Asset risk monitoring and checking system
Through the integration of the system of asset information center, vulnerability scanning, website monitoring, email testing and remote assistance modules, the shortcomings of existing tools in detecting new vulnerabilities and complex attacks are solved, real-time monitoring and rapid response to network assets are achieved, and the operational efficiency and security of the enterprise are improved.
Patent Information
- Application Number
- CN202510513986.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-23
- Publication Date
- 2025-07-25
AI Technical Summary
The existing asset security monitoring tools have shortcomings in terms of comprehensive functionality, accuracy and real-time functionality, and cannot detect new vulnerabilities in a timely manner, and cannot accurately identify and warn when facing complex attacks. The data processing and analysis capabilities are limited, resulting in slow response speed for security incidents.
A system including asset information center module, vulnerability scanning module, website monitoring module, risk center module, email testing module and remote assistance module was designed. Through multi-module collaboration, the website operation status can be monitored in real time, potential security risks can be discovered, and early warning can be conducted through vulnerability scanning, website monitoring and email phishing modules.
Real-time monitoring and rapid response to network assets is achieved, the efficiency and security of enterprise operations are improved, the security and compliance of information systems are ensured, and the spread of security risks is reduced.
Smart Images
Figure CN120378160A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network information security technology, and particularly relates to a monitoring and inspection system for asset risks. Background Art
[0002] Network assets refer to valuable resources and information owned by an individual, organization, or company on the Internet. Specifically, they include but are not limited to the following categories: Hardware devices: such as network infrastructure like hosts, routers, switches, firewalls, etc. Digital assets: including domain names, websites and applications, social media accounts, digital content (such as online articles, videos, pictures, etc.), email lists, data and analytics, etc. Software and applications: such as operating systems, Web applications, business applications, middleware, frameworks, APIs, source code, etc. Other assets: such as IP addresses, ports, certificates, institutional official accounts, mini-programs, Apps, etc.
[0003] Risks of network assets: Network assets face various risks, mainly including: Network security risks: Network assets may be subject to security threats such as hacker attacks, data leakage, malware infections, etc. Vulnerability risks: There may be software or hardware vulnerabilities in network assets that can be exploited by attackers. Configuration risks: Improper configuration of network assets may lead to security vulnerabilities or performance issues. Compliance risks: Network assets need to comply with relevant laws, regulations, and industry standards, otherwise they may face legal risks. Management risks: Such as inaccurate asset information, unrecorded asset changes in a timely manner, etc., may lead to management chaos.
[0004] Through effective network asset management, an organization can improve the visibility, controllability, and reliability of the network infrastructure, thus supporting the continuous operation and development of the business.
[0005] With the rapid development of the Internet, network assets have become an important platform for enterprises, government agencies, and individuals to conduct information dissemination, business processing, and data storage. However, with the rapid increase in the number of website assets, network asset security issues have become increasingly prominent. Security incidents such as hacker attacks, malware implantation, and data leakage occur frequently, not only causing huge economic losses to network asset owners, but also seriously affecting user privacy and data security.
[0006] Currently, there are already some asset security monitoring tools on the market. These tools mainly discover potential security risks by scanning the vulnerabilities of assets, monitoring the traffic and behaviors of assets, etc. However, these tools still have deficiencies in terms of comprehensive functionality, accuracy, and real-time performance. For example, some tools can only scan known vulnerabilities and cannot detect newly emerging vulnerabilities in a timely manner; although some tools can monitor the traffic of websites in real time, they often cannot accurately identify and give early warnings in the face of complex attack methods.
[0007] In addition, existing asset security monitoring tools also have limitations in data processing and analysis capabilities. Facing a vast amount of network data, these tools often fail to efficiently screen out valuable information, resulting in a slow response speed to security incidents and an inability to promptly and effectively contain the spread of security risks. Summary of the Invention
[0008] The object of the present invention is to make up for the deficiencies of the existing technology and provide a monitoring and inspection system for asset risks to solve the problems raised in the above background technology.
[0009] The present invention is realized through the following technical solutions: A monitoring and inspection system for asset risks includes an asset information center module, a vulnerability scanning module, a website monitoring module, a risk center module, an email testing module, and a remote assistance module; The asset information center module is used to collect and query relevant network assets, and view the fingerprint information, vulnerability information, and monitoring information of any network asset; The vulnerability scanning module is used to discover connected hosts, perform live host detection fingerprint recognition, and perform vulnerability scanning detection on target hosts according to corresponding vulnerability plugins; The website monitoring module is used to monitor the website in real time to discover risk problems in the website information; The risk center module is used to view and dispose of marks for risks discovered by vulnerability scanning and website monitoring; and query threat intelligence information of its own risk IPs; The email testing module is used to send phishing emails to mailboxes in batches to test the security awareness of employees; The remote assistance module is used to remotely control the host to assist in emergency traceability and remote work for system operation and maintenance.
[0010] As a further solution of the present invention: The vulnerability scanning module includes an enterprise asset query sub-module, an IP reverse domain name query sub-module, a host live scanning sub-module, a port live scanning sub-module, and a fingerprint recognition sub-module; The enterprise asset query sub-module is used to query relevant assets by enterprise name and independently select whether to perform vulnerability scanning / website monitoring on the assets; The IP reverse domain name query sub-module is used to query relevant assets by IP reverse domain name and independently select whether to perform vulnerability scanning / website monitoring on the assets; The host live scanning sub-module is used to send constructed ICMP packets or use the ping command to the host to detect the host's liveness; The port liveness scanning sub-module is used to detect whether the host port is alive through TCP SYN scanning and ICMP echo Request; The fingerprint recognition sub-module is used to send specific data packets to the target system, analyze its response, and identify the operating system type characteristics of the system.
[0011] As a further solution of the present invention: The website monitoring module includes an availability detection sub-module, a domain name hijacking detection sub-module, a tampering detection sub-module, a sensitive file detection sub-module, a sensitive word detection sub-module, a black link / malware detection sub-module, and a GitHub sensitive information detection sub-module; The availability detection sub-module is used to determine whether the website is available by returning the response code of accessing the website; The domain name hijacking detection sub-module is used to determine whether the website domain name is hijacked by judging the change of the page content; The tampering detection sub-module is used to determine whether the website content is tampered by judging the change of the page content; if it is detected that the page has changed, it is judged by sensitive words, and if there are no sensitive words, it is judged based on the self-developed system and the large model AI monitoring; The sensitive file detection sub-module is used to detect whether there is sensitive information in the website files by matching with the pre-provided sensitive word dictionary in a regular expression matching manner; The sensitive word detection sub-module is used to detect whether there is sensitive information in the website content by matching with the pre-provided sensitive word dictionary in a regular expression matching manner; The black link / malware detection sub-module is used to determine whether there is a black link / malware on the website by judging the change of the page content; The GitHub sensitive information detection sub-module is used to discover code leakage behaviors by scanning GitHub and find out whether there is any Internet leakage of its related asset sensitive data.
[0012] As a further solution of the present invention: The data security risk issues of the website monitoring module include availability, domain name hijacking, tampering, sensitive files, sensitive words, black link / malware, and GitHub sensitive risk issues.
[0013] As a further solution of the present invention: The system performs vulnerability detection on the identified fingerprint information through the vulnerability library established in the background, and automatically confirms the CVE number and vulnerability details of the vulnerability.
[0014] As a further solution of the present invention: The vulnerability scanning is based on the host port scanning technology. By means of the port scanning technology, the ports and services opened by the target host are known, and these port information are matched with the vulnerability library information provided in advance to check whether there are results that meet the matching conditions; A weak password dictionary is used to simulate an attack on it. If the attack is successful, it indicates that there are security vulnerabilities in the target host.
[0015] As a further solution of the present invention: A technology based on vulnerability library matching is adopted. After the host fingerprint is identified, the scanning program automatically performs scanning, and the target host is scanned for security vulnerabilities by simulating the attack methods of hackers. If the attack is successful, it indicates that there are security vulnerabilities in the host.
[0016] As a further solution of the present invention: If an alarm occurs in the vulnerability scanning and website monitoring, the alarm information will be actively sent in the form of text messages and enterprise WeChat.
[0017] Compared with the prior art, the present invention has the following technical effects: By adopting the above technical solutions, through the adoption of a vulnerability scanning module, a website monitoring module, a remote control module, and an email phishing module, the running status of the website can be monitored in real time, potential security risks can be discovered and warned in time, which provides favorable conditions for timely repairing the security vulnerabilities of the information system. These modules cooperate together to improve the operation efficiency, customer satisfaction and security of the enterprise, and provide solid support for the development of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The following will describe in detail the specific embodiments of the present invention in conjunction with the accompanying drawings: Figure 1 It is a schematic diagram of the modules of the inspection system for the disclosed embodiments of the present application; Figure 2 It is a system function flow chart of the inspection system for the disclosed embodiments of the present application. SPECIFIC EMBODIMENTS
[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.
[0020] Please refer to Figure 1 and Figure 2 , in the embodiments of the present invention, a monitoring and inspection system for asset risks includes an asset information center module, a vulnerability scanning module, a website monitoring module, a risk center module, an email testing module, and a remote assistance module; The Asset Information Center module is used to collect and query relevant network assets, and view the fingerprint information, vulnerability information, and monitoring information of any network asset; The Vulnerability Scanning module is used to discover connected hosts, detect the liveness of the hosts and perform fingerprint recognition, and perform vulnerability scanning on the target hosts according to the corresponding vulnerability plugins; The Website Monitoring module is used to monitor the website in real time to discover the risk issues of the website information; The Risk Center module is used to view and dispose of the risks discovered by vulnerability scanning and website monitoring; and query the threat intelligence information of the risk IP itself; The Email Testing module is used to send phishing emails to mailboxes in batches to test the security awareness of employees; The Remote Assistance module is used to remotely control the host to assist in emergency tracing and remote work of system operation and maintenance. Specifically, remotely operate files to assist in emergency tracing, system operation and maintenance and other remote work.
[0021] In this embodiment, the vulnerability scanning module includes an enterprise asset query sub-module, an IP reverse domain name query sub-module, a host liveness scanning sub-module, a port liveness scanning sub-module, and a fingerprint recognition sub-module; Specifically, it can efficiently and accurately discover system weaknesses, provide detailed vulnerability reports and repair suggestions and automatically issue alarms, effectively reducing security risks, improving the security response speed, and helping enterprises meet compliance requirements and optimizing security management resources.
[0022] The enterprise asset query sub-module is used to query relevant assets by enterprise name and independently select whether to perform vulnerability scanning / website monitoring on the assets; Specifically, the user queries relevant network assets by enterprise name and independently selects whether to send the queried assets to the vulnerability scanning engine; The IP reverse domain name query sub-module is used to query relevant assets by IP reverse domain name and independently select whether to perform vulnerability scanning / website monitoring on the assets; Specifically, the user queries relevant network assets by IP reverse domain name and independently selects whether to send the queried assets to the vulnerability scanning engine; The host liveness scanning sub-module is used to send constructed ICMP packets or use the ping command to the host to detect the liveness of the host; after establishing an icmp connection with the target, send the data packet 8 0 198 204 49 50 0 1 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 to the target system. If the other party is alive, it will return a packet, and it is judged whether it is alive by judging whether the target returns a packet. Among them, the data packet 8 is the ICMP type, indicating an Echo Request.
[0023] 0 is the ICMP code with no special meaning.
[0024] 198 204 is the checksum, which is calculated by the checkSum function.
[0025] 49 50 is the identifier, which is the first two characters of the hostname (ASCII code) 0 1 is generated by genSequence and is a fixed value What follows is the ICMP data part.
[0026] Specifically, it is configured to send a constructed ICMP packet to the host or use the ping command to detect the viability of the asset host; if the host is detected as not alive, several common port scans are directly performed to prevent ping blocking. If a live port is scanned, it is sent to the port liveness scanning module; if not detected, the scan is abandoned.
[0027] The port liveness scanning sub-module is used to detect whether the host port is alive through TCP SYN scanning and ICMP echo Request; Specifically, it is configured to detect whether the host port is alive through TCP SYN scanning and ICMP echo Request; if the port is alive, the service is identified and sent to the fingerprint recognition module; if the port is not alive, the scan is abandoned. If the service cannot be identified when the port is alive, the corresponding service list of common ports is matched, and the suspected service is given and sent to the fingerprint recognition module.
[0028] The fingerprint recognition sub-module is used to send specific data packets to the target system, analyze its response, and identify the operating system type characteristics of the system. The specific data packets contain common request parameters for specified services, such as ssh, http, ftp, mysql, etc. For a certain port, a tcp data packet GET / HTTP / 1.0\r\n\r\n is sent. If the response is HTTP / 1.1 200 OK, it can be determined that this port is an http service. However, among different web containers, the returned response values are different. Apache may return Server: Apache / 2.4.7, and Nginx may return Server: nginx / 1.18.0. These differentiated header information become the key information for more accurate identification.
[0029] Common rules: HTTP: Send GET / HTTP / 1.0\r\n\r\n, response HTTP / 1.1 200 OK FTP: Send HELP\r\n, and the response is 214 - The following commands are recognized. SSH: Send any character, and the response is SSH - 2.0 - XXXX SMB: Send EHLO localhost\r\n, and the response is 250 - localhost Hello localhost.
[0030] Specifically, it is configured to identify the characteristics of the operating system type, middleware, web program, database, etc. of the system by sending specific data packets to the target system and analyzing its responses, such as port status, protocol handling methods, and response header information, etc.; adopt the technology based on vulnerability library matching. After the host fingerprint is identified, the scanning program will automatically perform a scan, and perform a security vulnerability scan on the target host by simulating the attack methods of hackers. If the attack is successful, it indicates that the host has security vulnerabilities.
[0031] In this embodiment, the website monitoring module includes an availability detection sub - module, a domain name hijacking detection sub - module, a tampering detection sub - module, a sensitive file detection sub - module, a sensitive word detection sub - module, a black link / malware detection sub - module, and a github sensitive information detection sub - module; The availability detection sub - module is used to determine whether the website is available by returning the response code of accessing the website; The domain name hijacking detection sub - module is used to determine whether the website domain name is hijacked by judging the change of the page content; Specifically, by sending a detection request that simulates the access of real users, it monitors in real - time whether the website domain name is hijacked, thereby avoiding traffic loss and damage to the brand image caused thereby.
[0032] The tampering detection sub - module is used to determine whether the website content is tampered with by judging the change of the page content; if it detects that the page has changed, it judges through sensitive words, and if there are no sensitive words, it judges based on the self - developed system and large - model AI monitoring; Specifically, this module uses intelligent crawling technology and powerful algorithms to compare the web page content, timely discover whether the web page is tampered with, and locate the modification position. This helps to ensure the accuracy and integrity of the website content and prevent the spread of malicious information.
[0033] The sensitive file detection sub - module is used to detect whether there is sensitive information in the website files by matching with a pre - provided sensitive word dictionary in a regular expression matching manner; Specifically, it is configured to detect whether there is sensitive information in the website files by matching with a pre - provided sensitive word dictionary in a regular expression matching manner, thereby protecting the data security of the website.
[0034] The sensitive word detection sub-module is used to detect whether there is sensitive information in the website content by matching with a pre-provided sensitive word dictionary through regular expression matching; Specifically, it is configured to detect whether there is sensitive information in the website content by matching with a pre-provided sensitive word dictionary through regular expression matching, so as to protect the data security of the website.
[0035] The black link / malware detection sub-module is used to judge whether there is a black link / malware on the website by judging the change of the page content; The GitHub sensitive information detection sub-module is used to discover code leakage behavior by scanning GitHub and check whether there is Internet leakage of its relevant asset sensitive data, so as to ensure information security.
[0036] In this embodiment, the risk issues of the website monitoring module include availability, domain name hijacking, tampering, sensitive files, sensitive words, black links / malware, and GitHub sensitive risk issues.
[0037] The website monitoring module can achieve comprehensive monitoring and effective protection of website security, ensure the compliance of website content, and avoid legal risks and negative impacts caused thereby.
[0038] In the specific implementation manner, the remote assistance module only needs to execute an Agent without an account password, etc., to achieve an effect similar to Rdp, and display relevant processes, network communication conditions, and remotely operate files to assist in emergency traceability, system operation and maintenance, and other remote work.
[0039] In this embodiment, the system performs vulnerability detection on the identified fingerprint information through a vulnerability library established in the background, and automatically confirms the CVE number and vulnerability details of the vulnerability.
[0040] In this embodiment, the vulnerability scanning is based on the host port scanning technology. Through the port scanning technology, the ports and services opened by the target host are known, and these port information are matched with the pre-provided vulnerability library information to check whether there are results that meet the matching conditions; a test weak password dictionary is used to simulate an attack on it. If the attack is successful, it indicates that the target host has a security vulnerability.
[0041] In this embodiment, a technology based on vulnerability library matching is adopted. When the host fingerprint is identified, the scanning program automatically performs scanning, and the target host is scanned for security vulnerabilities by simulating the attack methods of hackers. If the attack is successful, it indicates that the host has a security vulnerability.
[0042] In this embodiment, if an alarm occurs during vulnerability scanning and website monitoring, the alarm information will be actively sent in the form of text messages and enterprise WeChat.
[0043] In the specific implementation manner, the inspection system has the core capabilities of real-time monitoring and automatically checking the risks of network assets, can immediately detect and automatically trigger the alarm mechanism, and quickly respond to potential security threats. By comprehensively collecting detailed information of system and application components, including but not limited to software versions, configuration statuses, vulnerability conditions, etc., the system provides a detailed asset security overview for enterprise management and security teams.
[0044] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents and should be included within the protection scope of the present invention.
Claims
1. A monitoring and inspection system for asset risks, characterized in that, It includes an asset information center module, a vulnerability scanning module, a website monitoring module, a risk center module, an email testing module, and a remote assistance module; The asset information center module is used to collect and query relevant network assets, and view the fingerprint information, vulnerability information, and monitoring information of any network asset; The vulnerability scanning module is used to discover networked hosts, perform live detection fingerprint recognition, and perform corresponding vulnerability scans on target hosts according to corresponding vulnerability plugins; The website monitoring module is used to monitor the website in real time to discover data security risk issues of the website; The risk center module is used to view and dispose of marks for risks discovered by vulnerability scanning and website monitoring, and query threat intelligence information of its own risk IPs; The email testing module is used to send phishing emails to mailboxes in batches to test the security awareness of employees; The remote assistance module is used to remotely control the host to assist in emergency traceability and remote work for system operation and maintenance.
2. The monitoring and inspection system for asset risks according to claim 1, wherein, The vulnerability scanning module includes an enterprise asset query sub-module, an IP reverse domain name query sub-module, a host live scan sub-module, a port live scan sub-module, and a fingerprint recognition sub-module; The enterprise asset query sub-module is used to query relevant assets by enterprise name and independently select whether to perform vulnerability scanning / website monitoring on the assets; The IP reverse domain name query sub-module is used to query relevant assets by IP reverse domain name and independently select whether to perform vulnerability scanning / website monitoring on the assets; The host live scan sub-module is used to send ICMP packets or use the ping command to the host to detect the liveness of the host; The port live scan sub-module is used to detect whether the host port is alive through TCP SYN scan and ICMP echo Request; The fingerprint recognition sub-module is used to send data packets to the target system, analyze its response, and identify the operating system type characteristics of the system.
3. A monitoring and inspection system for asset risks according to claim 1, characterized in that, The website monitoring module includes an availability detection sub-module, a domain name hijacking detection sub-module, a tampering detection sub-module, a sensitive file detection sub-module, a sensitive word detection sub-module, a black link / malware detection sub-module, and a github sensitive information detection sub-module; The availability detection sub-module is used to determine whether the website is available by returning the response code of accessing the website; The domain name hijacking detection sub-module is used to determine whether the website domain name is hijacked by judging the change of page content and whether the website is redirected; The tampering detection sub-module is used to determine whether the website content is tampered by judging the change of page content; The sensitive file detection sub-module is used to detect whether there is sensitive information in the website files by matching with a pre-provided sensitive word dictionary in a regular expression matching manner; The sensitive word detection sub-module is used to detect whether there is sensitive information in the website content by matching with a pre-provided sensitive word dictionary in a regular expression matching manner; The black link / malware detection sub-module is used to extract external links existing in the web page, access the home page content of the external links, and judge whether there is a black link / malware in the website by matching the web page content with a sensitive word library; The GitHub sensitive information detection sub-module is used to discover code leakage behaviors by scanning GitHub and check whether there is any Internet leakage of its related asset sensitive data.
4. The monitoring and inspection system for asset risks according to claim 3, wherein It is determined whether the website content has been tampered with by judging the change of the page content. If the detected page has changed, it is judged by sensitive words. If there are no sensitive words, it is judged based on the self-developed system and the large model AI monitoring.
5. The monitoring and inspection system for asset risks according to claim 3, characterized in that, The data security risk issues of the website monitoring module include availability, domain name hijacking, tampering, sensitive files, sensitive words, black links / malware, and GitHub sensitive risk issues.
6. The monitoring and inspection system for asset risks according to claim 1, characterized in that, The system performs vulnerability detection on the identified fingerprint information through the vulnerability library established in the background and automatically confirms the CVE number and details of the vulnerability.
7. The monitoring and inspection system for asset risks according to claim 6, wherein The vulnerability scanning is based on the host port scanning technology. Through the port scanning technology, the open ports and services of the target host are known, and these port information are matched with the vulnerability library information provided in advance to check whether there are results that meet the matching conditions.
8. The monitoring and inspection system for asset risks according to claim 7, wherein, A test weak password dictionary is used to simulate an attack on the target host. If the attack is successful, it indicates that there is a security vulnerability in the target host.
9. The monitoring and inspection system for asset risks according to claim 8, characterized in that, A technology based on vulnerability library matching is adopted. When the host fingerprint is identified, the scanning program automatically performs scanning, and the target host is scanned for security vulnerabilities by simulating the attack methods of hackers. If the attack is successful, it indicates that there is a security vulnerability in the host.
10. The monitoring and inspection system for asset risks according to claim 9, wherein, If alarms occur during vulnerability scanning and website monitoring, the alarm information will be actively sent in the form of text messages and enterprise WeChat.