can select from them. In this way, the object scanning device 200 can generate an object scanning request including multiple icons based on the user's selection, with each icon indicating a type. Upon triggering the object scanning request, the object scanning device 200 will then execute the corresponding object scanning process.

[0045] Then, the object scanning device 200 can parse various types of identifiers from the object scanning request, and based on these identifiers, determine multiple objects belonging to these multiple types in the device cluster 100. These multiple objects are the objects that the object scanning device 200 needs to scan. In this way, the object scanning device 200 can complete the corresponding object scanning process according to the user's actual application needs, thereby reducing unnecessary object scanning processes, reducing resource consumption, and improving scanning efficiency.

[0046] S202: The object scanning device 200 uses multiple scanning tools to scan multiple types of objects and obtain scanning results. Each scanning tool uses a single thread or a single process to scan one type of object at a time.

[0047] For example, a scanning tool may be implemented through a thread or process, or through a processor that includes threads or processes, etc.

[0048] After determining the objects to be scanned, the object scanning device 200 can use corresponding scanning tools to scan multiple objects of each type and obtain corresponding scan results. Each scanning tool can be responsible for scanning objects of one type. Furthermore, each scanning tool scans objects using only a single thread or a single process at a time; correspondingly, the object scanning device 200 receives a single data stream (i.e., scan traffic) obtained from the single thread / process scan of that scanning tool, thus avoiding the object scanning device 200 receiving multiple interfering data streams when scanning objects of the same type. This embodiment provides two implementation examples of using multiple scanning tools to scan multiple types of objects.

[0049] In the first implementation example, each scanning tool includes only one thread or only one process. Therefore, for multiple objects of each type, the object scanning device 200 can sequentially scan these multiple objects using one thread / process from the corresponding scanning tool. This ensures that the scanning traffic generated by the object scanning device 200 for each type of object is serial traffic, without concurrent traffic, thereby improving the accuracy of scanning objects of that type. Furthermore, multiple scanning tools can concurrently scan multiple different types of objects to improve the efficiency of object scanning. Specifically, when a scanning tool includes one process, that process includes one thread; or, the process includes multiple threads, but at most one thread can be scanning objects at any given time.

[0050] In the second implementation example, each scanning tool includes multiple threads or multiple processes. It is understood that if a scanning tool simultaneously utilizes multiple threads / processes to concurrently scan multiple objects of the same type, concurrent traffic will be generated, affecting the accuracy of the object scanning. Therefore, for each scanning tool, the object scanning device 200 uses only one thread / process from the multiple threads / processes included in the scanning tool to scan objects at a time, so that the scanning tool can avoid generating concurrent traffic within the same time period.

[0051] The object scanning device 200 can control multiple scanning tools to scan multiple types of objects concurrently by issuing scanning commands, and can also control each scanning tool to scan objects using a thread / process at the same time.

[0052] Specifically, regarding the first and second scanning tools among multiple scanning tools, it is assumed that both the first and second scanning tools use threads to scan objects, and the multiple threads in the first scanning tool include the first thread and the second thread, while the multiple threads in the second scanning tool include the third thread and the fourth thread.

[0053] During object scanning, the object scanning device 200 can first generate a first scanning instruction. The first scanning instruction includes operation instruction 1 and operation instruction 2, which respectively instruct the first scanning tool and the second scanning tool to execute the object scanning process sequentially. Specifically, it instructs the second scanning tool to begin executing the object scanning process after the first scanning tool completes its initial scan, and instructs the thread used by each scanning tool when scanning objects. Responding to operation instruction 1 in the first scanning instruction, the object scanning device 200 first uses the first thread in the first scanning tool to scan a first object belonging to a first type among various object types. This first object can be one or more objects, and when there are multiple first objects, the first thread can scan these multiple objects sequentially. During the scanning of the first object by the first thread, the object scanning device 200 can receive the corresponding scan traffic.

[0054] During the process of the object scanning device 200 responding to the first scan command, the object scanning device 200 can continuously monitor whether the first thread has completed scanning the first object. If the scan is not completed, the object scanning device 200 waits for the first thread to complete scanning the first object, and during the waiting process, the second thread is in a dormant state. If the scan is completed, the object scanning device 200 continues to respond to operation command 2 in the first scan command, and uses the third thread in the second scanning tool to scan the third object of the second type among multiple types of objects. At the same time, the object scanning device 200 can generate a second scan command, which includes operation command 3 and operation command 4, respectively instructing the first scanning tool and the second scanning tool to execute the object scanning process in sequence, and instructing the thread used by each scanning tool when scanning objects. The object scanning device 200 responds to operation command 3 in the second scan command, and uses the second thread in the first scanning tool to scan the second object of the first type. At this time, the first scanning tool and the second scanning tool scan different types of objects in parallel.

[0055] During the process of the object scanning device 200 responding to the second scan command, the object scanning device 200 can continuously monitor whether the second thread has completed scanning the second object. If the scan is not completed, the object scanning device 200 waits for the second thread to complete scanning the second object. If the scan is completed, the object scanning device 200 can detect whether the third thread has completed scanning the third object. If so, the object scanning device 200 can continue to respond to operation command 4 in the second scan command and use the fourth thread in the second scanning tool to scan the fourth object belonging to the second type. If the second thread finishes scanning but the third thread has not finished scanning, the object scanning device 200 can wait for the third thread to complete scanning the third object. After the third thread finishes scanning, the object scanning device 200 then uses the fourth thread in the second scanning tool to scan the fourth object. In this way, for multiple threads in the scanning tool, the object scanning device 200 controls the next thread to execute the object scanning process only after determining that the currently running thread has completed scanning, which can effectively avoid multiple threads concurrently scanning multiple objects of the same type at the same time, thereby improving the accuracy of scanning this type of object.

[0056] For ease of understanding, the following example uses an object scanning device 200. Figure 1 The following example illustrates how four scanning tools can simultaneously scan multiple types of objects.

[0057] like Figure 3 As shown, the object scanning device 200 can use scanning tools 201 to 204 to scan the operating system, ports, protocols, and software vulnerabilities in the device cluster 100, respectively. The object scanning device 200 can first generate scan command 1 and, in response to scan command 1, use thread 201-1 in scanning tool 201 to scan the operating system on device 101; correspondingly, the object scanning device 200 can receive the packets (i.e., scan traffic) returned by device 101 regarding the operating system. Furthermore, in the process of responding to scan command 1, the object scanning device 200 will also sequentially control thread 202-1 in scanning tool 202 to scan the ports on device 101, control thread 203-1 in scanning tool 203 to scan the protocols used by the ports on device 101, and control thread 204-1 in scanning tool 204 to scan for software vulnerabilities on device 101. Each thread, from 201-1 to 204-1, executes the next thread only after the previous thread has finished executing.

[0058] After thread 201-1 completes its scan of the operating system on device 101, object scanning device 200 generates and responds to scan command 2. During the response to scan command 2, object scanning device 200 sequentially controls thread 201-2 in scanning tool 201 to scan the operating system on device 102, controls thread 202-2 in scanning tool 202 to scan the ports on device 102, controls thread 203-2 in scanning tool 203 to scan the protocols used by the ports on device 102, and controls thread 204-2 in scanning tool 204 to scan for software vulnerabilities on device 102. Correspondingly, object scanning device 200 can sequentially receive packets (i.e., scan traffic) from device 102 for various scanned objects. Threads 201-2 to 204-2 execute only after the previous thread has finished executing. Furthermore, during the response to scan command 2, before executing the currently executing thread (one of threads 201-2 to 204-2), the object scanning device 200 can detect whether other threads are currently scanning objects of the same type. If so, the object scanning device 200 can wait for other threads to continue their scanning process, and only after those other threads have finished scanning will it control the currently executing thread to begin scanning the object. For example, before executing thread 202-2, the object scanning device 200 can first check whether thread 202-1 has completed port scanning. If it has not completed scanning, thread 202-2 will be in a sleep state, and the object scanning device 200 will wait for thread 202-1 to continue its scanning process until thread 202-1 completes port scanning. At this point, the object scanning device 200 will begin using thread 202-2 in the scanning tool 202 to scan the ports on device 102 (other threads are similar), such as... Figure 3 As shown, after thread 201-2 finishes execution, thread 202-2 will wait for a period of time before starting the scanning process.

[0059] After thread 201-2 completes its scan, object scanning device 200 can generate and respond to scan command 3. During the response to scan command 3, object scanning device 200 sequentially controls thread 201-3 in scanning tool 201 to scan the operating system on device 103, controls thread 202-3 in scanning tool 202 to scan the ports on device 103, controls thread 203-3 in scanning tool 203 to scan the protocols used by the ports on device 103, and controls thread 204-3 in scanning tool 204 to scan for software vulnerabilities on device 103. Correspondingly, object scanning device 200 can sequentially receive packets (i.e., scan traffic) from device 102 for various scanned objects. Similarly, threads 201-3 to 204-3 execute only after the previous thread has finished. Furthermore, during the response to scan instruction 3, before executing the currently executing thread (one of threads 201-3 to 204-3), the object scanning device 200 can detect whether there are other threads currently scanning objects of the same type, and will only begin executing the currently executing thread after waiting for those other threads to complete their scans. Figure 3 As shown.

[0060] After thread 201-3 completes its scan, object scanning device 200 can generate and respond to scan command 4. During the response to scan command 4, object scanning device 200 sequentially controls thread 201-4 in scanning tool 201 to scan the operating system on device 104, controls thread 202-4 in scanning tool 202 to scan the ports on device 104, controls thread 203-4 in scanning tool 203 to scan the protocols used by the ports on device 104, and controls thread 204-4 in scanning tool 204 to scan for software vulnerabilities on device 104. Correspondingly, object scanning device 200 can sequentially receive packets (i.e., scan traffic) from device 102 for various scanned objects. Similarly, threads 201-4 to 204-4 execute only after the previous thread has finished. Furthermore, during the response to scan instruction 4, while the object scanning device 200 is executing each thread from thread 201-4 to thread 204-4, no other thread is simultaneously scanning objects of the same type as that thread, such as... Figure 3 As shown.

[0061] Thus, during the execution of scan instruction 1, the object scanning device 200 will sequentially execute scan instructions 2 through 4. This not only ensures that multiple threads do not concurrently scan the same type of object at the same time, but also allows the object scanning device 200 to concurrently scan multiple types of objects using threads from multiple scanning tools during certain time periods, such as... Figure 3 As shown, this ensures efficient scanning for various object types.

[0062] For example, the following is an exemplary description of the specific implementation process of the object scanning device 200 using threads to scan various types of objects, including operating systems, ports, interfaces, protocols, fingerprint features, software, software vulnerabilities, and network topologies. For ease of explanation, the following example uses the scanning of various types of objects on device 101.

[0063] 1. Scan the operating system.

[0064] When the object scanning device 200 scans the operating system on device 101 using a thread, it can use the thread to generate a probe message 1 for an operating system of type A and send the probe message 1 to device 101. When the operating system on device 101 is of type A, device 101 can generate a corresponding response message and send it to the object scanning device 200. Upon receiving the response message, the object scanning device 200 can determine that the operating system on device 101 is of type A. If the operating system on device 101 is not of type A, device 101 does not need to send a response message. If the object scanning device 200 does not receive a response message within a preset time period, it can use the thread to generate a probe message 2 for an operating system of type B and send the probe message 2 to device 101. When the operating system on device 101 is of type B, device 101 can send a corresponding response message to the object scanning device 200 so that the object scanning device 200 can determine that the operating system on device 101 is of type B. When the operating system on device 101 is not of type B, device 101 may not send a response message. In this way, object scanning device 200 can use threads to send probe messages to device 101 sequentially for different types of operating systems, until it receives a response message from device 101, and then determine the type of the operating system on device 101.

[0065] Furthermore, after determining the type of the operating system on device 101, object scanning device 200 can further refer to the above-described similar method, use threads to sequentially generate corresponding probe messages for different versions of the operating system under that type, and send them to device 101, and determine the version of the operating system on device 101 based on the response of device 101 to the probe message.

[0066] 2. Scan the ports.

[0067] When the object scanning device 200 scans ports on device 101 using a thread, it can generate different probe packets for different port numbers. For example, the object scanning device 200 can generate 65536 different probe packets for port numbers 0-65535, with each probe packet used to probe one type of port number. In this way, the object scanning device 200 can sequentially send different probe packets to device 101. Correspondingly, for open ports on device 101, device 101 can use that port to send a response packet to the object scanning device 200, while for closed ports on device 101, device 101 may not send a response packet. Thus, the object scanning device 200 can determine one or more open ports on device 101 based on the responses from device 101.

[0068] 3. Scan the interface.

[0069] When the object scanning device 200 scans the interfaces on the device 101 using a thread, it can use the thread to generate different probe packets for different interfaces. In this way, the object scanning device 200 can determine one or more interfaces provided by the device 101 based on the device 101's response to different probe packets.

[0070] 4. Scan the protocols used by the ports.

[0071] When the object scanning device 200 scans the ports on device 101 using a thread to determine the protocol used, it can generate a probe packet based on protocol A using the thread and send the probe packet to the port on device 101. After receiving the probe packet at the port, if the protocol used by the port is consistent with protocol A used to generate the probe packet, device 101 can send a corresponding response packet back to the object scanning device 200, allowing the object scanning device 200 to determine that the port uses protocol A. If the protocol used by the port is inconsistent with protocol A, device 101 may not respond to the probe packet. In this case, the object scanning device 200 can generate a probe packet based on protocol B and send it to the port on device 101. Similarly, the object scanning device 200 can determine the protocol used by the ports on the device by sending probe packets of different protocols to device 101 and based on the response from device 101.

[0072] 5. Scan the fingerprint features.

[0073] In this embodiment, the fingerprint features of a webpage on device 101 obtained by the object scanning device 200 are used as an example for illustration.

[0074] In practice, the object scanning device 200 can use a thread to generate a probe message for a specified webpage and send the probe message to the device 101. Upon receiving the probe message, the device 101 can collect the fingerprint features of the webpage. These fingerprint features may include, for example, the name of the application, the programming language used, the applicable application framework, or other types of fingerprint features. Then, the device 101 can generate a response message based on the collected fingerprint features and send the response message to the object scanning device 200. In this way, the object scanning device 200 can parse the fingerprint features of the webpage from the received response message.

[0075] 6. Scan the software.

[0076] When the object scanning device 200 scans the software on the device 101 using a thread, it can use the thread to sequentially generate probe messages for different software and send these probe messages to the device 101. Upon receiving a probe message, the device 101 can check whether the software indicated by the probe message is running on the device 101. If it exists, the device 101 can send a corresponding response message back to the object scanning device 200. If it does not exist, the device 101 does not need to send a response message. In this way, the object scanning device 200 can determine the software running on the device 101 based on the device's response.

[0077] Furthermore, after scanning and obtaining the software on device 101, the object scanning device 200 can also determine whether the software is malicious by sending probe messages to device 101. For example, the object scanning device 200 can send probe messages corresponding to different malicious behaviors to device 101 in sequence based on the possible malicious behaviors of the software. When the software exhibits the malicious behavior indicated by the probe message, device 101 can send a corresponding response message back to the object scanning device 200; when the software does not exhibit the malicious behavior indicated by the probe message, device 101 may not send a response message. In this way, the object scanning device 200 can determine whether the software running on device 101 is malicious based on the response of device 101.

[0078] 7. Scan for software vulnerabilities.

[0079] When the object scanning device 200 exploits a thread to scan for software vulnerabilities on the device 101, it can use the thread to run a pre-configured script to simulate and generate corresponding malicious commands, which are then sent to the device 101. The device 101 can provide the received malicious commands to the software. If the software executes the malicious command, the device 101 can generate a response message indicating that the malicious command has been executed and send this response message to the object scanning device 200. If the software does not execute the malicious command, the device 101 may not send a response message, or the sent response message may indicate that the malicious command was rejected by the software. Thus, the object scanning device 200 can determine whether the software running on the device 101 has software vulnerabilities based on the responses from the device 101. In practical applications, the object scanning device 200 can send different types of malicious commands to the device 101 to determine whether the software has vulnerabilities in various aspects.

[0080] 8. Scan the network topology.

[0081] In this embodiment, the scanning device 200 scans the topology of a local area network as an example.

[0082] When scanning the topology of a local area network (LAN) using threads, the object scanning device 200 can send probe messages to each device in the LAN. These probe messages instruct the device to provide its routing information, which may be, for example, a forwarding information base (FIB) or a routing information base (RIB). Upon receiving a probe message, device 101 can provide its routing information back to the object scanning device 200. Other devices in the LAN can also provide corresponding routing information to the object scanning device 200 based on the received probe messages. In this way, the object scanning device 200 can determine the connection relationships between different devices based on the routing information provided by each device, and thereby generate the LAN network topology.

[0083] It should be noted that the above implementation method is illustrated by scanning objects on device 101. For other devices in device cluster 100, object scanning device 200 can also complete object scanning in a similar manner. Furthermore, the specific implementation of object scanning device 200 in scanning objects in device cluster 100 is not limited to the various implementation methods described above. In practical applications, object scanning device 200 can also scan operating systems, ports, and other objects based on other implementation methods. Moreover, object scanning device 200 can also scan other types of objects in device cluster 100 without limitation.

[0084] The object scanning device 200 can generate corresponding scan results based on the scan traffic received from scanning various types of objects. These scan results can include relevant information about the objects. For example, taking port scanning as an example, the object scanning device 200 can determine the open ports of each device based on the response messages (i.e., scan traffic) returned by each device, and generate scan results accordingly. These scan results may indicate, for example, the number of open ports and port numbers on each device.

[0085] S203: The object scanning device 200 outputs the scanning results.

[0086] For example, after generating the scan results, the object scanning device 200 can output the scan results to the client or user-side terminal device, and the client or terminal device can present the scan results to the user on the interactive interface so that the user can learn about the relevant information of objects on each device in the device cluster 100.

[0087] Alternatively, after generating the scan results, the object scanning device 200 can output the scan results to a corresponding storage device (such as a hard disk or storage server) for persistent storage, so that users can view the scan results from the storage device later.

[0088] In this embodiment, since the object scanning device 200 uses only a single thread (or a single process) to scan each type of object, concurrent scanning traffic for the same type of object is avoided. This ensures that the object scanning device 200 does not interfere with each other when receiving scanning traffic, thereby minimizing errors or omissions in the final scan results and improving the accuracy of object scanning. Furthermore, the object scanning device 200 uses multiple scanning tools to perform concurrent scanning of various types of objects, which also ensures that the overall efficiency of object scanning remains at a high level.

[0089] In addition, since each type of object can be scanned using a single thread / process, this avoids the object scanning device 200 receiving too much scanning traffic in the same time period, which would cause the object scanning device 200 to fail to receive some scanning traffic in time (this part of the scanning traffic is discarded due to receiving timeout). This can further avoid omissions in the scanning results, thereby further improving the accuracy of object scanning.

[0090] It is worth noting that other reasonable combinations of steps that can be conceived by those skilled in the art based on the above description also fall within the scope of protection of this application. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to this application.

[0091] The above combination Figures 1 to 3 The object scanning method provided in the embodiments of this application will be introduced. Next, the structure of the object scanning device and computing device provided in the embodiments of this application will be described with reference to the accompanying drawings.

[0092] See Figure 4 A schematic diagram of an object scanning device 400 is shown, comprising:

[0093] The determination module 401 is used to determine multiple types of objects to be scanned in response to an object scanning request, wherein there are multiple objects of each type.

[0094] The scanning module 402 is used to scan multiple types of objects using multiple scanning tools to obtain scanning results. Each of the multiple scanning tools uses a single thread or a single process to scan one type of object at a time.

[0095] Output module 403 is used to output the scan results.

[0096] In one possible implementation, the plurality of scanning tools include a first scanning tool and a second scanning tool, the first scanning tool including a first thread and a second thread, and the second scanning tool including a third thread and a fourth thread;

[0097] Therefore, the scanning module 402 is used for:

[0098] In response to the first scan instruction, the first thread in the first scan tool is used to scan the first object of the first type among multiple types of objects;

[0099] In response to the first scan command, after the first thread finishes scanning the first object, the third thread in the second scan tool is used to scan the third object of the second type among multiple types of objects, and in response to the second scan command, the second thread in the first scan tool is used to scan the second object of the first type among multiple types of objects.

[0100] After the third thread finishes scanning the third object, the fourth thread in the second scanning tool is used to scan the fourth object of the second type among multiple types of objects, including the first type and the second type.

[0101] In one possible implementation, the object scanning device 400 further includes:

[0102] The detection module 404 is used to detect whether the first thread has finished scanning the first object before the second thread scans the second object.

[0103] During the period when the first thread has not finished scanning the first object, the second thread is in a sleep state.

[0104] In one possible implementation, the object to be scanned includes any one or more of the following objects:

[0105] Operating system, port, interface, protocol, fingerprint characteristics, software, software vulnerability, network topology.

[0106] In one possible implementation, the object to be scanned is the network topology corresponding to the local area network;

[0107] Therefore, the scanning module 402 is used for:

[0108] Use one of several scanning tools to scan devices on the local area network (LAN) and obtain the routing information of the devices on the LAN.

[0109] Generate the local area network topology based on the routing information.

[0110] In one possible implementation, the determining module 401 is specifically used for:

[0111] Parse multiple types of identifiers from the object scanning request;

[0112] Based on various types of identifiers, identify multiple objects belonging to multiple types.

[0113] In one possible implementation, the object scanning device 400 further includes:

[0114] Module 405 is provided to provide an interactive interface;

[0115] The request generation module 406 is used to generate an object scanning request in response to the user's selection of various types of identifiers on the interactive interface.

[0116] because Figure 4 The object scanning device 400 shown corresponds to the above. Figure 2 The object scanning device 200 in the illustrated embodiment, therefore Figure 4 For a detailed description of the object scanning device 400 and its technical effects, please refer to the above. Figure 2 The relevant details in the illustrated embodiments are described in detail here, and will not be repeated here.

[0117] Figure 5 This application provides a schematic diagram of the hardware structure of a computing device 500, which, for example, can implement the above-described... Figure 2 The object scanning device 200 in the illustrated embodiment, etc.

[0118] like Figure 5 As shown, the computing device 500 includes a processor 501, a memory 502, and a communication interface 503. The processor 501, memory 502, and communication interface 503 communicate via a bus 504, or via wireless transmission or other means. The memory 502 stores instructions, and the processor 501 executes the instructions stored in the memory 502. Further, the computing device 500 may also include a memory unit 505, which is connected to the processor 501, storage medium 502, and communication interface 503 via the bus 504. The memory 502 stores program code, and the processor 501 can call the program code stored in the memory 502 to perform the following operations:

[0119] In response to an object scanning request, multiple types of objects to be scanned are determined, wherein there are multiple objects of each type;

[0120] Multiple scanning tools are used to scan the various types of objects to obtain scanning results. Each of the multiple scanning tools uses a single thread or a single process to scan one type of object at a time.

[0121] Output the scan results.

[0122] It should be understood that in the embodiments of this application, the processor 501 may be a CPU, or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete device assemblies, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0123] The memory 502 may include read-only memory and random access memory, and provides instructions and data to the processor 501. The memory 502 may also include non-volatile random access memory.

[0124] The memory 502 can be volatile memory or non-volatile memory, or it can include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0125] The communication interface 503 is used to communicate with other devices connected to the computing device 500. The bus 504 may include a data bus, a power bus, a control bus, and a status signal bus, etc. However, for clarity, all buses are labeled as bus 504 in the figure.

[0126] It should be understood that the computing device 500 according to the embodiments of this application may correspond to the object scanning device 400 in the embodiments of this application, and may correspond to the execution of the device according to the embodiments of this application. Figure 2 The method executed by the object scanning device 200 in the illustrated method, and the above-mentioned and other operations and / or functions implemented by the computing device 500, are respectively for the purpose of implementing... Figure 2 The process of the corresponding methods in [the document] will not be elaborated here for the sake of brevity.

[0127] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computing device to perform the above-described object scanning method.

[0128] This application also provides a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0129] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0130] The computer program product can be a software installation package. When any of the aforementioned object scanning methods is required, the computer program product can be downloaded and executed on a computing device.

[0131] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0132] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An object scanning method, characterized in that, The method includes: In response to an object scanning request, multiple types of objects to be scanned are determined, wherein there are multiple objects of each type; Multiple scanning tools are used to scan the various types of objects to obtain scanning results. Each of the multiple scanning tools uses a single thread or a single process to scan one type of object at a time. The multiple scanning tools include a first scanning tool, which includes a first thread and a second thread. Output the scan results; The process of using multiple scanning tools to scan the various types of objects includes: In response to the first scan instruction, the first thread in the first scan tool is used to scan the first object of the first type among the multiple types of objects; After the first thread finishes scanning the first object, in response to the second scanning instruction, the second thread in the first scanning tool is used to scan the second object belonging to the first type among the multiple types of objects, the multiple types including the first type.

2. The method according to claim 1, characterized in that, The plurality of scanning tools also includes a second scanning tool, which includes a third thread and a fourth thread; The process of using multiple scanning tools to scan the various types of objects includes: In response to the first scan instruction, the first thread in the first scan tool is used to scan the first object of the first type among the multiple types of objects; In response to the first scanning instruction, after the first thread finishes scanning the first object, the third thread in the second scanning tool is used to scan the third object of the second type among the multiple types of objects, and in response to the second scanning instruction, the second thread in the first scanning tool is used to scan the second object of the first type among the multiple types of objects. After the third thread finishes scanning the third object, the fourth thread in the second scanning tool is used to scan the fourth object belonging to the second type among the multiple types of objects, where the multiple types include the second type.

3. The method according to claim 2, characterized in that, The method further includes: Before using the second thread to scan the second object, check whether the first thread has finished scanning the first object; During the period when the first thread has not finished scanning the first object, the second thread is in a sleep state.

4. The method according to claim 1, characterized in that, The object includes any one or more of the following objects: Operating system, port, interface, protocol, fingerprint characteristics, software, software vulnerability, network topology.

5. The method according to claim 4, characterized in that, The object refers to the network topology corresponding to a local area network; The process of using multiple scanning tools to scan the various types of objects and obtaining the scanning results includes: Using one of the multiple scanning tools, scan the devices in the local area network to obtain the routing information of the devices in the local area network; Based on the routing information, the network topology of the local area network is generated.

6. The method according to claim 1, characterized in that, In response to the object scanning request, the method identifies multiple types of objects to be scanned, including: The various types of identifiers are parsed from the object scanning request; Based on the various types of identifiers, multiple objects belonging to the various types are identified.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: Provide an interactive interface; The object scanning request is generated in response to the user's selection of the various types of identifiers on the interactive interface.

8. An object scanning device, characterized in that, The device includes: The determination module is used to determine multiple types of objects to be scanned in response to an object scanning request, wherein there are multiple objects of each type; A scanning module is used to scan the various types of objects using multiple scanning tools to obtain scanning results. Each of the multiple scanning tools uses a single thread or a single process to scan one type of object at a time. The multiple scanning tools include a first scanning tool, which includes a first thread and a second thread. The output module is used to output the scan results; The scanning module is used for: In response to the first scan instruction, the first thread in the first scan tool is used to scan the first object of the first type among the multiple types of objects; After the first thread finishes scanning the first object, in response to the second scanning instruction, the second thread in the first scanning tool is used to scan the second object belonging to the first type among the multiple types of objects, the multiple types including the first type.

9. The apparatus according to claim 8, characterized in that, The plurality of scanning tools also includes a second scanning tool, which includes a third thread and a fourth thread; The scanning module is used for: In response to the first scan instruction, the first thread in the first scan tool is used to scan the first object of the first type among the multiple types of objects; In response to the first scanning instruction, after the first thread finishes scanning the first object, the third thread in the second scanning tool is used to scan the third object of the second type among the multiple types of objects, and in response to the second scanning instruction, the second thread in the first scanning tool is used to scan the second object of the first type among the multiple types of objects. After the third thread finishes scanning the third object, the fourth thread in the second scanning tool is used to scan the fourth object belonging to the second type among the multiple types of objects, where the multiple types include the second type.

10. The apparatus according to claim 9, characterized in that, The device further includes: The detection module is used to detect whether the first thread has finished scanning the first object before the second thread scans the second object; During the period when the first thread has not finished scanning the first object, the second thread is in a sleep state.

11. The apparatus according to any one of claims 8 to 10, characterized in that, The object includes any one or more of the following objects: Operating system, port, interface, protocol, fingerprint characteristics, software, software vulnerability, network topology.

12. The apparatus according to claim 11, characterized in that, The object refers to the network topology corresponding to a local area network; The scanning module is used for: Using one of the multiple scanning tools, scan the devices in the local area network to obtain the routing information of the devices in the local area network; Based on the routing information, the network topology of the local area network is generated.

13. A computing device, characterized in that, Including processor and memory; The processor is configured to execute instructions stored in the memory to cause the computing device to perform the steps of the method as described in any one of claims 1 to 7.

14. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computing device, cause the computing device to perform the steps of the method as described in any one of claims 1 to 7.

Images