Software asset scanning method and device applied to CMDB and related equipment

Abstract

The invention relates to the technical field of data security maintenance, in particular to a software asset scanning method and device applied to a CMDB (Configuration Management Database) and related equipment, and is applied to first network equipment in a local area network, and the first network equipment is deployed with a CMDB. Determining a plurality of open software ports in the local area network; sequentially sending a plurality of pieces of request information following different network protocols to each software port in the plurality of software ports until response information is received; according to the response information, determining actual attribute information of a target software asset corresponding to the software port sending the response information; and storing the actual attribute information to the CMDB. The technical problems that an existing software asset scanning method applied to CMDB is low in accuracy, time-consuming and labor-consuming and has potential risks can be solved.

Description

Technical Field

[0001] The present application relates to the technical field of data security maintenance, and in particular to a software asset scanning method, apparatus and related equipment applied to CMDB. Background Art

[0002] In large enterprises and private companies, CMDB (Configuration Management Database) is usually used to automate and standardize the management of network devices within the coverage of their local area network. In actual operation, CMDB can also be used to scan and register software assets on each network device in the local area network.

[0003] In actual applications, CMDB can remotely manage and monitor each network device through remote network protocols such as SNMP (Simple Network Management Protocol) to obtain information about software assets on each network device; or, CMDB can scan information about software assets on each network device through software agents installed on each network device. The software agent then sends the scan results to CMDB, allowing CMDB to determine the scan results of software assets on each network device in the local area network.

[0004] In actual operation, remote network protocols such as SNMP can usually only obtain part of the software asset information in the network device, but cannot obtain a detailed software asset list. In addition, when installing software agents in different network devices, the software agents may need to be customized or modified to ensure that they can run normally and collect accurate information. With the continuous updating of software assets in network devices, software agents may need to be frequently updated and upgraded. In addition, the installation of software agents may also bring additional security risks to network devices, which is very detrimental to data security.

[0005] In summary, the existing software asset scanning methods applied to CMDB have technical problems such as low accuracy, time-consuming and labor-intensive, and potential risks. Summary of the invention

[0006] In view of this, the purpose of this application is to provide a software asset scanning method, device and related equipment applied to CMDB, so as to solve the technical problems of the existing software asset scanning method applied to CMDB, such as low accuracy, time-consuming and labor-intensive, and potential risks.

[0007] In a first aspect, the present application provides a software asset scanning method applied to a CMDB, which is applied to a first network device in a local area network, wherein the first network device is deployed with a configuration management database CMDB, and the method comprises:

[0008] During the current software asset scanning process of the software assets, determining a plurality of software ports opened in the local area network where the first network device is located;

[0009] Sending a plurality of request messages complying with different network protocols to each of the plurality of software ports in sequence until a response message is received;

[0010] Determine, according to the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information;

[0011] The actual attribute information is stored in the CMDB.

[0012] In a second aspect, the present application provides a software asset scanning device applied to CMDB, which is applied to a first network device in a local area network, wherein the first network device is deployed with a configuration management database CMDB, and the device comprises: a port determination module, an asset scanning module, an asset determination module and an asset update module;

[0013] The port determination module is used to determine a plurality of software ports opened in the local area network during the current software asset scanning process;

[0014] The asset scanning module is used to sequentially send a plurality of request messages complying with different network protocols to each of the plurality of software ports until a response message is received;

[0015] The asset determination module is used to determine, based on the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information;

[0016] The asset update module is used to store the actual attribute information in the CMDB.

[0017] In a third aspect, the present application provides an electronic device, comprising a processor and a memory, wherein the memory is used to store an application program, and the processor runs or executes a software program stored in the memory so that the electronic device implements the above-mentioned software asset scanning method applied to CMDB.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes are used to implement the above-mentioned software asset scanning method applied to CMDB.

[0019] In a fifth aspect, the present application provides a computer program product, which includes computer instructions. When the computer instructions are executed on an electronic device, the electronic device implements the above-mentioned software asset scanning method applied to CMDB.

[0020] Beneficial effects:

[0021] The present application provides a software asset scanning method applied to CMDB. The present application provides a software asset scanning method applied to CMDB, which is applied to a first network device in a local area network, and the first network device is deployed with a configuration management database CMDB. The method includes: during the current software asset scanning process of the software asset, determining multiple software ports opened in the local area network where the first network device is located; sending multiple request information following different network protocols to each of the multiple software ports in sequence until a response information is received; determining, based on the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information; and updating the actual attribute information of the target software asset to the CMDB.

[0022] In summary, the present application abandons the technical idea of ​​using network devices as the basic unit for scanning software assets, and instead directly scans the software assets in the local area network through a first network device deployed with a CMDB, making the software assets directly the basic unit for scanning software assets, so as to obtain the attribute information of all software assets in the local area network; since the present application does not need to "control the second network device through a network protocol", but directly scans the software assets in the local area network, it can avoid the technical problem of low accuracy of the existing software asset scanning methods based on remote network protocols such as SNMP; in addition, since the present application also does not need to "use a software agent to scan the second network device", but directly scans the software assets in the local area network, it can completely avoid the technical problems of time-consuming, labor-intensive and potential risks of the software asset scanning method based on the software agent. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. The following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A flowchart of a software asset scanning method applied to CMDB provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of the structure of a software asset scanning device applied to CMDB provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In large-scale enterprises and private enterprises, for the purpose of maintaining data security, it is necessary to scan and register all software assets in the local area network to facilitate subsequent management. In particular, since employees in enterprises and private enterprises often fail to actively report and register newly downloaded software assets or the registration of old versions of software assets becomes invalid due to automatic software updates, all software assets in the local area network need to be scanned and registered regularly.

[0027] If CMDB is deployed on the network devices of large enterprises, institutions and private enterprises, the network devices with CMDB can be used to scan the software assets in other network devices in the local area network. The scanning process usually uses the network device as the basic unit for software asset scanning.

[0028] Among them, CMDB can communicate with each network device through remote network protocols such as SNMP (Simple Network Management Protocol) to obtain information about software assets on each network device; or, CMDB can scan information about software assets on each network device through software agents installed on each network device. The software agent then sends the scan results to CMDB, allowing CMDB to determine the scan results of software assets on each network device in the local area network.

[0029] In actual operation, the software asset scanning method based on remote network protocols such as SNMP applied to CMDB has the technical problem of low accuracy; in addition, the software asset scanning method based on software agent program applied to CMDB has the technical problem of being time-consuming, labor-intensive and having potential risks.

[0030] In order to solve the above technical problems, the present application provides a technical solution for software asset scanning applied to CMDB. This technical solution abandons the technical idea of ​​"CMDB-network device-software assets on network device" that uses network devices as the basic unit for software asset scanning, but instead directly scans the software assets in each second network device in the local area network through a first network device deployed with CMDB, making the software assets directly the basic unit for software asset scanning, so as to obtain the attribute information of all software assets in the local area network.

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0032] First, the present application provides a software asset scanning method applied to CMDB, the method is applied to a first network device in a local area network, the first network device is deployed with a configuration management database CMDB, such as Figure 1 As shown, Figure 1 The flowchart of the software asset scanning method applied to CMDB provided in the embodiment of the present application includes: S110 to S140, and the details are as follows:

[0033] S110: During the current software asset scanning process, multiple software ports opened in the local area network are determined.

[0034] Specifically, in the embodiment of the present application, the software assets mainly include: database system, application software, network system software, security system software and other software; in the embodiment of the present application, the first network device is used to scan the software assets installed in the second network device. The software port is an address for the transport layer and the application layer to exchange information between layers, and the software assets (applications) are identified by the port number; in the communication network, different network devices are identified and distinguished by IP (Internet Protocol) addresses, and different software assets in a network device are identified and distinguished by port numbers, that is, the port number has only local significance, and the port number only identifies each process in the application layer of the local network device. Different network devices in a local area network may have the same port number.

[0035] When software assets communicate with software assets on other network devices, both parties transmit data through their respective software ports. Therefore, the embodiment of the present application uses the software port in the local area network as the entry point to directly determine the number of software assets in the local area network.

[0036] In actual operation, in order to ensure timely statistics of software assets in enterprises, institutions and private enterprises, the scanning process of software assets is usually repeated, which may be performed at preset intervals or irregularly. The embodiment of the present application takes a software asset scanning process as an example to illustrate the specific implementation process of the software asset scanning method applied to CMDB.

[0037] Compared with the prior art that requires the use of software agents, the embodiment of the present application directly executes the software asset scanning method applied to CMDB through the first network device in the local area network; in actual applications, the first network device can use the open source tool Masscan to perform a blind scan on the software ports in the local area network, that is, to perform a scan without a clear target IP address within a certain local area network range. Through blind scanning, the first network device can determine the open software ports in the local area network; if there are open software ports, it indicates that a software asset is currently running or listening.

[0038] In actual operation, the scanning process for software assets in the local area network usually needs to be performed multiple times to update the attribute information of the software assets in the local area network in real time.

[0039] In one implementation, the local area network includes multiple network segments; S110 includes: step (1), the details of which are as follows:

[0040] Step (1): Determine multiple software ports opened in a target network segment in a local area network; wherein the software ports opened in the target network segment indicate that the IP address contained in the request information encapsulated and decapsulated by the software ports is in the target network segment; and the target network segment is one of the multiple network segments in the local area network.

[0041] Specifically, the meaning of step (1) is that the current scanning process can be divided into a plurality of different blind scanning stages according to different network segments; the number of network segments included in a local area network can be set according to actual needs; dividing different blind scanning stages by different network segments can improve the efficiency of blind scanning. This is because for a private enterprise and an institution whose number of personnel generally does not change much, the difference in the software ports opened in different network segments during different rounds of scanning is usually relatively small. Therefore, implementing blind scanning based on different network segments helps to quickly locate the open software ports that are missing or increased in the current scanning process compared to the previous round of scanning process.

[0042] In actual operation, a corresponding blind scan can be performed on all network segments in the local area network, or only on some network segments, that is, the target network segment can be set according to actual needs, and this application does not make any specific restrictions on this.

[0043] The “software port opened in the target network segment” means that the IP (Internet Protocol Address) address included in the request information encapsulated and decapsulated by the software port is in the target network segment.

[0044] S120: Sending a plurality of request messages complying with different network protocols to each of the plurality of software ports in sequence until a response message is received.

[0045] Specifically, in the prior art, the scanning of software assets is highly dependent on specific network protocols, such as SNMP (Simple Network Management Protocol), WMI (Windows Management Instrumentation), etc. However, the embodiment of the present application sends multiple request messages that follow different network protocols, so that network devices in the local area network that follow different network protocols for information transmission can receive the request information through the software port, which is convenient for subsequent software asset statistics.

[0046] In actual operation, request information needs to be encapsulated into data packets for transmission between different network devices; different request information needs to be designed for different communication connection methods; for example, for some HTTP ports or HTTPS ports that communicate based on application layer protocols, if you want to trigger their responses, you can encapsulate the HTTP request or HTTPS request into a data packet and transmit it to the above port; for some software ports that communicate based on Socket connections, if you want to trigger their responses, you need to encapsulate the data into a data packet that can be received by the corresponding Socket interface and then transmit it.

[0047] In actual operation, it is necessary to try different sending methods and different contents multiple times to ensure that the response of the software service can be triggered to the maximum extent. Since the software port discovered in the first step may not necessarily get the interaction type supported by the interface, it is necessary to test each software port separately in various ways until valid software response information can be obtained.

[0048] S130: Determine, according to the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information.

[0049] Specifically, the request information is transmitted in the form of a data packet, and the response information is also received in the form of a data packet. Therefore, when the first network device receives the data packet of the response information, it is necessary to decapsulate the data packet of the response information, and then parse the response information and determine the actual attribute information of the target software asset corresponding to the software port that sends the response information based on the content obtained from the analysis.

[0050] In one implementation, the local area network further includes: a plurality of second network devices; S120 includes: steps (2) to (5), the details of which are as follows:

[0051] Step (2): parse the response information to obtain feedback feature information and network device address;

[0052] The feedback feature information is data that uniquely points to the target software asset.

[0053] Specifically, after parsing the response information, the feedback characteristic information in the response information that can indicate different software assets can be determined. The response information sent by different software assets has different feedback characteristic information. The feedback characteristic information is a set of data that can uniquely identify the software asset. In actual applications, the feedback characteristic information may include a version number, a service identifier, or a specific response mode, etc. For details, please see Table 1. Table 1 is an example table of response information of different software assets provided in an embodiment of the present application.

[0054] Table 1

[0055]

[0056]

[0057]

[0058]

[0059]

[0060]

[0061]

[0062] In Table 1, "Type of software asset" is an attribute column set according to needs, and specific types such as "middleware" can also be determined according to actual needs; the content recorded in the attribute column of "Content of request information" is the content included in the request information constructed by HTTP / HTTPS connection and Socket connection; the bold character string in the attribute column of "Response information" is the feedback feature information; it should be emphasized that Table 1 is only shown for example, and the content of Table 1 can be expanded and supplemented according to actual needs.

[0063] After parsing the response information, the "source IP address" and "destination IP address" can be obtained. The "source IP address" indicates the address of the second network device that sends the response information, and the "destination IP address" in the embodiment of the present application should be the address of the first network device. The focus of the embodiment of the present application is on confirming the "source IP address". The network device address referred to in step (2) is the "source IP address".

[0064] Step (3): Determine the target software asset based on the feedback feature information.

[0065] Specifically, as can be seen from Table 1, although the feedback characteristic information varies, it generally includes data that can indicate the corresponding target software asset, such as "Zookeeper" and "Mysql", etc. Therefore, the target software asset for sending the response information can be determined through the feedback characteristic information.

[0066] In one implementation, step (3) includes: step (3.1) to step (3.2), the details of which are as follows:

[0067] Step (3.1): According to the feedback feature information, determine the identifier of the target software asset in the first basic table pre-constructed in the CMDB.

[0068] The first basic table is used to record the corresponding information between the feedback feature information and the identifier.

[0069] Specifically, CMDB is a logical database. In actual applications, CMDB may be composed of multiple physical databases. CMDB stores and manages various information of network devices and / or network assets through the above physical databases. Therefore, when CMDB obtains feedback feature information, CMDB can determine the identifier of the target software asset based on the pre-built first basic table stored therein.

[0070] In an embodiment of the present application, relevant data of feedback characteristic information is stored in a first basic table pre-constructed in the CMDB; the fields of the first basic table may include: an identifier of the feedback characteristic information, an identifier of the target software asset, a request method (socket, http or https, etc.), request information, feedback characteristic information (text, error code, etc.).

[0071] In actual operation, after parsing the feedback characteristic information, the first network device compares the feedback characteristic information with the feedback characteristic information recorded in the first basic table to further determine the identifier of the parsed feedback characteristic information; the identifier can be an ID or other data such as a string with unique directionality. For details, please see Table 2, which is an example table of the fields of the first basic table provided in an embodiment of the present application.

[0072] Table 2

[0073]

[0074]

[0075] Step (3.2): According to the identifier of the target software asset, determine the name and type of the target software asset in the second basic table pre-constructed in the CMDB.

[0076] The second basic table is used to record the corresponding information between the identifier, name and type of the software asset.

[0077] Specifically, the first basic table and the second basic table can be data tables constructed based on historical experience, which are used to enumerate the feedback feature information, software asset identifiers, software asset names and software asset types of all software assets that may appear in the local area network. When the identifier of the target software asset is obtained, the name and type of the target software asset are determined in the first basic table and the second basic table.

[0078] For example, the first basic table and the second basic table function as dictionaries. When encountering an unfamiliar word (feedback feature information), the meaning of the word (the identifier, name and type of the software asset corresponding to the feedback feature information) can be determined in the dictionary.

[0079] In addition to recording the corresponding information between the software asset's identifier, name, and type, the second basic table may also record the software asset's identifier and the software asset's version information, operating status, and dependency relationship. The version information mainly refers to the software asset's version number, the operating status mainly refers to the software asset's operating status at the current moment, and the dependency relationship mainly refers to other software assets or other network services that the software asset depends on, as determined by configuration files and operating logs.

[0080] It should be emphasized that the version information, operating status and dependency relationship of the software assets recorded in the second basic table are determined based on historical experience, and are not necessarily the same as the actual attribute information of the target software assets. In an embodiment of the present application, the relevant data of the target software assets are stored in the second basic table pre-constructed in the CMDB; the fields of the second basic table may include: the identifier of the software asset, the name of the software asset, the type of software asset (such as database service, Web service, middleware, etc.), and other relevant attributes (such as version, release date, etc.). In actual applications, the attribute information of the software asset clearly indicates the configuration information, network location, operating environment and operating status of the software asset. After the attribute information of the software asset is stored in the CMDB, it can be used by enterprises, institutions and private enterprises to formulate management strategies and security strategies for network equipment and / or software assets based on the above attribute information, providing strong support for the automated management and comprehensive management of network equipment and / or software assets.

[0081] In actual operation, after determining the identifier of the target software asset, the first network device compares the identifier of the target software asset with the identifier of the software asset recorded in the second basic table to further determine the name and type of the parsed feedback feature information. For details, please see Table 3, which is an example table of the fields of the second basic table provided in an embodiment of the present application.

[0082] Table 3

[0083]

[0084] In actual operation, the fields in the first basic table and the second basic table can be added according to actual needs; in addition, constraints can be constructed for the first basic table and the second basic table, such as determining the identifier of the target software asset in the first basic table as the external code, and determining the identifier of the software asset in the second basic table as the primary code, so that the first basic table and the second basic table are associated, and the associated first basic table and the second basic table are convenient for adding and deleting data; in addition, the first basic table and the second basic table can be combined into one table; the specific details can be determined according to actual needs, and this application does not make any specific limitations.

[0085] In actual operation, when the feedback characteristic information, name and type corresponding to the software assets on the market are updated, the corresponding information needs to be updated to the first basic table and the second basic table to ensure that the feedback characteristic information obtained from each software asset scanning information can be used to determine the name and type of the corresponding target software asset. Step (4): Determine the second network device where the target software asset is located based on the network device address.

[0086] Specifically, in a local area network, an IP address can uniquely point to a network device, so the first network device can determine the corresponding second network device according to the network device address resolved in the above steps.

[0087] Step (5): According to the name and type of the target software asset, actual attribute information of the target software asset is determined in the second network device where the target software asset is located.

[0088] Specifically, after the name and type of the target software asset and the second network device where the target software asset is located are determined, the actual attribute information of the target software asset can be determined in the local storage of the second network device where the target software asset is located.

[0089] In actual operation, when different software assets are installed in the second network device, the installation location, storage location of the configuration file and the log file path all have their own characteristics, so the actual attribute information of the target software asset can be efficiently found in the second network device according to its configuration characteristics.

[0090] It should be emphasized that although step (5) is also performed on the basis of the first network device "controlling the second network device through the network protocol", it is different from the prior art in that in the prior art, the purpose of "controlling the second network device through the network protocol" by the first network device is to "scan the software assets in the second network device", which belongs to "scanning of software assets", but in the embodiment of the present application, the purpose of "controlling the second network device through the network protocol" by the first network device is to determine the actual attribute information of each software asset in the second network device, which belongs to "verification of the scanning results of software assets and / or supplementation of the scanning information of software assets".

[0091] Among them, when the first network device "controls the second network device through the network protocol" to perform "software asset scanning", the first network device is not clear about the various software assets in the second network device, so it is usually necessary to exhaustively check various local storage locations in the second network device to determine whether new software assets are added, updated or deleted in the second network device. Therefore, in many cases, the above method often results in missed scans and the like.

[0092] When the first network device "controls the second network device through the network protocol" to perform "verification of the scanning results of the software assets and / or supplementation of the scanning information of the software assets", the first network device is very clear about each software asset in the second network device. Since different software assets have their own characteristics in the second network device, the actual attribute information of the target software asset can be efficiently found in the second network device according to its configuration characteristics.

[0093] S140: Storing the actual attribute information in the CMDB.

[0094] Specifically, after the actual attribute information of the target software asset is determined, the actual attribute information of the target software asset needs to be stored in the CMDB.

[0095] In one implementation, S140 includes: step (6), the details of which are as follows:

[0096] Step (6): Update the actual attribute information of the target software asset to the third basic table in the CMDB; wherein the third basic table is used to record the actual attribute information of each software asset in the local area network.

[0097] Specifically, after the actual attribute information of the target software asset is determined, the third basic table can be updated, for example, the attribute information (such as version number) of the software assets recorded in the third basic table can be updated, or the software assets not recorded in the third basic table can be recorded, so that the third basic table can record all software assets in the local area network.

[0098] In actual operation, when updating the attribute information of software assets in CMDB, it is necessary to ensure the accuracy and completeness of the data. Usually, multiple means are used to check and verify the data to ensure that the updated attributes are consistent with the actual status of the software. In addition, a data update recording mechanism is established to record the time, content, operator and other information of each update for subsequent audit and traceability.

[0099] In practical applications, by updating the third basic table in CMDB, CMDB can become a more complete, accurate and detailed information base of software assets, so that the data stored in CMDB can reflect the latest status of software assets in network devices in real time, including equipment model, configuration, location and software version, etc., which can not only provide strong support for subsequent software deployment, upgrade, maintenance and other operations, but also avoid decision-making errors and operational errors caused by information lag, and ensure the accuracy of software asset management; in addition, when a network device or software asset fails, the latest updated data in CMDB can be queried to quickly locate the problem, reduce troubleshooting time, and lay the most solid foundation for improving the efficiency and quality of software resource management. In summary, the embodiment of the present application scans the software assets in the local area network through the first network device deployed with CMDB. This process avoids "controlling the second network device through the network protocol" or "scanning the second network device using the software agent program", but realizes the scanning of "each software asset in the local area network" through the result of direct interaction with each software asset in the local area network.

[0100] Among them, since the embodiment of the present application does not require "controlling the second network device through the network protocol", but directly scans the software assets in the local area network, the technical problem of low accuracy of the existing software asset scanning method based on remote network protocols such as SNMP applied to CMDB can be avoided; in addition, since the embodiment of the present application does not require "scanning the second network device using a software agent program", but directly scans the software assets in the local area network, the technical problem of time-consuming, labor-intensive and potential risks of the software asset scanning method based on the software agent program applied to CMDB can be completely avoided.

[0101] Second, the present application provides a software asset scanning device applied to CMDB, which is applied to a first network device, such as Figure 2 As shown, Figure 2 A schematic diagram of the structure of a scanning device for software assets applied to CMDB provided in an embodiment of the present application, the device comprising: a port determination module 310, an asset scanning module 320, an asset determination module 330 and an asset update module 340;

[0102] The port determination module 310 is used to determine a plurality of software ports opened in the local area network during the software asset scanning process;

[0103] The asset scanning module 320 is used to sequentially send a plurality of request messages complying with different network protocols to each of the plurality of software ports until a response message is received;

[0104] The asset determination module 330 is used to determine the actual attribute information of the target software asset corresponding to the software port sending the response information according to the response information;

[0105] The asset update module 340 is used to store the actual attribute information of the target software asset into the CMDB.

[0106] In one implementation, the local area network includes multiple network segments; the port determination module is further used to determine multiple software ports opened in a target network segment in the local area network;

[0107] The software port opened in the target network segment indicates that the IP address included in the request information encapsulated and decapsulated by the software port is in the target network segment.

[0108] In one implementation, the local area network further includes: a plurality of second network devices; an asset determination module 330, further configured to parse the response information to obtain feedback feature information and a network device address;

[0109] The feedback feature information is data that uniquely points to the target software asset;

[0110] The asset determination module 330 is further used to determine the target software asset according to the feedback feature information;

[0111] The asset determination module 330 is further configured to determine the second network device where the target software asset is located according to the network device address.

[0112] In one implementation, the asset determination module 330 is further configured to determine an identifier of the target software asset in a first basic table pre-constructed in the CMDB according to the feedback characteristic information;

[0113] Wherein, the first basic table is used to record the correspondence information between the feedback feature information and the identifier of the software asset;

[0114] The asset determination module 330 is further used to determine the name and type of the target software asset in a second basic table pre-constructed in the CMDB according to the identifier of the target software asset;

[0115] The second basic table is used to record the corresponding information among the identifiers, names and types of multiple software assets.

[0116] In one implementation, the asset determination module 330 is further configured to determine actual attribute information of the target software asset in the second network device where the target software asset is located, based on the name and type of the target software asset;

[0117] The asset update module 340 is further used to update the actual attribute information of the target software asset to the third basic table in the CMDB;

[0118] The third basic table is used to record the actual attribute information of each software asset in the local area network.

[0119] Third, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements steps S110 to S140 provided in the above embodiment when executing the computer program.

[0120] Fourth, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, steps S110 to S140 of the above embodiment are executed.

[0121] Fifth, the computer program product provided in the present application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method in the previous method embodiment. The specific implementation can refer to steps S110 to S140 of the method embodiment, which will not be repeated here.

[0122] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0123] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0124] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0125] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0126] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0127] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A software asset scanning method applied to CMDB, characterized in that: The method is applied to a first network device in a local area network, wherein the first network device is deployed with a configuration management database CMDB, and comprises: During the software asset scanning process, determining multiple software ports opened in the local area network; Sending a plurality of request messages complying with different network protocols to each of the plurality of software ports in sequence until a response message is received; Determine, according to the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information; The actual attribute information is stored in the CMDB.

2. The method according to claim 1, characterized in that The local area network includes multiple network segments; the determining of multiple software ports opened in the local area network includes: Determining a plurality of software ports opened in a target network segment in the local area network; The software port opened in the target network segment indicates that the IP address included in the request information encapsulated and decapsulated by the software port is in the target network segment.

3. The method according to claim 1, characterized in that: The local area network further includes a plurality of second network devices; and determining, based on the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information includes: Parsing the response information to obtain feedback feature information and a network device address; Wherein, the feedback characteristic information is data that uniquely points to the target software asset; Determining the target software asset according to the feedback feature information; The second network device where the target software asset is located is determined according to the network device address.

4. The method according to claim 3, characterized in that The step of determining the target software asset according to the feedback feature information includes: Determine, according to the feedback characteristic information, an identifier of the target software asset in a first basic table pre-constructed in the CMDB; Wherein, the first basic table is used to record the correspondence information between the feedback feature information and the identifier of the software asset; Determining the name and type of the target software asset in a second basic table pre-constructed in the CMDB according to the identifier of the target software asset; The second basic table is used to record the corresponding information between the identifiers, the names and the types of the plurality of software assets.

5. The method according to claim 4, characterized in that The determining the actual attribute information of the target software asset according to the feedback feature information further includes: Determining actual attribute information of the target software asset in the second network device where the target software asset is located according to the name and the type of the target software asset; The storing the actual attribute information in the CMDB includes: Updating the actual attribute information of the target software asset to a third basic table in the CMDB; The third basic table is used to record the actual attribute information of each software asset in the local area network.

6. A software asset scanning device applied to CMDB, characterized in that: The device is applied to a first network device in a local area network, wherein the first network device is deployed with a configuration management database CMDB, and the device comprises: a port determination module, an asset scanning module, an asset determination module and an asset update module; The port determination module is used to determine a plurality of software ports opened in the local area network during the software asset scanning process; The asset scanning module is used to sequentially send a plurality of request messages complying with different network protocols to each of the plurality of software ports until a response message is received; The asset determination module is used to determine, based on the response information, actual attribute information of the target software asset corresponding to the software port that sends the response information; The asset update module is used to store the actual attribute information in the CMDB.

7. The device according to claim 6, characterized in that The local area network includes multiple network segments; the port determination module is also used to determine multiple software ports opened in the target network segment in the local area network; wherein the software port opened in the target network segment indicates that the IP address included in the request information encapsulated and decapsulated by the software port is in the target network segment.

8. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory is used to store an application program, and the processor runs or executes a software program stored in the memory so that the electronic device implements the software asset scanning method applied to CMDB as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes executed by a processor, and the program codes are used to implement the software asset scanning method applied to CMDB according to any one of claims 1 to 5.

10. A computer program product, characterized in that The computer program product includes computer instructions. When the computer instructions are executed on an electronic device, the electronic device implements the software asset scanning method applied to CMDB as described in any one of claims 1 to 5.

Images