Network security asset mapping and management method and system based on active sniffing analysis

Abstract

The present invention discloses a network security asset mapping and management method and system based on active sniffing analysis, which relates to the field of network asset security technology, including using stateless scanning identification to connect with the system for management and control and element collection; building an active sniffing base based on a network detection and identification model to perform dynamic asset tracking and mark asset changes; building a full-type dynamic network asset knowledge graph, and performing asset risk health assessment based on the knowledge graph. The present invention realizes active and dynamic sniffing of network assets by constructing an IPv4 / IPv6 network detection and identification model, combining port fingerprint stateless scanning and web service fingerprint identification technology. It not only improves the accuracy and efficiency of asset identification, but also ensures the real-time and dynamic nature of asset information.

Description

Technical Field

[0001] The present invention relates to the field of network asset security technology, and in particular to a network security asset mapping and management method and system based on active sniffing analysis. Background Art

[0002] Driven by the wave of digitalization, the networking and intelligent level of enterprise assets is increasing day by day. At the same time, network security risks are also showing a complex and changeable trend. As the cornerstone for ensuring the safety of enterprise operations, the management efficiency of network security assets is directly related to the strength of the core competitiveness of the enterprise. However, traditional asset management methods have been difficult to adapt to the current rapidly developing network environment, and an efficient and intelligent asset management system is urgently needed to meet the challenges. To this end, the present invention proposes a network security asset mapping and dynamic management system based on active sniffing analysis, which aims to achieve comprehensive, real-time and accurate management of assets through advanced network detection technology, data analysis methods and security management strategies, so as to safeguard enterprise network security. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the problem to be solved by the present invention is that the traditional asset management method is difficult to adapt to the current rapidly changing asset data.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a network security asset mapping and management method based on active sniffing analysis, which includes: using stateless scanning identification and system connection to perform management and control and element collection; building an active sniffing base based on a network detection and identification model to perform dynamic asset tracking and mark asset changes; building a knowledge graph of all types of dynamic network assets, and performing asset risk health assessment based on the knowledge graph.

[0006] As a preferred solution of the network security asset mapping and management method based on active sniffing analysis described in the present invention, the use of stateless scanning identification and system connection for management and control includes asset identification through port fingerprint stateless scanning identification and web service fingerprint identification, and connection with the system; the element collection includes identifying the device type, device information and asset information after connecting to the system.

[0007] As a preferred solution of the network security asset mapping and management method based on active sniffing analysis described in the present invention, wherein: the construction of an active sniffing base based on a network detection and identification model includes, based on the IPv4 / IPv6 network detection and identification model, detecting and acquiring various types of data in the network by deploying multiple target detection engines; the detection engine includes a node basic information detection payload, a routing security equipment detection payload, an Internet of Things detection payload, a business system detection payload, and a vulnerability detection payload.

[0008] As a preferred solution of the network security asset mapping and management method based on active sniffing analysis described in the present invention, the dynamic asset tracking includes: after cleaning and feature extraction of the IP address, MAC address, open port, running service, operating system type and security patch level data actively sniffed out by the asset, the asset is divided into different clusters using a clustering algorithm, and then the asset fingerprint information and fingerprint features in each cluster are extracted; in response to asset changes, a Simhash algorithm is used to generate a fixed-length hash value for the extracted feature data, for each asset, the Simhash value calculated for the first time is saved as a benchmark value, and a new Simhash value of each asset is re-extracted and calculated after a preset time interval, and the newly calculated Simhash value is compared with the benchmark value by comparing the different bits in the binary representation of the two hash values, and a threshold is set to determine whether the asset has changed, thereby dynamically tracking the asset.

[0009] As a preferred solution of the network security asset mapping and management method based on active sniffing analysis described in the present invention, the marking of asset changes includes marking the changes of the scanned assets after each round of active sniffing, and the change status of the assets is divided into four states: New, Changed, Unchanged, and Stable; the New state indicates that the asset is introduced or registered into the organization's financial, asset management system or records for the first time; the Changed state indicates that the asset has undergone any form of change during its life cycle, including changes in location, status, value, owner or management responsibility; the Unchanged state indicates that the status, value or attributes of the asset have not changed since the last assessment or audit; the Stable state indicates that the asset remains in a consistent state for a period of time, and the performance, value or management responsibility has not changed.

[0010] As a preferred solution of the network security asset mapping and management method based on active sniffing analysis described in the present invention, the construction of a full-type dynamic network asset knowledge graph includes: using natural language processing technology and named entity recognition technology to extract attribute information of the data, and establishing associations between data based on the attribute information; fusing knowledge from different data sources, abstracting the concepts of the constructed data layer, and forming a model layer of the knowledge graph; collecting new asset data, extracting features related to the attributes of the asset itself, and automatically generating labels based on the feature information of the asset, and finally forming a full-type dynamic network asset knowledge graph.

[0011] As a preferred solution of the network security asset mapping and management method based on active sniffing analysis described in the present invention, the asset risk health assessment includes building a network asset security risk assessment system, identifying security threats to asset data in the knowledge graph and quantifying risk levels, formulating assessment indicators for asset elements, assigning a risk value to each assessment indicator, and using weight allocation and scoring systems to quantify asset risks.

[0012] Another object of the present invention is to provide a network security asset mapping and management system based on active sniffing analysis, which can dynamically track network asset data and perform security assessments.

[0013] To solve the above technical problems, the present invention provides the following technical solutions: a system for network security asset mapping and management methods based on active sniffing analysis, comprising: a system connection module, an asset data tracking module and an asset risk assessment module; the system connection module adopts stateless scanning identification and system connection for management and control and element collection; the asset data tracking module constructs an active sniffing base based on a network detection and identification model, performs dynamic asset tracking, and marks asset changes; the asset risk assessment module constructs a knowledge graph of all types of dynamic network assets, and performs asset risk health assessment based on the knowledge graph.

[0014] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the network security asset mapping and management method based on active sniffing analysis as described above are implemented.

[0015] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the network security asset mapping and management method based on active sniffing analysis as described above.

[0016] The beneficial effects of the present invention are as follows: the traditional asset management method is difficult to adapt to the current fast and dynamic changes in asset data. The present invention realizes active and dynamic sniffing of network assets by building an IPv4 / IPv6 network detection and identification model, combining port fingerprint stateless scanning and web service fingerprint identification technology. It not only improves the accuracy and efficiency of asset identification, but also ensures the real-time and dynamic nature of asset information.

[0017] And based on the Simhash algorithm, asset change identification is carried out to achieve rapid response and effective management of asset changes. By building a knowledge graph of all types of assets, a healthy assessment of asset security is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0019] Figure 1 This is a flow chart of the network security asset mapping and management method based on active sniffing analysis in Example 1.

[0020] Figure 2 This is an asset target entity attribute description diagram of the network security asset mapping and management method based on active sniffing analysis in Example 1.

[0021] Figure 3 This is a diagram of the security equipment collaborative defense system of the network security asset mapping and management method based on active sniffing analysis in Example 1.

[0022] Figure 4 This is a module structure diagram of the network security asset mapping and management system based on active sniffing analysis in Example 2. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0024] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0025] Example 1, reference Figure 1-Figure 3, which is the first embodiment of the present invention, and which provides a network security asset mapping and management method based on active sniffing analysis, including: Figure 1 As shown:

[0026] S1. Use stateless scanning and recognition to connect with the system for management, control and element collection.

[0027] The business of power generation enterprises involves many types of assets, including fuel control, real-time supervision of production data, SIS, MIS, power forecasting, portals, indicator supervision, access control, security and other systems. Equipment types include office computers, printers, fax machines, telephones, card readers, cameras, acquisition terminals, servers, workstations, hyper-convergence, virtualization, routers, switches, AC controllers, AP terminals, firewalls, WAFs, probes, etc. This paper mainly realizes asset identification through port fingerprint stateless scanning and web service fingerprint identification. Port fingerprint stateless scanning and identification, that is, without paying attention to the TCP connection status and without occupying the TCP / IP protocol stack resources of the operating system, directly performs data packaging at the bottom layer and maintains and manages the connection. Including TCP full connection scanning, TCPSYN scanning, TCPConnect scanning, UDPICMP scanning, etc., it can discover and identify various devices such as DTU / DCU, and identify device information including IP address, MAC address, device type, device model, operating system, security domain, unit / department, etc. The scanning technology is shown in Table 1.

[0028] Table 1: Scanning technology principle table

[0029]

[0030]

[0031] The web service fingerprint recognition of power generation enterprises is mainly used to obtain the formation of web applications for fuel control, real-time supervision of production data, SIS, MIS, power forecasting, portals, indicator supervision, access control, security and other systems. By sending HTTP requests to the target system, analyzing the corresponding data packets, extracting fingerprint features, and comparing the components in the web library, the components corresponding to the successfully matched templates are used as the final recognition results.

[0032] S2. Build an active sniffing base based on the network detection and identification model to perform dynamic asset tracking and mark asset changes.

[0033] Through stateless scanning (such as SYN scanning) or stateful scanning (such as TCPConnect scanning) and other port scanning, fingerprint recognition, protocol analysis and other technologies, the IPv4 / IPv6 network detection and identification model is constructed, and various detection engines and target payloads are used to detect and obtain various types of data in the network. At the network detection layer, combined with the actual network situation, multiple target detection engines are deployed, combined with node basic information detection payloads, routing security equipment detection payloads, Internet of Things detection payloads, business system detection payloads, vulnerability / weak password detection payloads, etc., to achieve basic information detection and collection and vulnerability, vulnerability scanning and other functions. The technical principle of the detection engine is shown in Table 2.

[0034] Table 2: Detection engine technology principle table

[0035]

[0036]

[0037] Since there is a great deal of uncertainty in the correspondence between network assets and addresses, there will be asset device types that are discovered for the first time in each scan detection result. After cleaning the data and extracting features from the IP address, MAC address, open ports, running services, operating system type, security patch level and other data that are actively sniffed out by the asset, clustering algorithms such as K-means, hierarchical clustering, DBSCAN, and spectral clustering are used to divide the assets into different clusters, and then extract the asset fingerprint information and fingerprint features in each cluster. For asset changes, the Simhash algorithm is used to generate a fixed-length hash value for the extracted feature data. For each asset, the Simhash value calculated for the first time is saved as the benchmark value, and the new Simhash value of each asset is re-extracted and calculated regularly. The newly calculated Simhash value is compared with the benchmark value by comparing the different bits in the binary representation of the two hash values. At the same time, a threshold is set to determine whether the asset has changed significantly, thereby laying the foundation for dynamic asset tracking, effectively avoiding the inaccurate detection of assets due to changes in network asset attributes, and improving the overall management efficiency of asset management.

[0038] After each round of active sniffing, the scanned assets should be marked for changes. The change status of assets is divided into four states: New, Changed, Unchanged, and Stable:

[0039] New: The asset is introduced or registered into the organization's financial, asset management system or records for the first time. The asset details (such as description, location, value, owner, etc.) must be recorded completely and accurately.

[0040] Changed: Any changes to an asset during its lifecycle, including but not limited to changes in location, status, value, owner, or management responsibility. The reason, time, executor, and status after the change need to be recorded in detail.

[0041] Unchanged: The asset has not changed in status, value, or attributes since the last valuation or audit. Usually means the asset is stable and reliable in its current state. Reduces the need for management and monitoring, but still requires regular audits and inspections.

[0042] Stable: An asset remains in a relatively stable or consistent state over a period of time, with no significant changes in performance, value, or management responsibilities.

[0043] S3. Build a knowledge graph of all types of dynamic network assets and conduct asset risk health assessment based on the knowledge graph.

[0044] In order to achieve comprehensive, dynamic and refined management of network assets, it is necessary to integrate data integration technology, natural language processing technology, graph database technology, entity linking technology, dynamic update technology, etc. to build a full-type dynamic network asset knowledge graph. As an important information representation and management tool, its framework design must fully consider the integrity, accuracy and efficiency of the data.

[0045] Knowledge extraction: Use natural language processing (NLP) technology to extract information such as entities, relationships, and attributes from unstructured data. Use named entity recognition (NER) technology to identify key entities such as asset names, IP addresses, and domain names in text. Use relationship extraction technology to discover semantic relationships between entities, such as dependency relationships and access relationships between assets.

[0046] Knowledge fusion: Fusion of knowledge from different data sources to eliminate duplicate and conflicting information. Use entity alignment technology to determine whether multiple entities in the same or different data sets point to the same real-world asset. Fill in attribute values ​​based on the credibility and quantity of data sources to ensure the accuracy and completeness of knowledge.

[0047] Knowledge processing and ontology construction: abstract the concepts of the constructed data layer to form the model layer of the knowledge graph. Build the asset ontology to define the attributes, relationships and constraints of the assets. Use the ontology construction technology to build the top-level ontology of the asset knowledge graph to form a well-structured concept hierarchy tree.

[0048] At the same time, for the cross-layer correlation analysis of the detection data, based on asset fingerprint information and vulnerability information, using the target entity label generation technology, a target attribute knowledge graph is formed through multiple links such as data collection, processing, feature extraction and final label generation.

[0049] Data collection: Through active sniffing, dynamic asset tracking, asset change marking and other links, the data of network assets, including IP addresses, domain names, MAC addresses, port information, service types, etc., are cleaned, unified in format, and standardized.

[0050] Feature extraction: Extract features related to the attributes of the asset itself, such as IP address, domain name, organization, etc. Analyze the behavior patterns of assets, such as traffic, access frequency, response time, etc. Explore the relationship between assets, such as dependency, communication relationship, etc. Complete the extraction of asset data features.

[0051] Tag generation: Use predefined templates to automatically generate tags based on the asset's feature information. This includes the asset's basic information, security status, business classification, etc. By configuring a series of rules, the corresponding tags are matched according to the asset's features. Rules can be defined based on static features, dynamic features, or associated features. Use machine learning algorithms to learn the asset's features and automatically generate tags. This method can automatically discover patterns in the data and generate more accurate tags. The knowledge graph is as follows: Figure 2 shown.

[0052] Break through data barriers to achieve dynamic management of automated assets: At present, various power generation companies have deployed multiple security protection methods such as situational awareness systems, access systems, firewalls, IPS, and terminal security management software in network security protection for the overall situation, terminal entities, etc. However, due to the influence of family vulnerabilities, security equipment is often deployed in heterogeneous modes. While ensuring security, data barriers are formed invisibly, resulting in inconsistent technical standards, incompatible data formats, privacy and security concerns, etc. By establishing a unified data format, encoding, and naming rules to achieve a unified data standard, break through the API interface between situational awareness, terminal protection, firewalls and other equipment and the asset management platform, and use data synchronization technologies such as real-time database replication and message queues to ensure that asset data in each system is consistent. Use data exchange platforms or middleware to realize data exchange between asset management systems and systems such as situational awareness, firewalls, and terminal antivirus software. Push information about assets in the asset management system (such as IP address, MAC address, device type, etc.) to the situational awareness system in real time so that the situational awareness system can fully grasp the asset situation in the network. Similarly, the abnormal or threat information identified by the situational awareness system can be pushed to the asset management system, and the terminal antivirus software can regularly send security reports to the asset management system, including discovered viruses, malware, etc., so that the company's network administrators can promptly understand and deal with security issues of related assets. Form a "multi-source linkage, dynamic defense" "one game" defense system, such as Figure 3 shown.

[0053] Based on DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability), a network asset security risk assessment system is built to identify security threats to key assets, quantify risk levels, and develop specific assessment indicators for each DREAD element. For example, destructive assessment indicators can include the severity of data leakage, the duration of service interruption, etc.; reproducible assessment indicators can include the complexity of vulnerability exploitation steps, required skill level, etc. Based on the collected asset information and the developed assessment indicators, a DREAD assessment is conducted on each asset, a risk value is assigned, and a weight distribution and scoring system is used to quantify the risk. This allows an assessment of the health of asset security risks.

[0054] Example 2, reference Figure 4 , which is the second embodiment of the present invention, and is different from the first embodiment in that: a system for network security asset mapping and management method based on active sniffing analysis, including a system connection module 100, an asset data tracking module 200 and an asset risk assessment module 300; the system connection module 100 adopts stateless scanning identification and system connection for management and control and element collection; the asset data tracking module 200 builds an active sniffing base based on the network detection and identification model, performs dynamic asset tracking, and marks asset changes; the asset risk assessment module 300 builds a knowledge graph of all types of dynamic network assets, and performs asset risk health assessment based on the knowledge graph.

[0055] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0056] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0057] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0058] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0059] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security asset mapping and management method based on active sniffing analysis, characterized by: include, Use stateless scanning and recognition to connect with the system for control and element collection; Build an active sniffing base based on the network detection and identification model to track assets dynamically and mark asset changes; Build a knowledge graph of all types of dynamic network assets and conduct asset risk health assessment based on the knowledge graph.

2. The network security asset mapping and management method based on active sniffing analysis as claimed in claim 1, characterized in that: The use of stateless scanning identification and system connection for control includes asset identification through port fingerprint stateless scanning identification and web service fingerprint identification, and connection with the system; The element collection includes identifying the device type, device information and asset information after connecting to the system.

3. The network security asset mapping and management method based on active sniffing analysis as claimed in claim 2, characterized in that: The active sniffing base constructed based on the network detection and identification model includes, based on the IPv4 / IPv6 network detection and identification model, detecting and acquiring various types of data in the network by deploying multiple target detection engines; The detection engine includes node basic information detection payload, routing security equipment detection payload, Internet of Things detection payload, business system detection payload, and vulnerability detection payload.

4. The network security asset mapping and management method based on active sniffing analysis as claimed in claim 3 is characterized by: The dynamic asset tracking includes cleaning and feature extraction of IP addresses, MAC addresses, open ports, running services, operating system types and security patch level data actively sniffed by the assets, dividing the assets into different clusters using a clustering algorithm, and then extracting asset fingerprint information and fingerprint features in each cluster; In response to asset changes, the Simhash algorithm is used to generate a fixed-length hash value for the extracted feature data. For each asset, the Simhash value calculated for the first time is saved as the benchmark value. The new Simhash value of each asset is re-extracted and calculated after a preset time interval. The newly calculated Simhash value is compared with the benchmark value by comparing the different numbers of bits in the binary representation of the two hash values. At the same time, a threshold is set to determine whether the asset has changed, thereby dynamically tracking the asset.

5. The network security asset mapping and management method based on active sniffing analysis as claimed in claim 4, characterized in that: The marking of asset changes includes marking the changes of the scanned assets after each round of active sniffing. The change status of the assets is divided into four states: New, Changed, Unchanged, and Stable; The New state indicates that the asset is introduced or registered into the organization's financial or asset management system or records for the first time; The Changed state indicates that the asset has undergone any form of change during its life cycle, including changes in location, status, value, owner, or management responsibility; The Unchanged status indicates that the asset has not changed in status, value, or attributes since the last valuation or audit; The Stable state means that the asset remains in a consistent state over time, with no changes in performance, value, or management responsibilities.

6. The network security asset mapping and management method based on active sniffing analysis as claimed in claim 5, characterized in that: The construction of a knowledge graph of all types of dynamic network assets includes extracting attribute information of data using natural language processing technology and named entity recognition technology, and establishing associations between data based on the attribute information; Integrate knowledge from different data sources, abstract concepts from the constructed data layer, and form the model layer of the knowledge graph; Collect new asset data, extract features related to the asset's own attributes, automatically generate labels based on the asset's feature information, and ultimately form a knowledge graph of all types of dynamic network assets.

7. The network security asset mapping and management method based on active sniffing analysis as claimed in claim 6, characterized in that: The asset risk health assessment includes building a network asset security risk assessment system, identifying security threats to asset data in the knowledge graph and quantifying risk levels, formulating assessment indicators for asset elements, assigning a risk value to each assessment indicator, and using a weight allocation and scoring system to quantify asset risks.

8. A system using the network security asset mapping and management method based on active sniffing analysis as claimed in any one of claims 1 to 7, characterized in that: It comprises a system connection module (100), an asset data tracking module (200) and an asset risk assessment module (300); The system connection module (100) uses stateless scanning identification to connect with the system for management and control and element collection; The asset data tracking module (200) constructs an active sniffing base based on a network detection and recognition model, performs dynamic asset tracking, and marks asset changes; The asset risk assessment module (300) constructs a knowledge graph of all types of dynamic network assets and performs asset risk health assessment based on the knowledge graph.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security asset mapping and management method based on active sniffing analysis described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security asset mapping and management method based on active sniffing analysis described in any one of claims 1 to 7 are implemented.

Images