Static analysis method and system for network asset exposure surface, and storage medium
By constructing a parallel search algorithm for multi-level device element models, the inefficiency and insufficient accuracy of network asset exposure analysis in enterprise-level network environments are solved, and efficient and accurate network asset identification and verification are achieved.
Patent Information
- Application Number
- CN202510656668.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-21
- Publication Date
- 2025-08-15
AI Technical Summary
In the enterprise-level network environment, the network asset exposure analysis is inefficient and insufficiently accurate. The traditional message testing method has the problem of combination explosion, while the static analysis method based on firewall ignores the internal routing behavior of the network, resulting in false alarms and underreporting high-risk assets.
A multi-level device element model based on routing behavior and policy behavior is built, and a parallel search algorithm is used to perform network asset analysis. By obtaining the data surface information of network devices, identifying network planning and generating five-tuple spatial representations, realizing accurate modeling and efficient verification of the firewall.
It significantly improves the efficiency and accuracy of network assets exposure analysis in large-scale and complex network environments, avoids the efficiency and coverage of traditional methods, and ensures accurate identification and verification of network assets.
Smart Images
Figure CN120498786A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a static analysis method, system and storage medium for network asset exposure surfaces. Background Art
[0002] Network asset exposure refers to the total number of network assets that an enterprise has that are accessible and detectable to the outside world on the Internet. These assets are crucial for security protection because they are easy targets for potential attackers.
[0003] Current mainstream methods for calculating network exposure can be categorized as traditional packet-based testing and firewall-based static analysis. While effective in specific scenarios, traditional packet-based testing methods suffer from significant complexity limitations, as their coverage scales exponentially with service scale. When faced with enterprise networks with thousands of service segments, traditional packet-based testing methods are prone to combinatorial explosion, resulting in inefficiencies and coverage issues. Firewall-based static analysis methods, while providing direct access to all target servers through the default firewall, ignore potential internal network routing behaviors and other security measures that can block actual traffic. Consequently, they suffer from significant modeling incompleteness, with static analysis models often mistakenly labeling services as exposed that are not actually exposed. These false alarms, resulting in extensive manual verification efforts by security teams, can lead to delays in identifying truly high-risk exposure points. Summary of the Invention
[0004] The purpose of the present invention is to provide an accurate and efficient static analysis method and system for network asset exposure, which can accurately characterize the multi-level architecture characteristics of firewalls and realize efficient verification of large-scale configurations through a parallelized policy analysis engine.
[0005] Technical solution:
[0006] In a first aspect, the present invention discloses a static analysis method for network asset exposure, comprising:
[0007] Obtain data plane information of network devices;
[0008] Constructing an initial device connection graph based on the data plane information, obtaining in-degree interfaces and out-degree interfaces with physical meaning at the routing behavior level from the initial device connection graph, and constructing in-degree interfaces and out-degree interfaces with logical meaning at the policy behavior level;
[0009] Based on the in-degree interface and out-degree interface in the routing behavior layer and the policy behavior layer, the firewall is modeled at multiple levels according to its behavior to obtain the device element model;
[0010] Design a search algorithm and use it to search the device element model to obtain search results;
[0011] Based on the search results, reachability determination and path analysis are performed to obtain the corresponding network exposed assets. Furthermore, the data plane information includes topological connectivity, routing, and policies. Based on the data plane information, network planning is identified, including identifying the network starting device interface connected to the Internet and generating a corresponding data packet with a five-tuple spatial representation, namely, containing srcIP, dstIP, source port, destination port, and protocol type.
[0012] Furthermore, in the device connection diagram, nodes represent firewalls, routers, switches, and host devices, and edges represent the physical / logical connection relationship between the physical interfaces of the devices represented by the nodes. All interfaces in the firewall are divided according to the virtual system VSYS to obtain interfaces of each virtual system, and Zone attributes are added to all interfaces in the VSYS. Zone attributes include Zone-pair and its direction.
[0013] Furthermore, the multi-level modeling uses behavior as the unit of the device element model. At the routing behavior level, each VSYS constructs physically meaningful in-degree interfaces and out-degree interfaces according to its VRF. At the policy behavior level, the access control list (ACL) is organized according to the zone-pair direction of the interface within the VSYS to construct logically meaningful in-degree interfaces and out-degree interfaces at the policy behavior level.
[0014] Furthermore, based on the in-degree interface and out-degree interface in the routing behavior layer and the policy behavior layer, the firewall is modeled at multiple levels according to its behavior. The process of obtaining the device element model includes:
[0015] (1) For firewall devices, initialize the Forward element and the Filtering element;
[0016] (2) For the Forward element, each VSYS has an independent instance. Each instance contains a physically meaningful in-degree interface and an out-degree interface. The physically meaningful in-degree interface of the Forward instance is all the physical interfaces in the virtual system, and the physically meaningful out-degree interface of the Forward instance is the next-hop interface determined by the VRF routing in the virtual system.
[0017] (3) For the Filtering element, each Zone-pair has an independent Zone-pair instance. Each Zone-pair instance contains an in-degree interface and an out-degree interface with logical meaning. The in-degree interface is the Zone-pair determined by the firewall after the Forward element, and the out-degree interface is a fixed permit and deny logical interface, which represents the constraint relationship of the packet space defined for a certain five-tuple space.
[0018] Furthermore, the process of using the search algorithm to search the device element model to obtain the search results includes:
[0019] Scheduling threads based on a starting interface in a device element model; initializing a queue, wherein the queue is independently stored based on a starting data packet;
[0020] The unit scheduling thread loads the data packet to be verified from the queue and traverses the global device elements of the device element model in sequence according to the topological relationship. Every time a device element is passed, the search algorithm generates a new data packet state according to the rules of all possible out-degree interfaces of the device;
[0021] If the packet finds the next-hop interface through the VRF routing of the Forward element and is determined to be permitted by the policy of the Filtering element, a new packet carrying the updated path information is generated and added to the queue to complete forwarding. If it is determined to be denied or there is no reachable path, the branch is terminated. If the next-hop interface already exists in the path information of the packet, the branch is also terminated. This process is repeated until there are no new packets to be processed in the queue, and the traversal is completed.
[0022] Furthermore, the reachability determination and path analysis include:
[0023] After all data packets have been traversed, reachability determination and path analysis are performed based on the five-tuple spatial representation of the data packets. If there is at least one data packet that can reach the destination device specified by the dstIP in the five-tuple, then the reachability relationship from srcIP to dstIP is considered to be established, otherwise it is not established.
[0024] In a second aspect, the present invention further discloses a static analysis system for network asset exposure, comprising:
[0025] Data acquisition module, used to obtain data plane information of network devices;
[0026] A connection graph module is used to construct an initial device connection graph based on data plane information, obtain in-degree interfaces and out-degree interfaces with physical meaning at the routing behavior level, and construct in-degree interfaces and out-degree interfaces with logical meaning at the policy behavior level from the initial device connection graph;
[0027] A modeling module is used to perform multi-level modeling of the firewall behavior based on the in-degree interface and out-degree interface in the routing behavior layer and the policy behavior layer to obtain a device element model;
[0028] Search module, used to design search algorithms and use the search algorithms to search the device element models to obtain search results;
[0029] An analysis module is used to perform reachability determination and path analysis based on the search results to obtain the corresponding network exposed assets. Furthermore, the data plane information includes topological connectivity, routing, and policies. Based on the data plane information, a network plan is identified. This identification includes identifying the network initiating device interface connected to the Internet and generating a corresponding data packet with a five-tuple spatial representation, namely, containing the srcIP, dstIP, source port, destination port, and protocol type.
[0030] Furthermore, in the device connection diagram, nodes represent firewalls, routers, switches, and host devices, and edges represent the physical / logical connection relationship between the physical interfaces of the devices represented by the nodes. All interfaces in the firewall are divided according to VSYS to obtain interfaces of each virtual system, and Zone attributes are added to all interfaces in the VSYS. Zone attributes include Zone-pair and its direction.
[0031] Furthermore, the multi-level modeling uses behavior as the unit of the device element model. At the routing behavior level, each VSYS constructs physically meaningful in-degree and out-degree interfaces based on its VRF. At the policy behavior level, ACLs are organized according to the zone-pair direction of the interface within the VSYS to construct logically meaningful in-degree and out-degree interfaces at the policy behavior level.
[0032] Furthermore, the construction of the device element model includes:
[0033] (1) For firewall devices, initialize the Forward element and the Filtering element;
[0034] (2) For the Forward element, each VSYS has an independent instance. Each instance contains an in-degree interface and an out-degree interface with physical meaning. The in-degree interface is all physical interfaces in the VSYS, and the out-degree interface is the next-hop interface determined by the VRF routing in the VSYS.
[0035] (3) For the Filtering element, each Zone-pair has an independent instance. Each instance contains an in-degree interface and an out-degree interface with logical meaning. The in-degree interface is the Zone-pair determined by the firewall after the Forward element, and the out-degree interface is a fixed permit and deny logical interface, which represents the constraint relationship for a certain space.
[0036] Furthermore, the process of using the search algorithm to search the device element model to obtain the search results includes:
[0037] Scheduling threads based on a starting interface in a device element model; initializing a queue, wherein the queue is independently stored based on a starting data packet;
[0038] The unit scheduling thread loads the data packet to be verified from the queue and traverses the global device elements of the device element model in sequence according to the topological relationship. Every time a device element is passed, the search algorithm generates a new data packet state according to the rules of all possible out-degree interfaces of the device;
[0039] If the packet finds the next-hop interface through the VRF routing of the Forward element and is determined to be permitted by the policy of the Filtering element, a new packet carrying the updated path information is generated and added to the queue to complete forwarding. If it is determined to be denied or there is no reachable path, the branch is terminated. If the next-hop interface already exists in the path information of the packet, the branch is also terminated. This process is repeated until there are no new packets to be processed in the queue, and the traversal is completed.
[0040] Furthermore, the reachability determination and path analysis include:
[0041] After all data packets have been traversed, reachability determination and path analysis are performed based on the five-tuple spatial representation of the data packets. If there is at least one data packet that can reach the destination device specified by the dstIP in the five-tuple, then the reachability relationship from srcIP to dstIP is considered to be established, otherwise it is not established.
[0042] In a third aspect, the present invention further discloses a computer-readable storage medium having a computer program stored thereon, which implements all the steps of the aforementioned method when executed by a processor.
[0043] Beneficial effects:
[0044] This paper models the firewall's behavior based on the in-degree interface and out-degree interface at the routing behavior level and the policy behavior level, innovatively constructing a device element model with both physical and logical attributes. It accurately characterizes the topological isolation characteristics between VSYSs and the directional constraints of zone pairs, eliminating the policy analysis blind spots in the existing technology and fully capturing the multi-level semantics of the firewall.
[0045] The present invention also designs a search algorithm, which uses the search algorithm to search the device element model to obtain search results, and adopts a parallelized breadth-first algorithm to quickly obtain spatial reachability information, which significantly improves the efficiency of network asset exposure surface analysis in large-scale complex network environments. In enterprise-level network environments, it still maintains effective analysis of network asset exposure surfaces, avoiding efficiency and coverage problems caused by a large number of message tests. BRIEF DESCRIPTION OF THE DRAWINGS
[0046] Figure 1 It is a schematic diagram of the overall process of the present invention;
[0047] Figure 2 A schematic diagram of the firewall element model construction and matching process of the present invention;
[0048] Figure 3 Schematic diagram of parallel analysis of the present invention. DETAILED DESCRIPTION
[0049] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, modifications of various equivalent forms of the present invention made by those skilled in the art all fall within the scope defined by the claims attached to the present invention.
[0050] Existing methods for calculating network exposed assets restrict the efficiency and accuracy of network asset exposure analysis. Therefore, there is an urgent need for an efficient static analysis method that can fully consider the diversity of network device policies and the complexity of the architecture, and achieve accurate network asset exposure analysis while ensuring computational efficiency.
[0051] The present invention discloses an accurate and efficient static analysis method and system for network asset exposure. Figure 1 The complete process of the present invention is shown, which specifically includes the following steps:
[0052] Step 1: Obtain data plane information from network devices. This information, including topological connectivity, routing, and policies, is obtained through control plane simulation or automated acquisition. Based on the network plan, the network initiator interface connected to the Internet is identified and a corresponding data packet with a five-tuple spatial representation is generated, consisting of the srcIP address, dstIP address, source port, destination port, and protocol type.
[0053] Step 2: Build an initial device connection graph based on the network topology. From this graph, obtain physically meaningful in-degree and out-degree interfaces at the routing behavior level, and construct logically meaningful in-degree and out-degree interfaces at the policy behavior level. Nodes represent firewalls, routers, switches, and host devices, and edges represent the physical and logical connections between interfaces. All interfaces within the firewall are divided into VSYSs, and zone attributes are added to all interfaces within a VSYS.
[0054] In this embodiment, the firewall device implements logical isolation and functional partitioning through virtual systems (VSYS). Each VSYS independently manages its own security zones (Zones) and physical interfaces. For example, VSYS-1 includes the Trust zone, the Untrust zone, and the DMZ zone, each bound to interfaces 1-3, 4-6, and 7-9. Inter-access permissions between these zones are constrained by policies. VSYS-3 further subdivides the Internal zone into multiple layers of Trust zones, reflecting the need for refined management and control. Verification of such complex architectures requires analysis using graph models. However, traditional flat policy expressions cannot accurately represent the topological isolation characteristics between VSYSs and the directional constraints of Zone pairs (e.g., prohibiting Untrust from directly accessing Internal), which can easily lead to blind spots in policy analysis. By abstracting the physical interfaces, routing behavior, and policy logic into a computable graph model, the firewall's multi-layered semantics can be fully captured, providing structured input for parallel analysis.
[0055] Step 3: Based on the in-degree and out-degree interfaces at the routing and policy behavior levels, the firewall is modeled at multiple levels to create a device element model. At the routing behavior level, each VSYS independently constructs physically meaningful in-degree and out-degree interfaces based on its VRF routing. At the policy behavior level, access control lists are organized based on the zone-pair direction of interfaces within the VSYS, constructing logically meaningful in-degree and out-degree interfaces. This transforms the firewall's forwarding and filtering behaviors into a device element model with both physical and logical meaning.
[0056] The operations for constructing the device element model are as follows:
[0057] (1) For firewall devices, initialize the Forward and Filtering elements, which represent the device's routing forwarding and policy control behaviors, respectively;
[0058] (2) For the Forward element, each VSYS has an independent instance, and each instance contains physically meaningful in-degree interfaces and out-degree interfaces. Specifically, the in-degree interfaces are all physical interfaces within the VSYS, and the out-degree interfaces are the next-hop interfaces determined by the VRF routing within the VSYS.
[0059] (3) For the Filtering element, each Zone-pair has an independent instance, each containing logically meaningful in-degree and out-degree interfaces. Specifically, the in-degree interface is the Zone-pair determined by the firewall after the Forward element, while the out-degree interface is a fixed permit and deny logical interface, representing the constraint relationship for a specific space.
[0060] In this embodiment, the construction and matching process of the firewall element model is as follows: Figure 2 Shown, including:
[0061] (1) The device generates Forward and Filtering elements. For routing behaviors of different VSYSs, the firewall device in the figure will generate Forward elements, including instances of VSYS-1, VSYS-2, VSYS-3, and VSYS-4. For filtering behaviors of different Zone-pair policy groups, the firewall device in the figure will generate Filtering elements, including filtering behaviors of different policy groups. For example, in this embodiment, no traffic is allowed to flow between Trust-V1 and Untrust-V1 under VSYS-1.
[0062] (2) The Forward element initializes the in-degree interface and out-degree interface. Specifically, the in-degree interface is bound to all physical interfaces in VSYS-1, including interfaces 1-3 of Trust-V1, interfaces 4-6 of Untrust-V1, and interfaces 7-9 of DMZ-V1. The out-degree interface is determined based on the possible next hops of the VRF routing in the VSYS. For example, in VSYS-1, for traffic destined for the 10.0.0.0 / 24 network segment, there is an equal-cost multi-path routing (ECMP) that causes the outgoing interface to point to interfaces 7 and 8 of DMZ-V1.
[0063] (3) The Filtering element initializes the in-degree interface and out-degree interface. Taking Trust-V1 to DMZ-V1 as an example, the logical interface of the in-degree interface is defined as ZonePair(Trust-V1→DMZ-V1), indicating that the traffic is sent from the Trust zone to the DMZ zone. The out-degree interface is bound to the logical interface permit or deny, and the result is determined according to the access control list policy: if the policy allows traffic destined for the 10.0.0.0 / 24 network segment, the permit interface takes effect and the traffic can reach interface 7 of DMZ-V1; if the policy prohibits traffic to the destination network segment, the deny interface takes effect and the traffic is discarded;
[0064] (4) The firewall device model is based on the core matching process of the behavioral element. The data packet first enters the Forward element and is bound to the source zone under the corresponding VSYS. The outbound interface of the traffic is determined within the interface range of the VSYS and is bound to the destination zone. After the Zone-pair is determined, the corresponding instance is searched in the Filtering element to apply the Zone1-pair policy: If a policy exists for the zone-pair, the rules in the policy map (such as deny, permit, etc.) are applied; if there is no matching zone-pair policy, the data packet is processed according to the default rule.
[0065] Step 4: Design a search algorithm and use it to search the device element model to obtain search results. Perform a parallel BFS analysis based on the existing device element model. During the initialization phase, schedule threads based on the starting interface. During the forwarding phase, schedule threads based on the data packets on the traversed device interfaces. All data packets store the path information during the forwarding process, i.e., the sequence of interfaces they traverse.
[0066] The operations of performing parallel analysis based on the existing device element model are as follows:
[0067] (1) Initially, the queue is loaded with packets to be verified. Then, according to the topological relationship, the global device elements, such as the Forward routing element and the Filtering policy element, are traversed in sequence. Each time an element is passed, the algorithm generates a new packet state based on all possible outbound interface rules of the device: If the packet finds the next-hop interface through the VRF routing of the Forward element and is judged as permit by the policy of the Filtering element, a new packet carrying the updated path information is generated and added to the queue; if it is judged as deny or there is no reachable path, the branch is terminated; if the next-hop interface already exists in the packet's path information, the branch is also terminated. This process is repeated until there are no new packets to be processed in the queue, and the traversal is completed.
[0068] (2) For the multiple starting data packets at the Internet interconnection interface determined by step 1, each data packet can reuse the existing global model for parallel analysis. For the queues generated during the initialization process, they are all stored independently in units of starting data packets.
[0069] (3) For the data packets generated by the forwarding process in step 4, each data packet can also reuse the existing global model for parallel analysis. The paths generated during the traversal process are stored independently in units of data packets.
[0070] In this embodiment, the parallel analysis process is as follows: Figure 3 Shown, including:
[0071] (1) Determine the specific attributes of the five-tuple starting data packet that need to be verified at the starting interface: the data packet of starting interface A ({srcip=192.168.0.0 / 24, dstip=10.0.0.0 / 24, srcport=all, dstport=all, proto=TCP}) requires verification of TCP connectivity from the internal trusted network (Trust-V1) to the DMZ area (DMZ-V1); the data packet of starting interface B ({srcip=192.168.1.0 / 24, dstip=10.0.1.0 / 24, srcport=all, dstport=all, proto=UDP}) needs to verify UDP connectivity from the external network (Untrust-V1) to the internal trusted network (Trust-V1).
[0072] (2) Each starting data packet is independently assigned a queue to avoid conflicts in the initialization process: the starting data packet A thread: initializes queue Queue_A and loads the corresponding TCP data packet; the starting data packet B thread: initializes queue Queue_B and loads the corresponding UDP data packet.
[0073] (3) Each next-hop device interface independently allocates data packets to avoid conflicts in the forwarding process: Data packet 1 reuses the Forward_VSYS1 and Filter_Trust-DMZ(V1) elements in the global model, and is routed to the interface in the DMZ area, triggering policy judgment, pointing to different next-hop devices B and C respectively, and generating data packets 3 and 4 that can be forwarded in the queue. These two data packets can run in parallel in subsequent traversals; Data packet 2 is routed to the interface under the Trust-V1 area through the same model and triggers the Filter_Untrust-Trust(V1) policy check. Although there are routes in VSYS that can point to devices D and E, the space is rejected because the policy is not met, so no data packet is generated.
[0074] Step 5: Based on the search results, reachability determination and path analysis are performed to identify the corresponding exposed network assets. After all packets have been traversed, reachability determination and path analysis are performed based on the packet's five-tuple spatial representation. If at least one packet can reach the destination device specified by the dstIP in the five-tuple, then a reachability relationship from the srcIP to the dstIP is established; otherwise, it is not established. Finally, based on the reachability relationship, the set of services accessible on the Internet is obtained, completing the exposure analysis of the network assets.
[0075] The present invention constructs a behavior-based multi-level device element model through data surface information, and adopts a parallel analysis mechanism to quickly obtain spatial reachability information, which significantly improves the accuracy and efficiency of network asset exposure surface analysis in large-scale complex network environments.
[0076] It will be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention may be implemented in various computer languages, for example, the object-oriented programming language Java and the interpreted scripting language JavaScript.
[0077] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0078] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0079] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0080] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.
[0081] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.
Claims
1. A static analysis method for network asset exposure, characterized in that: include: Obtain data plane information of network devices; Constructing an initial device connection graph based on the data plane information, obtaining in-degree interfaces and out-degree interfaces with physical meaning at the routing behavior level from the initial device connection graph, and constructing in-degree interfaces and out-degree interfaces with logical meaning at the policy behavior level; Based on the in-degree interface and out-degree interface in the routing behavior layer and the policy behavior layer, the firewall is modeled at multiple levels according to its behavior to obtain the device element model; Design a search algorithm and use it to search the device element model to obtain search results; Perform reachability determination and path analysis based on search results to obtain the corresponding network exposed assets.
2. The static analysis method according to claim 1, characterized in that: The data plane information includes topological connection relationships, routes and policies; network planning is identified based on the data plane information, including identifying the network starting device interface interconnected with the Internet, and generating a five-tuple space representation corresponding to the network starting device interface, the five-tuple space representation including srcIP, dstIP, source port, destination port, and protocol type.
3. The static analysis method according to claim 2, characterized in that: The device connection graph includes multiple nodes and edges connecting the nodes. The nodes represent firewalls, routers, switches, and host devices, and the edges represent the physical / logical connection relationships between the physical interfaces of the devices represented by the nodes.
4. The static analysis method according to claim 3, characterized in that: The obtaining of in-degree interfaces and out-degree interfaces having physical meaning at the routing behavior level, and the constructing of in-degree interfaces and out-degree interfaces having logical meaning at the policy behavior level include: All interfaces within the firewall are divided into virtual systems to obtain interfaces of each virtual system. Zone attributes are added to all interfaces within the virtual system. Zone attributes include zone-pair and its direction. At the routing behavior level, according to the VRF of each virtual system, in-degree and out-degree interfaces with physical meaning are constructed at the routing behavior level. At the policy behavior level, access control lists are organized according to the zone-pair direction of the interfaces within the virtual system, and in-degree and out-degree interfaces with logical meaning are constructed at the policy behavior level.
5. The static analysis method according to claim 4, characterized in that: The firewall is modeled at multiple levels based on the in-degree and out-degree interfaces at the routing and policy behavior levels. The process of obtaining the device element model includes the following: For the firewall, initialize the Forward element and the Filtering element; For the Forward element, each virtual system has an independent Forward instance. Each Forward instance contains physically meaningful in-degree interfaces and out-degree interfaces. The physically meaningful in-degree interfaces of the Forward instance are all physical interfaces in the virtual system, and the physically meaningful out-degree interfaces of the Forward instance are the next-hop interfaces determined by the VRF routing in the virtual system. For the Filtering element, each Zone-pair has an independent Zone-pair instance. Each Zone-pair instance contains a logically meaningful in-degree interface and an out-degree interface. The logically meaningful in-degree interface is the Zone-pair determined by the firewall after the Forward element, and the logically meaningful out-degree interface is the fixed permit and deny logical interfaces, indicating the constraint relationship of the packet space defined for a certain five-tuple space.
6. The static analysis method according to claim 5, characterized in that: The process of using the search algorithm to search the device element model to obtain the search results includes: Scheduling threads based on the starting interface in the device element model; initializing a queue, wherein the queue is independently stored based on data packets; The unit scheduling thread loads the data packet to be verified from the queue and traverses the global device elements of the device element model in sequence according to the topological relationship. Every time a device element is passed, the search algorithm generates a new data packet state according to the rules of all possible out-degree interfaces of the device; If the packet finds the next-hop interface through the VRF routing of the Forward element and is determined to be permitted by the policy of the Filtering element, a new packet carrying the updated path information is generated and added to the queue to complete forwarding. If it is determined to be denied or there is no reachable path, the branch is terminated. If the next-hop interface already exists in the path information of the packet, the branch is also terminated. This process is repeated until there are no new packets to be processed in the queue, and the traversal is completed.
7. The static analysis method according to claim 6, characterized in that: The search results include a five-tuple spatial representation of each data packet. The reachability determination and path analysis based on the search results include: Reachability determination and path analysis are performed based on the five-tuple space representation of each data packet. If there is at least one data packet that can reach the destination device specified by dstIP in the five-tuple space representation, then the reachability relationship from srcIP to dstIP is considered to be established, otherwise it is not established.
8. A static analysis system for network asset exposure, characterized in that: include: Data acquisition module, used to obtain data plane information of network devices; A connection graph module is used to construct an initial device connection graph based on data plane information, obtain in-degree interfaces and out-degree interfaces with physical meaning at the routing behavior level, and construct in-degree interfaces and out-degree interfaces with logical meaning at the policy behavior level from the initial device connection graph; A modeling module is used to perform multi-level modeling of the firewall behavior based on the in-degree interface and out-degree interface in the routing behavior layer and the policy behavior layer to obtain a device element model; Search module, used to design search algorithms and use the search algorithms to search the device element models to obtain search results; The analysis module is used to perform reachability determination and path analysis based on the search results to obtain the corresponding network exposed assets.
9. The static analysis system according to claim 8, characterized in that: The data plane information includes topological connection relationships, routes and policies; network planning is identified based on the data plane information, including identifying the network starting device interface interconnected with the Internet, and generating a five-tuple space representation corresponding to the network starting device interface, the five-tuple space representation including srcIP, dstIP, source port, destination port, and protocol type.
10. The static analysis system according to claim 9, characterized in that: The device connection graph includes multiple nodes and edges connecting the nodes. The nodes represent firewalls, routers, switches, and host devices, and the edges represent the physical / logical connection relationships between the physical interfaces of the devices represented by the nodes.
11. The static analysis system according to claim 10, characterized in that: The obtaining of in-degree interfaces and out-degree interfaces having physical meaning at the routing behavior level, and the constructing of in-degree interfaces and out-degree interfaces having logical meaning at the policy behavior level include: All interfaces within the firewall are divided into virtual systems to obtain interfaces of each virtual system. Zone attributes are added to all interfaces within the virtual system. Zone attributes include zone-pair and its direction. At the routing behavior level, according to the VRF of each virtual system, in-degree and out-degree interfaces with physical meaning are constructed at the routing behavior level. At the policy behavior level, access control lists are organized according to the zone-pair direction of the interfaces within the virtual system, and in-degree and out-degree interfaces with logical meaning are constructed at the policy behavior level.
12. The static analysis system according to claim 11, characterized in that: The firewall is modeled at multiple levels based on the in-degree and out-degree interfaces at the routing and policy behavior levels. The process of obtaining the device element model includes the following: For the firewall, initialize the Forward element and the Filtering element; For the Forward element, each virtual system has an independent Forward instance. Each Forward instance contains physically meaningful in-degree interfaces and out-degree interfaces. The physically meaningful in-degree interfaces of the Forward instance are all physical interfaces in the virtual system, and the physically meaningful out-degree interfaces of the Forward instance are the next-hop interfaces determined by the VRF routing in the virtual system. For the Filtering element, each Zone-pair has an independent Zone-pair instance. Each Zone-pair instance contains a logically meaningful in-degree interface and an out-degree interface. The logically meaningful in-degree interface is the Zone-pair determined by the firewall after the Forward element, and the logically meaningful out-degree interface is the fixed permit and deny logical interfaces, indicating the constraint relationship of the packet space defined for a certain five-tuple space.
13. The static analysis system according to claim 12, characterized in that: The process of using the search algorithm to search the device element model to obtain the search results includes: Scheduling threads based on a starting interface in a device element model; initializing a queue, wherein the queue is independently stored based on a starting data packet; The unit scheduling thread loads the data packet to be verified from the queue and traverses the global device elements of the device element model in sequence according to the topological relationship. Every time a device element is passed, the search algorithm generates a new data packet state according to the rules of all possible out-degree interfaces of the device; If the packet finds the next-hop interface through the VRF routing of the Forward element and is determined to be permitted by the policy of the Filtering element, a new packet carrying the updated path information is generated and added to the queue to complete forwarding. If it is determined to be denied or there is no reachable path, the branch is terminated. If the next-hop interface already exists in the path information of the packet, the branch is also terminated. This process is repeated until there are no new packets to be processed in the queue, and the traversal is completed.
14. The static analysis system according to claim 13, characterized in that: The search results include a five-tuple spatial representation of each data packet. The reachability determination and path analysis based on the search results include: Reachability determination and path analysis are performed based on the five-tuple space representation of each data packet. If there is at least one data packet that can reach the destination device specified by dstIP in the five-tuple space representation, then the reachability relationship from srcIP to dstIP is considered to be established, otherwise it is not established.
15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claims 1 to 7 are implemented.