Network topology detection method and device, equipment and storage medium

Abstract

The invention discloses a network topology detection method, device and equipment and a storage medium, relates to the field of network security, is applied to a management end, and comprises the following steps: creating a detection topology task for each target client of each target node, obtaining each target scanning scheme corresponding to each target client from a target database, determining a target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme, and issuing each target scanning task to each target client, so that each target client executes a detection identification operation based on the target scanning task and generates a corresponding target detection result; and obtaining each target detection result and storing the target detection results in a target database, and executing network topology based on all the target detection results and the current target node data to obtain a network topology detection result. According to the invention, the accuracy and usability of network topology detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network topology detection method, device, equipment and storage medium. Background Art

[0002] At present, in the security field, with the continuous advancement of information innovation, network environments and devices have become more complex and dynamic, which makes it more difficult to track and map network topologies. Therefore, it is necessary to have a continuous monitoring and update mechanism for the dynamic changes of network topology to ensure the accuracy of network topology. Traditional network topology detection methods require the detected device to support and run related network services, and also need to configure related firewall policies. However, there are usually many security devices from different periods in the security field, and because of security needs, each device will also deploy anti-scanning detection security components and configure strict firewall policies. It does not support a large number of deployed probe programs. This makes the traditional network topology detection method not suitable for the increasingly complex security network environment and cannot accurately reflect the real situation of the network.

[0003] In summary, how to improve the accuracy and usability of network topology detection is a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a network topology detection method, device, equipment and storage medium, which can improve the accuracy and usability of network topology detection. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a network topology detection method, which is applied to a management end and includes:

[0006] Creating a detection topology task for each target client of each target node, acquiring each target scanning scheme corresponding to each target client from a target database, and determining a target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme;

[0007] Sending each of the target scanning tasks to the corresponding target clients so that each of the target clients performs detection and identification operations based on each of the target scanning tasks and generates corresponding target detection results;

[0008] Acquire each of the target detection results sent by each of the target clients, and store all of the target detection results in the target database, so as to execute the network topology based on all the target detection results in the target database and the current target node data to obtain the network topology detection result;

[0009] Among them, the target nodes include switches and routers, the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, and each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client.

[0010] Optionally, before creating a topology detection task for each target client of each target node, the process further includes:

[0011] The target node and each target client corresponding to the target node are determined, and environment recognition is performed on each target client based on a preset environment recognition operation to obtain each target scanning solution corresponding to each target client.

[0012] Optionally, performing environment identification on each of the target clients based on a preset environment identification operation to obtain each of the target scanning solutions corresponding to each of the target clients includes:

[0013] Acquire current target node data of the target node based on the simple network management protocol, and store the current target node data in the target database;

[0014] An asset identification task is issued to each of the target clients so that each of the target clients scans the target assets based on the asset identification task to obtain each of the target scanning solutions corresponding to each of the target clients.

[0015] Optionally, the sending of the asset identification task to each of the target clients so that each of the target clients scans the target assets based on the asset identification task to obtain each of the target scanning solutions corresponding to each of the target clients includes:

[0016] Sending an asset identification task to each of the target clients so that each of the target clients determines a target scanning type based on the asset identification task, and determines a target scanning mode based on the target scanning type;

[0017] Scanning the target asset by using the target scanning mode through the target client, and judging whether the target scanning mode meets the preset matching condition based on the corresponding scanning result;

[0018] If the scanning result indicates that the target scanning mode meets the preset matching condition, the target scanning mode is determined as the target scanning scheme corresponding to the target client.

[0019] Optionally, the target scanning type is any one or more combinations of full-connection scanning based on transmission control protocol, semi-open scanning based on synchronization sequence numbering, and scanning based on user datagram protocol; the preset matching condition is that the target scanning mode is adapted to the network conditions and network protocol where the target client is located.

[0020] Optionally, the network topology detection method further includes:

[0021] The current target node data of the target node is collected based on a preset collection time and a simple network management protocol, and the current target node data is updated to the target database.

[0022] Optionally, executing the network topology based on all target detection results in the target database and current target node data to obtain the network topology detection result includes:

[0023] Determine a first relationship table and a second relationship table from the target detection result and the current target node data in the target database; the first relationship table is a relationship table between the switch interface and the MAC address, and the second relationship table is a relationship table between the IP address and the MAC address;

[0024] All the target detection results are merged with the first relationship table, the second relationship table and the current target node data to obtain a network topology detection result.

[0025] In a second aspect, the present application discloses a network topology detection device, which is applied to a management end and includes:

[0026] A scanning task determination module is used to create a detection topology task for each target client of each target node, obtain each target scanning scheme corresponding to each target client from a target database, and determine a target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme;

[0027] A scanning task sending module, used to send each of the target scanning tasks to the corresponding target clients, so that each of the target clients performs detection and identification operations based on each of the target scanning tasks and generates corresponding target detection results;

[0028] A topology detection result acquisition module is used to obtain each of the target detection results sent by each of the target clients, and store all of the target detection results in the target database, so as to execute the network topology based on the target detection results in the target database and the current target node data to obtain the network topology detection result;

[0029] Among them, the target nodes include switches and routers, the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, and each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client.

[0030] In a third aspect, the present application discloses an electronic device, comprising:

[0031] Memory, used to store computer programs;

[0032] The processor is used to execute the computer program to implement the aforementioned network topology detection method.

[0033] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned network topology detection method when executed by a processor.

[0034] In the present application, when performing network topology detection, the management end creates a detection topology task for each target client of each target node, obtains each target scanning scheme corresponding to each target client from the target database, and determines the target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme; sends each target scanning task to the corresponding target client, so that each target client performs detection and identification operations based on each target scanning task and generates corresponding target detection results; obtains each target detection result sent by each target client, and stores all the target detection results in the target database, so as to execute the network topology based on the target detection results in the target database and the current target node data to obtain the network topology detection result; wherein, the target node includes switches and routers, the current target node data includes the interface table, address transfer table and address resolution protocol table of the current network communication equipment, and each target detection result includes the corresponding IP address, MAC address, open port and asset type corresponding to each target client. It can be seen that in this application, based on the target scanning scheme, the management end sends a target scanning task that matches it to each target client, and the target client performs a detection and identification operation based on the target scanning task to generate a corresponding target detection result. After obtaining the target detection result, the management end saves the target detection result to the target database. Thereafter, the network topology detection result can be determined based on the target detection result in the target database and the current target node data. Since the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client. Therefore, the determined network topology detection result is more accurate and the accuracy of the network topology is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0036] Figure 1 A flow chart of a network topology detection method disclosed in this application;

[0037] Figure 2 This is an overall deployment architecture diagram disclosed in this application;

[0038] Figure 3 A schematic diagram of a process flow of an automatic environment identification stage disclosed in this application;

[0039] Figure 4 A schematic diagram of a topology detection phase process disclosed in this application;

[0040] Figure 5 A schematic diagram of the structure of a network topology detection device disclosed in this application;

[0041] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] At present, in the security field, with the continuous advancement of information innovation, network environments and devices have become more complex and dynamic, which makes it more difficult to track and map network topologies. Therefore, it is necessary to have a continuous monitoring and update mechanism for the dynamic changes of network topology to ensure the accuracy of network topology. Traditional network topology detection methods require the detected device to support and run related network services, and also need to configure related firewall policies, but there are usually many security devices from different periods in the security field, and because of security needs, each device will also deploy anti-scanning detection security components and configure strict firewall policies. It does not support a large number of deployed probe programs, which makes the traditional network topology detection method not suitable for the current increasingly complex security network environment and cannot accurately reflect the real situation of the network. In order to solve the above technical problems, the present application discloses a network topology detection method that can improve the accuracy and ease of use of network topology detection.

[0044] See also Figure 1 As shown, an embodiment of the present invention discloses a network topology detection method, which is applied to a management end and includes:

[0045] Step S11, creating a detection topology task for each target client of each target node, obtaining each target scanning scheme corresponding to each target client from a target database, and determining a target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme.

[0046] In this embodiment, the overall deployment architecture is as follows: Figure 2 As shown, it includes a management end and a detection client (also known as a client). The management end is used to manage each detection client and send target scanning tasks to the client, aggregate and receive asset data scanned by each client (also known as target detection results), display network assets and generate a complete network topology based on the collected data, and the client is deployed in a small number of machines under key network nodes (also known as target nodes) for asset scanning, discovery, and identification in this network domain. In other words, if there are 5 machines under the target node, 3 of them can be deployed as clients under the target node, so that these clients can be used to perform asset scanning, discovery, and identification in this network domain. Among them, the target node includes switches and routers.

[0047] In this embodiment, before creating a detection topology task for each target client of each target node, it is also necessary to determine the target node and each target client corresponding to the target node, and perform environment recognition on each target client based on a preset environment recognition operation to obtain each target scanning solution corresponding to each target client. Figure 3As shown, the specific process of performing environmental identification on each target client based on a preset environmental identification operation to obtain each target scanning solution corresponding to each target client may include: obtaining the current target node data of the target node based on a simple network management protocol, and storing the current target node data in a target database; issuing an asset identification task to each target client so that each target client scans the target asset based on the asset identification task to obtain each target scanning solution corresponding to each target client. When performing asset scanning, the target client may scan the target asset based on the NMAP (Network Mapper) technology.

[0048] In a specific implementation, when determining a scanning scheme, an asset identification task is issued to each target client so that each target client determines a target scanning type based on the asset identification task, and determines a target scanning mode based on the target scanning type; the target client uses the target scanning mode to scan the target asset, and determines whether the target scanning mode meets the preset matching condition based on the corresponding scanning result; if the scanning result indicates that the target scanning mode meets the preset matching condition, the target scanning mode is determined as the target scanning scheme corresponding to the target client. Among them, the target scanning type is any one or more combinations of full connection scanning based on transmission control protocol, semi-open scanning based on synchronization sequence numbering, and scanning based on user datagram protocol; the preset matching condition is the target scanning mode and the network situation and network protocol adaptation of the target client. At the same time, a new target scanning mode can be obtained by modifying the parameters of the current target scanning mode, thereby eliminating the influence of factors such as network fluctuations on the adaptability of the target scanning mode to the network environment where the target client is located. That is, the client will determine different target scanning modes according to different parameters such as scanning type, scanning speed and scanning frequency, and use these target scanning modes to scan the target client to obtain corresponding scanning results, and then determine the target scanning scheme that is most suitable for the target client from these target scanning modes based on the obtained scanning results. After obtaining the target scanning scheme, the target client can send the target scanning scheme back to the management end, and then the management end uploads the target scanning scheme to the target database.

[0049] It is understandable that the above-mentioned automatic environment identification process can be executed in a variety of ways, including but not limited to automatic execution after initial installation, execution initiated by the management end, or automatic execution at a fixed period.

[0050] In this embodiment, Figure 4As shown, after determining the target clients under each target node, the management end can create detection topology tasks for these target clients, and then obtain the target scanning schemes corresponding to these target clients from the target database, thereby determining the target scanning tasks corresponding to each target client based on the detection topology tasks and the target scanning schemes. It is understandable that the target scanning schemes corresponding to different target clients may be different, their detection topology tasks may also be different, and the corresponding target scanning tasks may also be different.

[0051] Step S12: Send each of the target scanning tasks to the corresponding target clients, so that each of the target clients performs detection and identification operations based on each of the target scanning tasks and generates corresponding target detection results.

[0052] In this embodiment, after determining the target scanning task corresponding to each target client, the management end can send each target scanning task to the corresponding target client, and the target client will perform detection and identification operations based on the received target scanning task to obtain the corresponding target detection result. The target detection result includes the corresponding IP (Internet Protocol) address, MAC address (Media Access Control Address), open port, and asset type of each target client. Specifically, the target client can perform detection and identification operations based on NMAP technology. In addition, since the client will continue to generate new network relationship data at key network nodes (switches, routers) when scanning and detecting assets, the client will continue to generate new network relationship data at key network nodes (switches, routers) when performing such operations. Figure 4 During the detection and identification operation shown, the management end will collect the current target node data of the target node based on the preset collection time and the simple network management protocol, and update the current target node data to the target database to continuously improve and update the topology network. Among them, the current target node data includes the interface table, address transfer table and address resolution protocol table of the current network communication device.

[0053] Step S13 obtains each of the target detection results sent by each of the target clients, and stores all of the target detection results in the target database, so as to execute the network topology based on all the target detection results in the target database and the current target node data to obtain the network topology detection result.

[0054] In this embodiment, after obtaining the target detection result transmitted back by the target client, the management end will save the target detection result into the target database, and then execute the network topology based on all the target detection results in the target database and the current target node data, so as to obtain the current network topology detection result. In a specific implementation, the specific process of the management end executing the network topology based on all the target detection results in the target database and the current target node data to obtain the network topology detection result may include: determining the first relationship table and the second relationship table from the target detection results in the target database and the current target node data; the first relationship table is the relationship table between the switch interface and the MAC address, and the second relationship table is the relationship table between the IP address and the MAC address; all the target detection results are merged with the first relationship table, the second relationship table and the current target node data to obtain the network topology detection result.

[0055] It can be seen that in this application, based on the target scanning scheme, the management end sends a target scanning task that matches it to each target client, and the target client performs a detection and identification operation based on the target scanning task to generate a corresponding target detection result. After obtaining the target detection result, the management end saves the target detection result to the target database. Thereafter, the network topology detection result can be determined based on the target detection result in the target database and the current target node data. Since the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client. Therefore, the determined network topology detection result is more accurate and the accuracy of the network topology is improved.

[0056] See also Figure 5 As shown, the present application discloses a network topology detection device, which is applied to a management end and includes:

[0057] The scanning task determination module 11 is used to create a detection topology task for each target client of each target node, obtain each target scanning scheme corresponding to each target client from the target database, and determine the target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme;

[0058] The scanning task sending module 12 is used to send each of the target scanning tasks to the corresponding target clients, so that each of the target clients performs detection and identification operations based on each of the target scanning tasks and generates corresponding target detection results;

[0059] A topology detection result acquisition module 13 is used to obtain each target detection result sent by each target client, and store all the target detection results in the target database, so as to execute the network topology based on the target detection results in the target database and the current target node data to obtain the network topology detection result;

[0060] Among them, the target nodes include switches and routers, the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, and each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client.

[0061] It can be seen that in this application, based on the target scanning scheme, the management end sends a target scanning task that matches it to each target client, and the target client performs a detection and identification operation based on the target scanning task to generate a corresponding target detection result. After obtaining the target detection result, the management end saves the target detection result to the target database. Thereafter, the network topology detection result can be determined based on the target detection result in the target database and the current target node data. Since the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client. Therefore, the determined network topology detection result is more accurate and the accuracy of the network topology is improved.

[0062] In a specific embodiment, the device may further include:

[0063] The scanning scheme determination module is used to determine the target node and each target client corresponding to the target node, and perform environment recognition on each target client based on a preset environment recognition operation to obtain each target scanning scheme corresponding to each target client.

[0064] In a specific implementation, the scanning scheme determination module may specifically include:

[0065] A node data storage submodule, used for acquiring current target node data of a target node based on a simple network management protocol, and storing the current target node data in the target database;

[0066] The scanning scheme determination submodule is used to issue an asset identification task to each target client so that each target client scans the target asset based on the asset identification task to obtain each target scanning scheme corresponding to each target client.

[0067] In a specific implementation, the scanning scheme determination submodule may specifically include:

[0068] A scanning mode determination unit, configured to send an asset identification task to each of the target clients so that each of the target clients determines a target scanning type based on the asset identification task, and determines a target scanning mode based on the target scanning type;

[0069] A scanning result judgment unit, configured to scan the target asset using the target scanning mode through the target client, and judge whether the target scanning mode meets a preset matching condition based on a corresponding scanning result;

[0070] The scanning scheme determining unit is configured to determine the target scanning mode as the target scanning scheme corresponding to the target client if the scanning result indicates that the target scanning mode meets the preset matching condition.

[0071] In a specific embodiment, the device may further include:

[0072] The node data updating module is used to collect the current target node data of the target node based on the preset collection time and the simple network management protocol, and update the current target node data to the target database.

[0073] In a specific implementation, the topology detection result acquisition module 13 may specifically include:

[0074] A relationship table determination unit, configured to determine a first relationship table and a second relationship table from the target detection result and the current target node data in the target database; the first relationship table is a relationship table between the switch interface and the MAC address, and the second relationship table is a relationship table between the IP address and the MAC address;

[0075] The topology detection result acquisition unit is used to merge all the target detection results with the first relationship table, the second relationship table and the current target node data to obtain a network topology detection result.

[0076] Furthermore, the present application also discloses an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0077] Figure 6A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network topology detection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0078] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0079] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0080] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network topology detection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0081] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed network topology detection method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0082] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0083] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0084] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0085] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0086] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A network topology detection method, characterized in that: Applied to the management side, including: Creating a detection topology task for each target client of each target node, acquiring each target scanning scheme corresponding to each target client from a target database, and determining a target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme; Sending each of the target scanning tasks to the corresponding target clients so that each of the target clients performs detection and identification operations based on each of the target scanning tasks and generates corresponding target detection results; Acquire each of the target detection results sent by each of the target clients, and store all of the target detection results in the target database, so as to execute the network topology based on all the target detection results in the target database and the current target node data to obtain the network topology detection result; Among them, the target nodes include switches and routers, the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, and each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client.

2. The network topology detection method according to claim 1, characterized in that: Before creating a topology detection task for each target client of each target node, the method further includes: The target node and each target client corresponding to the target node are determined, and environment recognition is performed on each target client based on a preset environment recognition operation to obtain each target scanning solution corresponding to each target client.

3. The network topology detection method according to claim 2, characterized in that: The performing environment recognition on each of the target clients based on a preset environment recognition operation to obtain each of the target scanning solutions corresponding to each of the target clients includes: Acquire current target node data of the target node based on the simple network management protocol, and store the current target node data in the target database; An asset identification task is issued to each of the target clients so that each of the target clients scans the target assets based on the asset identification task to obtain each of the target scanning solutions corresponding to each of the target clients.

4. The network topology detection method according to claim 3, characterized in that: The sending of the asset identification task to each target client so that each target client scans the target asset based on the asset identification task to obtain each target scanning solution corresponding to each target client includes: Sending an asset identification task to each of the target clients so that each of the target clients determines a target scanning type based on the asset identification task, and determines a target scanning mode based on the target scanning type; Scanning the target asset by using the target scanning mode through the target client, and judging whether the target scanning mode meets the preset matching condition based on the corresponding scanning result; If the scanning result indicates that the target scanning mode meets the preset matching condition, the target scanning mode is determined as the target scanning scheme corresponding to the target client.

5. The network topology detection method according to claim 4, characterized in that: The target scanning type is any one or more combinations of full connection scanning based on transmission control protocol, semi-open scanning based on synchronization sequence numbering and scanning based on user datagram protocol; the preset matching condition is that the target scanning mode is adapted to the network conditions and network protocol where the target client is located.

6. The network topology detection method according to claim 1, characterized in that: Also includes: The current target node data of the target node is collected based on a preset collection time and a simple network management protocol, and the current target node data is updated to the target database.

7. The network topology detection method according to any one of claims 1 to 6, characterized in that: The executing the network topology based on all the target detection results in the target database and the current target node data to obtain the network topology detection result includes: Determine a first relationship table and a second relationship table from the target detection result and the current target node data in the target database; the first relationship table is a relationship table between the switch interface and the MAC address, and the second relationship table is a relationship table between the IP address and the MAC address; All the target detection results are merged with the first relationship table, the second relationship table and the current target node data to obtain a network topology detection result.

8. A network topology detection device, characterized in that: Applied to the management side, including: A scanning task determination module is used to create a detection topology task for each target client of each target node, obtain each target scanning scheme corresponding to each target client from a target database, and determine a target scanning task corresponding to each target client based on the detection topology task and each target scanning scheme; A scanning task sending module, used to send each of the target scanning tasks to the corresponding target clients, so that each of the target clients performs detection and identification operations based on each of the target scanning tasks and generates corresponding target detection results; A topology detection result acquisition module is used to obtain each of the target detection results sent by each of the target clients, and store all of the target detection results in the target database, so as to execute the network topology based on the target detection results in the target database and the current target node data to obtain the network topology detection result; Among them, the target nodes include switches and routers, the current target node data includes the interface table, address translation table and address resolution protocol table of the current network communication equipment, and each target detection result includes the corresponding IP address, MAC address, open port and asset type of each target client.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network topology detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the network topology detection method according to any one of claims 1 to 7 is implemented.

Images