Asset management method, device, equipment and storage medium

Abstract

The application discloses an asset management method, device and equipment and a storage medium, relates to the technical field of information processing, and the asset management method comprises the following steps: acquiring a network traffic log, wherein the network traffic log comprises a plurality of communication addresses; analyzing the network traffic log to determine first assets corresponding to the communication addresses; and performing asset merging on the communication addresses based on the first assets corresponding to the communication addresses. The application performs asset merging after analyzing the network traffic log, thereby accurately reflecting the real asset state in the network in real time, and realizing accurate merging of the assets in the network, so that the redundancy of the asset list is reduced, and the management cost and risk are reduced.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to an asset management method, apparatus, device and storage medium. Background Art

[0002] In today's prevalent multi-IP environment, a single asset may have multiple communication addresses for various reasons. These addresses can change frequently due to daily operational needs. This makes it difficult for asset management systems to accurately reflect the true status of assets on the network in real time, leading to outdated asset information and hindering decision-making efficiency and security response speed. Traditional asset management methods based on static IP-MAC binding or periodic refreshes are no longer adaptable to this rapidly changing environment. Furthermore, traditional methods often struggle to automatically associate seemingly independent communication addresses that actually belong to the same asset. This not only leads to redundant asset inventories but also increases management costs and risks. Summary of the Invention

[0003] The main purpose of this application is to provide an asset management method, device, equipment and storage medium, aiming to solve the technical problem that traditional methods are difficult to accurately reflect the real asset status in the network in real time.

[0004] To achieve the above objectives, this application proposes an asset management method, which includes:

[0005] Obtaining a network traffic log, wherein the network traffic log includes a plurality of communication addresses;

[0006] Analyzing the network traffic log to determine the first asset corresponding to each of the communication addresses;

[0007] Based on the first assets corresponding to the communication addresses, the assets of the communication addresses are merged.

[0008] In one embodiment, analyzing the network traffic log to determine the first asset corresponding to each communication address includes:

[0009] Determining whether the network traffic log is a Dynamic Host Configuration Protocol service;

[0010] If not, determining whether the network traffic log is a gateway-type media access control address;

[0011] If so, the first asset corresponding to each of the communication addresses is determined according to the gateway media access control address in the network traffic log.

[0012] In one embodiment, after determining whether the network traffic log is a Dynamic Host Configuration Protocol service, the method further includes:

[0013] If so, checking whether the network traffic log contains the same media access control address;

[0014] If so, the communication addresses corresponding to the same media access control addresses are associated and combined to generate several asset merging groups;

[0015] Perform asset consolidation on each of the asset consolidation groups.

[0016] In one embodiment, if not, after determining whether the network traffic log is a media access control address, the method further includes:

[0017] If not, obtain the preset observation time;

[0018] Based on a preset observation time, detecting whether the number of assets corresponding to the network traffic log changes;

[0019] If so, assets of each of the communication addresses are merged.

[0020] In one embodiment, the asset merging of each communication address based on the first asset corresponding to each communication address includes:

[0021] Obtaining network traffic, communication patterns, and behavioral characteristics corresponding to the network traffic log;

[0022] Inputting the network traffic, the communication mode, and the behavior characteristics into an asset merging analysis model to obtain a second asset corresponding to each communication address output by the asset merging analysis model;

[0023] Based on the first asset and the second asset, assets of the communication addresses are merged.

[0024] In one embodiment, the asset merging of each of the communication addresses based on the first asset and the second asset includes:

[0025] comparing the first asset to the second asset;

[0026] If the first asset and the second asset are the same, encrypt the communication addresses belonging to the same asset;

[0027] After detecting that the information encryption is completed, the assets of each communication address are merged.

[0028] In one embodiment, after merging the assets of the communication addresses based on the first assets corresponding to the communication addresses, the method further includes:

[0029] Obtaining the asset merger group corresponding to each of the communication addresses within a preset time;

[0030] Determining whether the asset consolidation group is properly consolidated;

[0031] If so, decryption information of each communication address is obtained, and the decryption information is pushed to the first asset corresponding to the asset merging group.

[0032] In addition, to achieve the above objectives, the present application also proposes an asset management device, which includes:

[0033] An acquisition module, configured to acquire a network traffic log, wherein the network traffic log includes a plurality of communication addresses;

[0034] an analysis module, configured to analyze the network traffic log to determine the first asset corresponding to each of the communication addresses;

[0035] The merging module is used to merge the assets of each communication address based on the first assets corresponding to each communication address.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes an asset management device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the asset management method as described above.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the asset management method described above are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the asset management method described above.

[0039] The present application provides an asset management method, apparatus, device and storage medium. The asset management method obtains a network traffic log, wherein the network traffic log includes a plurality of communication addresses, and then analyzes the network traffic log to determine the first asset corresponding to each of the communication addresses. Based on the first asset corresponding to each of the communication addresses, the assets of each of the communication addresses are merged, thereby accurately reflecting the real asset status in the network in real time and realizing the precise merging of assets in the network, thereby reducing the redundancy of the asset list and reducing management costs and risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 A flowchart of the first embodiment of the asset management method of this application is provided;

[0043] Figure 2 A flowchart of the second embodiment of the asset management method of this application is provided;

[0044] Figure 3 A flowchart of the third embodiment of the asset management method of this application is provided;

[0045] Figure 4 A brief example process diagram for the asset management method of this application;

[0046] Figure 5 This is a schematic diagram of the module structure of the asset management device according to an embodiment of the present application;

[0047] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the asset management method in the embodiment of the present application.

[0048] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0050] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0051] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device capable of implementing the above functions, a big data service platform, an asset management system, etc. The following uses an asset management system as an example to illustrate this embodiment and the following embodiments.

[0052] Based on this, the embodiment of the present application provides an asset management method, referring to Figure 1 , Figure 1 A flowchart illustrating the first embodiment of the asset management method of this application.

[0053] In this embodiment, the asset management method includes steps S11 to S13:

[0054] Step S11, obtaining a network traffic log, wherein the network traffic log includes a plurality of communication addresses;

[0055] It should be noted that the network traffic log refers to a log file that records detailed information about data packets transmitted in the network. The log is usually generated by network devices (such as routers, switches, firewalls, etc.) and includes the following information: source IP address and destination IP address (i.e., communication address); source port and destination port; transmission protocol: such as TCP, UDP, ICMP, etc.; packet size; timestamp, etc., which are not limited here.

[0056] It should be further explained that the communication address refers to the address used to identify a device or service in the network. This usually includes an IP address and a port number, wherein the IP address is used to identify the device at the network layer, while the port number is used to identify a specific service or application at the transport layer.

[0057] Specifically, network traffic logs can be obtained through system capture tools and other methods. There is no restriction here and it can be set according to actual conditions.

[0058] Step S12: analyzing the network traffic log to determine the first asset corresponding to each communication address;

[0059] It should be noted that the first asset refers to a single network device or resource that is identified and tracked in the network, such as servers, network devices (such as routers, switches, etc.), terminal devices (such as personal computers, laptops, smartphones and tablets, etc.), storage devices, security devices and Internet of Things (IoT) devices, etc., which can be set according to actual conditions and are not restricted here.

[0060] Specifically, determine whether the network traffic log is a dynamic host configuration protocol service, and if not, determine whether the network traffic log is a gateway-type media access control address, and if so, determine the first asset corresponding to each communication address based on the gateway-type media access control address in the network traffic log.

[0061] Step S13: Based on the first assets corresponding to the communication addresses, assets of the communication addresses are merged.

[0062] It should be noted that asset consolidation refers to the process of integrating different network identifiers (such as multiple IP addresses, MAC addresses, etc.) in the network that appear independent but actually belong to the same physical or logical entity into a single asset record, thereby simplifying network management, improving the accuracy of asset management, reducing redundancy, and helping to better understand network structure and device relationships.

[0063] Specifically, the network traffic, communication pattern and behavioral characteristics corresponding to the network traffic log are obtained, and then the network traffic, the communication pattern and the behavioral characteristics are input into the asset merging analysis model to obtain the second asset corresponding to each communication address output by the asset merging analysis model, so as to perform asset merging on each communication address based on the first asset and the second asset.

[0064] This embodiment obtains a network traffic log, wherein the network traffic log includes a plurality of communication addresses, and then analyzes the network traffic log to determine the first asset corresponding to each of the communication addresses. Based on the first asset corresponding to each of the communication addresses, the assets of each of the communication addresses are merged, thereby accurately reflecting the real asset status in the network in real time and realizing the precise merging of assets in the network, thereby reducing the redundancy of the asset list and lowering management costs and risks.

[0065] In a feasible implementation manner, analyzing the network traffic log to determine the first asset corresponding to each communication address includes:

[0066] Step S21, determining whether the network traffic log is a Dynamic Host Configuration Protocol service;

[0067] It should be noted that the Dynamic Host Configuration Protocol service refers to the DHCP (Dynamic Host Configuration Protocol) service, which is a network protocol service that allows network devices (such as computers, smart phones, printers, etc.) to automatically obtain IP addresses and other network configuration parameters, such as subnet masks, default gateways, and DNS server addresses. By identifying the DHCP service, it can help determine which IP addresses are dynamically allocated and whether they are associated with specific devices or assets. By analyzing the DHCP log, the allocation of IP addresses can be tracked, thereby identifying and merging different IP addresses belonging to the same asset.

[0068] Specifically, it is possible to determine whether the network traffic log is a Dynamic Host Configuration Protocol service by analyzing the characteristics and content of the data packets in the network traffic log. This can also be achieved by looking for specific DHCP message types, which include DHCP Discover, DHCP Offer, DHCP Request, DHCP Acknowledgment, etc. In one embodiment, in the network traffic log, the message is usually presented as a UDP protocol data packet, with the source port and destination port being 67 (DHCP server port) and 68 (DHCP client port), respectively. Thus, by checking the characteristics of the data packet, it is possible to determine whether the traffic in the log is related to the DHCP service. In addition, the content of the DHCP message usually includes information such as the MAC address of the device, the requested IP address, and the lease time. The information can also be used as a basis for judgment. If the traffic in the log meets the preset DHCP service characteristics, then it can be considered that these logs record the communication process of the DHCP service, which is not limited here.

[0069] Step S22: If not, determine whether the network traffic log is a gateway type media access control address;

[0070] It should be noted that a MAC address (Media Access Control address) is a unique hardware identifier for network devices and is used for data link layer communications. The gateway MAC address is typically assigned to network gateway devices, such as routers or firewalls. These devices connect different network segments (such as local area networks and wide area networks) and manage the routing of data packets. Therefore, these critical network devices are often identified by their gateway MAC addresses.

[0071] Specifically, by analyzing the communication patterns and device roles in the logs, since gateway devices, such as routers and firewalls, are usually responsible for forwarding and filtering network traffic, their MAC addresses will appear in communications across network segments. Therefore, in network traffic logs, gateway-class MAC addresses can be determined by identifying MAC addresses associated with known gateway devices. By checking whether the MAC addresses in the logs match these gateway devices and whether these addresses play a key forwarding role in network traffic, it can be determined whether the traffic in the logs involves gateway-class MAC addresses. If the logs show that specific MAC addresses frequently serve as the source or destination addresses of data packets, especially in communications between different subnets, then these MAC addresses are likely to belong to gateway-class devices.

[0072] Step S23: If yes, determine the first asset corresponding to each communication address according to the gateway media access control address in the network traffic log.

[0073] Specifically, if so, then, based on the gateway-type media access control addresses in the network traffic log, in one embodiment, the gateway-type media access control addresses in the network traffic log are checked to see if they contain the same MAC address and the number of assets is less than two, to ensure that each asset has a unique identifier. If so, the first asset corresponding to each communication address is determined, thereby avoiding incorrect asset merging and improving the accuracy and security of network management. Additionally, if the number of assets is greater than or equal to two, further analysis of these assets is required to determine whether they are truly the same physical device or whether they need to be merged.

[0074] This embodiment determines whether the network traffic log is a dynamic host configuration protocol service, and if not, determines whether the network traffic log is a gateway-type media access control address. If so, the first asset corresponding to each communication address is determined based on the gateway-type media access control address in the network traffic log, and then identifies different IP addresses that appear to be independent but actually belong to the same asset, thereby reducing asset list redundancy, thereby improving identification accuracy, optimizing asset management, simplifying network configuration, and reducing operating costs.

[0075] In a feasible implementation manner, after determining whether the network traffic log is a Dynamic Host Configuration Protocol service, the method further includes:

[0076] Step S31: If yes, then check whether the network traffic log contains the same media access control address;

[0077] It should be noted that the media access control address refers to a MAC address.

[0078] Specifically, if so, the network traffic log is checked for the presence of the same media access control address, wherein all MAC address information related to the data packet is extracted from the network traffic log, and the extracted MAC address is stored in a data structure, such as a hash table or an array, for quick search and comparison, so as to check the stored MAC addresses to determine whether duplicate addresses appear. If so, the duplicate MAC addresses are marked as possibly belonging to the same network asset or device.

[0079] Step S32: If yes, then the communication addresses corresponding to the same media access control addresses are associated and combined to generate several asset merging groups;

[0080] It should be noted that the asset merger group refers to a combination formed by merging network assets with the same or similar characteristics during the network management and asset identification process, where the characteristics include but are not limited to the same media access control (MAC) address, IP address, device type, geographic location or other network behavior patterns, thereby simplifying asset management, improving the efficiency of network monitoring and maintenance, and optimizing resource allocation.

[0081] Step S33: merging assets of each asset merging group.

[0082] Specifically, the asset information corresponding to each communication address in each asset merging group is integrated, and asset records are created or updated, including the asset's identification, location, status, configuration and associated network services, etc., and then the asset management database is updated, and the new asset merging records are synchronized to the network management system for unified monitoring, maintenance and security policy application, thereby improving the efficiency of asset management and enhancing the security and compliance of the network.

[0083] This embodiment detects whether the network traffic log contains the same media access control address, and if so, associates and combines the communication addresses corresponding to the same media access control address to generate several asset merging groups, thereby merging assets of each asset merging group, and then analyzing the MAC address in the same network segment, thereby more accurately identifying and merging assets belonging to the same physical device or virtual device, which helps to simplify network monitoring and maintenance work, because network administrators can manage the merged asset groups in a unified manner instead of tracking each address separately, and because the system better understands the actual device usage in the network, it helps to more effectively allocate network resources such as bandwidth and storage.

[0084] In a feasible implementation manner, if not, after determining whether the network traffic log is a media access control address, the method further includes:

[0085] Step S41, if not, obtain the preset observation time;

[0086] It should be noted that the preset observation time refers to the pre-set time for observing whether the asset quantity changes, which can be set according to actual conditions and is not limited here.

[0087] Step S42: detecting whether the number of assets corresponding to the network traffic log changes based on a preset observation time;

[0088] It should be noted that the number of assets refers to the total number of independent network assets identified and recorded in a specific network or organization, including various types of equipment such as computers, servers, printers, routers, switches, firewalls, mobile devices, etc.

[0089] Specifically, according to the preset observation time, it is detected whether the number of assets corresponding to the network traffic log changes within the preset observation time.

[0090] Step S43: If yes, then merge the assets of each communication address.

[0091] Specifically, if so, the communication addresses corresponding to the same media access control address are associated and combined to generate a plurality of asset merging groups, and then the assets are merged according to the asset merging groups.

[0092] In this embodiment, if not, a preset observation time is obtained, and then based on the preset observation time, whether the number of assets corresponding to the network traffic log has changed, and if so, assets of each communication address are merged, thereby realizing real-time tracking across network segments through dynamic analysis, thereby adapting to the dynamic network environment, avoiding erroneous merging, and effectively improving the accuracy of merging and reducing false positives and omissions.

[0093] Based on this, the embodiment of the present application provides an asset management method, referring to Figure 2 , Figure 2 This is a flow chart of the second embodiment of the asset management method of this application.

[0094] In a feasible implementation manner, the asset merging of each communication address based on the first asset corresponding to each communication address includes:

[0095] Step S51, obtaining network traffic, communication mode and behavior characteristics corresponding to the network traffic log;

[0096] It should be noted that network traffic refers to the total amount of data packets transmitted on the network. This includes all information transmitted over the network, such as web browsing, file transfers, and email communications, reflecting network usage and performance. Communication patterns refer to the methods and patterns of communication between devices on the network, including the frequency, time, duration, packet size distribution, and protocol types used. This helps identify normal and abnormal network behavior.

[0097] It should be further explained that the behavioral characteristics refer to the behavioral characteristics of network devices or users in the network, including the frequency of accessing specific services, activity in a specific time period, data transmission patterns, interaction with specific IP addresses, etc.

[0098] Specifically, network traffic data is captured through network monitoring tools or devices (such as network probes, routers, switches, etc.), including information such as the source IP address, destination IP address, source port, destination port, transmission protocol, packet size and timestamp of the data packet, and then the raw data is parsed and processed using log analysis tools or custom scripts to extract key network traffic features, such as traffic size, transmission rate, protocol distribution, etc. Furthermore, by analyzing the time series and flow direction of the data packets, communication patterns are identified, for example, which IP addresses communicate frequently and at which time of the day these communications are most active. Based on the communication patterns and traffic characteristics, behavioral features are further extracted, such as the preferences of specific devices or users for accessing specific services, and behavioral changes under abnormal circumstances, thereby obtaining the network traffic, communication patterns and behavioral features corresponding to the network traffic log.

[0099] Step S52: inputting the network traffic, the communication mode, and the behavior characteristics into an asset merging analysis model to obtain the second asset corresponding to each communication address output by the asset merging analysis model;

[0100] It should be noted that the asset consolidation analysis model is used to analyze network traffic, communication patterns, and behavioral characteristics to identify and consolidate network assets belonging to the same physical or logical entity. The second asset refers to a new asset entity identified based on network traffic, communication patterns, and behavioral characteristics after processing by the asset consolidation analysis model.

[0101] Specifically, the network traffic, the communication pattern and the behavioral characteristics are input into the asset merging analysis model to obtain the second assets corresponding to each communication address output by the asset merging analysis model. In addition, the model prediction results can be regularly pushed to the management personnel to determine the accuracy of the model output, and then determine the direction of model optimization and adjustment.

[0102] In addition, the training process of the asset consolidation analysis model is as follows: obtaining information such as network traffic, communication mode, and behavioral characteristics of historical network traffic logs within a preset time, and then performing data preprocessing on the network traffic, communication mode, and behavioral characteristics, such as data cleaning and normalization, so as to input the network traffic, communication mode, and behavioral characteristics into the initial asset consolidation analysis model to obtain the predicted value output by the asset consolidation analysis model, so as to obtain the asset consolidation analysis model through diversified data training, and then using the loss function to calculate the model loss value based on the predicted value. In this embodiment, the loss function can be set according to actual needs and is not specifically limited here. After the model loss value is calculated, the training process ends, and the error back propagation algorithm is used to update the model parameters in the initial asset consolidation analysis model, and then the next training is carried out. During the training process, it is determined whether the updated initial asset consolidation analysis model meets the preset training end conditions. If so, the updated initial asset consolidation analysis model is used as the asset consolidation analysis model. If not, the model training continues, wherein the preset training end conditions include loss convergence and reaching the maximum iteration number threshold.

[0103] Step S53: Based on the first asset and the second asset, perform asset merging on each of the communication addresses.

[0104] Specifically, the first asset is compared with the second asset, and if the first asset is the same as the second asset, the communication addresses belonging to the same asset are encrypted, so that when the information encryption is completed, the assets of each communication address are merged.

[0105] This embodiment obtains the network traffic, communication pattern and behavioral characteristics corresponding to the network traffic log, and then inputs the network traffic, the communication pattern and the behavioral characteristics into the asset merging analysis model to obtain the second asset corresponding to each communication address output by the asset merging analysis model, thereby performing asset merging on each communication address based on the first asset and the second asset, and then further accurately identifying and merging assets through the asset merging analysis model to reduce misjudgments. While enhancing recognition accuracy, it ensures that the merger is based on objective analysis rather than subjective judgment, thereby reducing the error rate of asset merging.

[0106] Based on this, the embodiment of the present application provides an asset management method, referring to Figure 3 , Figure 3 This is a flow chart of the third embodiment of the asset management method of this application.

[0107] In a feasible implementation manner, the asset merging of each communication address based on the first asset and the second asset includes:

[0108] Step S61, comparing the first asset with the second asset;

[0109] Step S62: If the first asset and the second asset are the same, encrypt the communication address belonging to the same asset;

[0110] Specifically, when it is confirmed that the first asset and the second asset are identical, meaning they belong to the same physical or logical entity, all communication addresses belonging to the same asset are encrypted. In one embodiment, this process involves encoding the asset's communication information using an encryption algorithm and a key to ensure the security and privacy of the data during storage and transmission. The encrypted communication addresses are converted into a format that can only be interpreted by authorized users or systems, thereby preventing unauthorized access and data leakage. Therefore, after encryption, these communication addresses are securely stored in the asset management database or securely transmitted within the network for further network management and security monitoring.

[0111] Step S63: After detecting that the information encryption is completed, assets of each communication address are merged.

[0112] Specifically, upon detecting that information encryption is complete, assets are merged for each of the communication addresses, wherein it is ensured that unauthorized users (such as unauthorized assets) access or use the communication addresses.

[0113] This embodiment compares the first asset with the second asset, and if the first asset is identical to the second asset, encrypts the communication addresses belonging to the same asset, thereby detecting that the information encryption is complete and merging the assets for each of the communication addresses. By comparing the first asset with the second asset, it is ensured that only truly identical assets are merged, thereby improving the accuracy of asset identification. Information encryption is used to protect asset information from unauthorized access or leakage when the correctness of the asset merger is not 100% confirmed, thereby enhancing data security and preserving the integrity and confidentiality of asset information.

[0114] In a feasible implementation manner, after merging the assets of the communication addresses based on the first assets corresponding to the communication addresses, the method further includes:

[0115] Step S71, obtaining the asset merger group corresponding to each communication address within a preset time;

[0116] It should be noted that the preset time refers to the pre-set asset review time to determine whether the asset merger within this period is correct.

[0117] Step S72, determining whether the asset merger group is correctly merged;

[0118] Specifically, through network traffic analysis and communication pattern recognition, the network behavior and characteristics of assets within the merged group are compared to check for consistency. Asset fingerprinting techniques, such as analyzing open ports, running services, and operating systems, can be used to further confirm asset similarity. Furthermore, historical data comparisons can be used to determine whether these assets exhibit similar patterns in past network activity, thereby ensuring the correctness of the merged asset group and improving the effectiveness of network management and security monitoring.

[0119] Step S73: If yes, obtain the decryption information of each communication address, and push the decryption information to the first asset corresponding to the asset merger group.

[0120] Specifically, if yes, decryption information of each communication address is obtained, and the decryption information is pushed to the first asset corresponding to the asset merging group.

[0121] Additionally, if the asset consolidation group is incorrectly merged, the data and factors that led to the incorrect consolidation are reviewed and analyzed, leading to a more in-depth asset fingerprinting and comparative analysis to identify the true relationships between assets. Based on the analysis results, the asset consolidation strategy and parameters are adjusted to ensure the accuracy of the consolidation logic. Simultaneously, for the incorrectly merged assets, an asset split operation is performed to restore them to their correct independent state, and the asset management database is updated to ensure the accuracy and up-to-dateness of all asset records. Furthermore, an analysis report is generated based on this incorrect consolidation to continuously optimize the asset consolidation algorithm and process, thereby correcting the incorrect consolidation issue and improving the accuracy and reliability of future asset consolidations.

[0122] This embodiment obtains the asset merging group corresponding to each of the communication addresses within a preset time, and then determines whether the asset merging group is correctly merged. If so, decryption information of each of the communication addresses is obtained, and the decryption information is pushed to the first asset corresponding to the asset merging group, thereby verifying the correctness of the asset merging group, ensuring that only verified accurate data is decrypted and pushed, thereby improving the reliability of the data. At the same time, the push of decryption information is only for the correctly merged asset group, thereby reducing the risk of data exposure in an unsafe or unverified environment.

[0123] For example, to help understand the implementation process of the asset management method, please refer to Figure 4 , Figure 4 A simplified flowchart of the asset management method for this application is provided.

[0124] It should be noted that the examples in the figure are only used to understand the present application and do not constitute a limitation on the asset management method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0125] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0126] This application also provides an asset management device, please refer to Figure 5 , the asset management device includes:

[0127] An acquisition module 51 is configured to acquire a network traffic log, wherein the network traffic log includes a plurality of communication addresses;

[0128] An analysis module 52 is configured to analyze the network traffic log to determine the first asset corresponding to each of the communication addresses;

[0129] The merging module 53 is configured to merge the assets of each of the communication addresses based on the first assets corresponding to each of the communication addresses.

[0130] The asset management device is also used for:

[0131] Determining whether the network traffic log is a Dynamic Host Configuration Protocol service;

[0132] If not, determining whether the network traffic log is a gateway-type media access control address;

[0133] If so, the first asset corresponding to each of the communication addresses is determined according to the gateway media access control address in the network traffic log.

[0134] The asset management device is also used for:

[0135] If so, checking whether the network traffic log contains the same media access control address;

[0136] If so, the communication addresses corresponding to the same media access control addresses are associated and combined to generate several asset merging groups;

[0137] Perform asset consolidation on each of the asset consolidation groups.

[0138] The asset management device is also used for:

[0139] If not, obtain the preset observation time;

[0140] Based on a preset observation time, detecting whether the number of assets corresponding to the network traffic log changes;

[0141] If so, assets of each of the communication addresses are merged.

[0142] The asset management device is also used for:

[0143] Obtaining network traffic, communication patterns, and behavioral characteristics corresponding to the network traffic log;

[0144] Inputting the network traffic, the communication mode, and the behavior characteristics into an asset merging analysis model to obtain a second asset corresponding to each communication address output by the asset merging analysis model;

[0145] Based on the first asset and the second asset, assets of the communication addresses are merged.

[0146] The asset management device is also used for:

[0147] comparing the first asset to the second asset;

[0148] If the first asset and the second asset are the same, encrypt the communication addresses belonging to the same asset;

[0149] After detecting that the information encryption is completed, the assets of each communication address are merged.

[0150] The asset management device is also used for:

[0151] Obtaining the asset merger group corresponding to each of the communication addresses within a preset time;

[0152] Determining whether the asset consolidation group is properly consolidated;

[0153] If so, decryption information of each communication address is obtained, and the decryption information is pushed to the first asset corresponding to the asset merging group.

[0154] The asset management device provided in this application, using the asset management method of the above-mentioned embodiment, can solve the technical problems described in the background art. Compared with the prior art, the beneficial effects of the asset management device provided in this application are the same as those of the asset management method provided in the above-mentioned embodiment, and the other technical features of the asset management device are the same as those disclosed in the above-mentioned embodiment method, and are not further described here.

[0155] The present application provides an asset management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the asset management method in the above-mentioned embodiment one.

[0156] Reference below Figure 6 , which shows a schematic diagram of the structure of an asset management device suitable for implementing the embodiments of the present application. The asset management device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The asset management device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0157] like Figure 6 As shown, the asset management device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the asset management device. Processing device 1001, ROM 1002, and RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 can allow the asset management device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows an asset management device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0158] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0159] The asset management device provided in this application, employing the asset management method of the aforementioned embodiment, can resolve the technical problems described in the background art. Compared to the prior art, the beneficial effects of the asset management device provided in this application are the same as those of the asset management method provided in the aforementioned embodiment, and the other technical features of the asset management device are the same as those disclosed in the aforementioned embodiment, and are not further elaborated here.

[0160] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0161] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0162] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer program) stored thereon, and the computer-readable program instructions are used to execute the asset management method in the above-mentioned embodiment.

[0163] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0164] The computer-readable storage medium may be included in the asset management device, or may exist independently without being assembled into the asset management device.

[0165] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the asset management device, the asset management device:

[0166] Obtaining a network traffic log, wherein the network traffic log includes a plurality of communication addresses;

[0167] Analyzing the network traffic log to determine the first asset corresponding to each of the communication addresses;

[0168] Based on the first assets corresponding to the communication addresses, the assets of the communication addresses are merged.

[0169] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0170] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0171] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0172] The computer-readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described asset management method, and is capable of resolving the technical problems described in the background art. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the asset management method provided in the above-described embodiments, and are not further elaborated here.

[0173] An embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above-mentioned asset management method when executed by a processor.

[0174] The computer program product provided in this application can solve the technical problems in the background technology. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiment of this application are the same as the beneficial effects of the asset management method provided in the above embodiment, which will not be repeated here.

[0175] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An asset management method, characterized in that: include: Obtaining a network traffic log, wherein the network traffic log includes a plurality of communication addresses; Analyzing the network traffic log to determine the first asset corresponding to each of the communication addresses; Based on the first assets corresponding to the communication addresses, merging the assets of the communication addresses; The analyzing the network traffic log to determine the first asset corresponding to each communication address includes: Determining whether the network traffic log is a Dynamic Host Configuration Protocol service; If the network traffic log is not a dynamic host configuration protocol service, determining whether the network traffic log is a gateway-type media access control address; if so, determining the first asset corresponding to each of the communication addresses based on the gateway-type media access control address in the network traffic log; If the network traffic log is a dynamic host configuration protocol service, detecting whether the network traffic log contains the same media access control address; if so, correlating and combining the communication addresses corresponding to the same media access control address to generate a plurality of asset merging groups; and merging assets in each of the asset merging groups; If not, after determining whether the network traffic log is a media access control address, the method further includes: If the network traffic log is not a media access control address, obtaining a preset observation time; based on the preset observation time, detecting whether the number of assets corresponding to the network traffic log has changed; if so, merging assets for each of the communication addresses; The asset merging of each communication address based on the first asset corresponding to each communication address includes: Obtaining network traffic, communication patterns, and behavioral characteristics corresponding to the network traffic log, wherein network traffic data packets are captured using a network monitoring tool, the network traffic data packets are parsed and processed using a log analysis tool or a custom script to extract network traffic, and communication patterns are identified by analyzing the time series and flow direction of the data packets. Based on the communication patterns and network traffic, behavioral characteristics are extracted; the network traffic, communication patterns, and behavioral characteristics are input into an asset merging analysis model to obtain a second asset corresponding to each of the communication addresses output by the asset merging analysis model; and asset merging is performed on each of the communication addresses based on the first assets and the second assets; After merging the assets of the communication addresses based on the first assets corresponding to the communication addresses, the method further includes: Obtain an asset merging group corresponding to each of the communication addresses within a preset time; determine whether the asset merging group is correctly merged; if so, obtain decryption information of each of the communication addresses, and push the decryption information to the first asset corresponding to the asset merging group.

2. The asset management method according to claim 1, wherein: The asset merging of each communication address based on the first asset and the second asset includes: comparing the first asset to the second asset; If the first asset and the second asset are the same, encrypt the communication addresses belonging to the same asset; After detecting that the information encryption is completed, the assets of each communication address are merged.

3. An asset management device, characterized in that: include: An acquisition module, configured to acquire a network traffic log, wherein the network traffic log includes a plurality of communication addresses; an analysis module, configured to analyze the network traffic log and determine the first asset corresponding to each of the communication addresses; a merging module, configured to merge the assets of each of the communication addresses based on the first assets corresponding to each of the communication addresses; The analysis module is further configured to determine whether the network traffic log is a dynamic host configuration protocol service; if the network traffic log is not a dynamic host configuration protocol service, determine whether the network traffic log is a gateway-type media access control address; if so, determine the first asset corresponding to each of the communication addresses based on the gateway-type media access control address in the network traffic log; if the network traffic log is a dynamic host configuration protocol service, detect whether the network traffic log contains the same media access control address; if so, associate and combine the communication addresses corresponding to the same media access control address to generate a plurality of asset merging groups; perform asset merging on each of the asset merging groups; if the network traffic log is not a media access control address, obtain a preset observation time; based on the preset observation time, detect whether the number of assets corresponding to the network traffic log has changed; if so, perform asset merging on each of the communication addresses; The merging module is also used to obtain the network traffic, communication mode and behavioral characteristics corresponding to the network traffic log, wherein the network traffic data packets are captured by a network monitoring tool, the network traffic data packets are parsed and processed using a log analysis tool or a custom script, the network traffic is extracted, and the communication mode is identified by analyzing the time series and flow direction of the data packets, and the behavioral characteristics are extracted based on the communication mode and network traffic; the network traffic, the communication mode and the behavioral characteristics are input into the asset merging analysis model to obtain the second asset corresponding to each of the communication addresses output by the asset merging analysis model; based on the first asset and the second asset, each of the communication addresses is merged; an asset merging group corresponding to each of the communication addresses within a preset time is obtained; it is determined whether the asset merging group is correctly merged; if so, the decryption information of each of the communication addresses is obtained, and the decryption information is pushed to the first asset corresponding to the asset merging group.

4. An asset management device, characterized in that: The asset management device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the asset management method according to any one of claims 1 to 2.

5. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the asset management method according to any one of claims 1 to 2 are implemented.

Images