Network asset risk checking method, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, and provides a network asset risk checking method, electronic equipment and a storage medium, and the method comprises the steps: reading and analyzing a target demand; crawling and collecting a network asset target; cleaning and normalizing the collected network assets; performing weak password verification detection on the network assets one by one; and adding a weak password tag to the screened network assets. The method is a scheme of automatic network asset collection and automatic weak password verification, can improve the weak password checking efficiency, reduces the labor cost and omission of manual checking, and is suitable for large-scale network asset risk checking work.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network asset risk investigation method, electronic device and storage medium. Background Art

[0002] The scope of network assets is very broad, ranging from portals, information systems to middleware, operating systems, and various network devices, security devices, IoT devices, etc. Anything that is active or accessible in the network can be classified as a network asset. Asset security has also become a key factor in determining whether the entire network security construction is up to standard. There are many hidden dangers caused by insufficient network asset security. On the one hand, the types and numbers of assets accessed in the network are constantly increasing, and construction forms such as virtualization and private cloud are also being used. The network boundary is gradually blurred, and traditional security construction ideas face huge challenges. It is easy to miss unknown assets and create security blind spots; on the other hand, from the perspective of attackers, the benefits of invading centralized systems such as VPNs, domain control, and unified management platforms are much higher than directly attacking the target host. However, such systems are usually not within the traditional asset protection area and can be easily bypassed and easily enter the intranet.

[0003] Conducting security checks on network assets with weak passwords and filling security holes in a timely manner can prevent many network attacks and protect the information security of enterprises and units. However, the amount of data on network assets is at the level of hundreds of millions. To find network assets with weak passwords, it is necessary to test and verify each network asset one by one. Currently, there is no automatic verification of weak passwords after network collection, which results in the inability to carry out large-scale work in this area due to low efficiency. Summary of the invention

[0004] In order to help improve the problem that the existing technology is inefficient and cannot perform large-scale network asset risk screening, the present application provides a network asset risk screening method, electronic device and storage medium.

[0005] In a first aspect, the present application provides a network asset risk investigation method, the method using the following technical solution includes:

[0006] Read and parse target requirements;

[0007] Crawling and collecting network asset targets; reading target demand texts through the NLP natural language text processing library, and processing and parsing the target demand texts

[0008] Clean and standardize the collected network assets; crawl the network asset targets through crawlers according to the analysis results of the target requirements to collect the required network assets

[0009] Perform weak password verification on each network asset; clean and normalize network asset data through data structure analysis tools and store it in the local database

[0010] Add weak password tags to the screened network assets.

[0011] Among them, the network asset data is read through the weak password verification system, and the network asset data is verified for weak passwords one by one; if weak password assets are found, a weak password tag is added to the network asset.

[0012] Furthermore, the spaCy model is used to detect and label weak passwords on network assets.

[0013] By adopting the above technical solution, risk investigation of network assets can be carried out efficiently and on a large scale.

[0014] In a second aspect, the present application provides an electronic device, which adopts the following technical solution:

[0015] An electronic device, comprising:

[0016] at least one processor;

[0017] Memory;

[0018] At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute a network asset risk screening method.

[0019] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0020] A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute any one of the network asset risk screening methods provided in the first aspect.

[0021] In summary, the technical solution of this application can accurately and efficiently perform a large number of weak password tests on the relevant network assets through the unstructured information of the relevant network asset targets, and then screen out the weak password targets. This technology not only provides effective technical support for network security attack and defense penetration, but can also be applied to the scenario of network asset security protection, which greatly improves work efficiency and is suitable for large-scale automated network asset risk investigation. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of a network asset risk investigation method provided by an embodiment of the present application;

[0023] Figure 2 It is a schematic diagram of the module principle of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-2 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0025] The embodiment of the present application provides a network asset risk screening method, which is used in a network asset risk screening system. This embodiment uses a network asset risk screening system as an application example to specifically illustrate the above method. In actual implementation, the above method can also be used in other systems, and this embodiment does not limit this.

[0026] Specific reference Figure 1 As shown, a network asset risk investigation method includes:

[0027] S10: Read and parse the target requirement: read the target requirement text through the NLP natural language text processing library, and process and parse the target requirement text. In this embodiment, the target requirement text is read and parsed using the NLP natural language text processing library of SpaCy.

[0028] S20: Crawling and collecting network asset targets: According to the analysis results of the target requirements, crawling the network asset targets by using a crawler to collect the required network assets. In this embodiment, Python crawlers are used for crawling.

[0029] S30: Clean and normalize the collected network assets; clean and normalize the network asset data through a data structure analysis tool and store it in a local database. In this embodiment, the Pandas data structure and analysis module are used to clean and normalize the network asset data.

[0030] S40: Perform weak password verification on each network asset: read network asset data through a weak password verification system, and perform network verification on each network asset data for weak passwords.

[0031] S50: adding a weak password tag to the screened network assets: if a weak password asset is found, adding a weak password tag to the network asset.

[0032] In this embodiment, the spaCy model is used to detect weak passwords and label network assets. Of course, other tools and models other than those described in the embodiment can also be used to complete the above steps, which are not limited to the description in this embodiment.

[0033] The technical solution of this application can accurately and efficiently perform a large number of weak password tests on the relevant network assets through the unstructured information of the relevant network asset targets, and then screen out the weak password targets. This technology not only provides effective technical support for network security attack and defense penetration, but can also be applied to the scenario of network asset security protection, which greatly improves work efficiency and is suitable for large-scale automated network asset risk investigation.

[0034] Due to the huge number of network assets on the Internet, if you want to collect a large number of network assets or collect data for designated network asset targets, it is inefficient to manually screen them, and the data specifications found are not uniform. If you need to verify the weak passwords of network assets later, it will be more troublesome and inefficient. In another embodiment of the present invention, first crawl the network asset information, crawl the designated network asset targets, clean the network asset targets, store the network asset data in a localized database according to the data storage specifications, and automatically scan the local network asset information library through the localized weak password detection system to automatically verify whether the network assets have weak password problems. If weak password assets are found, the data will be automatically marked. Through the above steps, network assets with weak passwords can be automatically found.

[0035] This solution uses SpaCy's NLP natural language text processing library to read configuration targets based on the network asset data on the Internet's public network platform, parses target requirements based on intelligent text processing, and automatically crawls network asset targets through Python crawlers, collects all relevant network assets, and uses Pandas data structures and analysis tools to clean and normalize data before storing it in a local database. The automatic weak password verification system automatically reads database network asset information, performs network verification on the network asset information one by one, and if weak password assets are found, the data is recorded and labeled. The network asset target can be found through the label for subsequent work (such as reporting to the National Information Security Vulnerability Sharing Platform).

[0036] The present application also provides an electronic device, such as Figure 2 As shown, Figure 2 The electronic device 700 shown includes: a processor 701 and a memory 703. The processor 701 and the memory 703 are connected, such as through a bus 702. Optionally, the electronic device 700 may also include a transceiver 704. It should be noted that in actual applications, the transceiver 704 is not limited to one, and the structure of the electronic device 700 does not constitute a limitation on the embodiments of the present application.

[0037] Processor 701 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 701 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0038] The bus 702 may include a path to transmit information between the above components. The bus 702 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 702 may be divided into an address bus, a data bus, etc. For ease of representation, Figure 2 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0039] The memory 703 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0040] The memory 703 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 701. The processor 701 is used to execute the application code stored in the memory 703 to implement the contents shown in the above method embodiment.

[0041] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, notebook computers, PDAs (personal digital assistants), PADs (tablet computers), etc., and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 2 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0042] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the network asset risk screening method provided in the above embodiment.

[0043] It should be understood that although the steps in the flowchart of the accompanying drawings are shown in sequence according to the instructions of the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise clearly stated in this document, the execution of these steps is not strictly limited in order and can be performed in other orders.

[0044] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A network asset risk investigation method, characterized in that: The method comprises: S10: read and parse target requirements; S20: crawl and collect network asset targets; S30: Clean and standardize the collected network assets; S40: Perform weak password verification on each network asset; S50: Add weak password tags to the screened network assets.

2. The network asset risk investigation method according to claim 1, characterized in that: In step S10, the target requirement text is read through the NLP natural language text processing library, and the target requirement text is processed and parsed.

3. The network asset risk investigation method according to claim 1, characterized in that: In step S20, according to the analysis result of the target demand, the network asset target is crawled by a crawler to collect the required network assets.

4. The network asset risk investigation method according to claim 1, characterized in that: In step S30, the network asset data is cleaned and normalized by a data structure analysis tool and stored in a local database.

5. The network asset risk investigation method according to claim 1, characterized in that: The network asset data is read through the weak password verification system, and the network asset data is verified for weak passwords one by one; if weak password assets are found, a weak password tag is added to the network asset.

6. The network asset risk investigation method according to claim 1, characterized in that: Use the spaCy model to detect and label weak passwords on network assets.

7. The network asset risk investigation method according to claim 6, characterized in that: Use SpaCy's NLP natural language text processing library to read and parse the target requirement text.

8. The network asset risk investigation method according to claim 6, characterized in that: Use Pandas data structures and parsing modules to clean and normalize network asset data.

9. An electronic device, characterized in that: The electronic device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the network asset risk investigation method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed in a computer, the computer is caused to execute the network asset risk screening method according to any one of claims 1 to 8.

Images