Asset vulnerability detection methods, devices, electronic equipment and storage media

Abstract

This application discloses an asset vulnerability detection method, apparatus, electronic device, and storage medium, relating to the field of network security technology. The method includes actively sending multi-protocol probe packets to scan target network segments to obtain a first asset set; passively monitoring network traffic to extract asset feature information to obtain a second asset set, thereby generating an asset list; distributing and parallel scheduling port scanning tasks for each asset to multiple scanning nodes, and combining a port scanning optimization model based on risk prediction to perform dynamic port scanning in descending order of multiple key elements to construct a full port risk map; static layer matching known vulnerabilities; dynamic layer identifying suspicious behaviors deviating from the normal behavior baseline through anomaly detection algorithms, and obtaining asset vulnerability detection results by combining cross-validation; this application meets the detection needs for full asset coverage and early threat detection in complex network environments.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an asset vulnerability detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, in network security protection practices, asset vulnerability detection typically relies on automated toolchains. A typical process includes: using a network scanner to poll IP address ranges to discover online hosts; performing full port or common port scans on the identified hosts to determine open services; determining device type and software version based on the returned service banner or protocol response characteristics through rule matching or simple pattern recognition; and finally, comparing the identification results with known vulnerability databases (such as CVE, CNVD) to output potential risk items.

[0003] However, the above methods face significant limitations in practical applications:

[0004] First, asset discovery relies heavily on proactive detection. It often fails to effectively identify temporary assets that are not exposed to the outside world, do not respond to scanning requests, or are dynamically generated (such as internal network containers or privately connected devices), resulting in an incomplete asset list and creating security blind spots.

[0005] Secondly, vulnerability detection mechanisms are essentially "post-event matching" mechanisms, which can only identify known vulnerabilities that are already recorded in the vulnerability database. They lack the ability to proactively detect and identify attacks that exploit unknown vulnerabilities or are carried out through abnormal behavior.

[0006] Although existing technologies have improved in terms of scanning speed and fingerprint matching accuracy, the aforementioned structural defects have not been effectively overcome, making it difficult to meet the detection requirements for full asset coverage and early threat detection in complex network environments. Therefore, improvements are urgently needed. Summary of the Invention

[0007] To address the shortcomings of existing technologies and meet the detection needs for full asset coverage and early threat detection in complex network environments, this application provides an asset vulnerability detection method, apparatus, electronic device, and storage medium.

[0008] Firstly, the objective of this invention is achieved through the following technical solution:

[0009] Asset vulnerability detection methods include:

[0010] By actively sending multi-protocol probe packets to scan the target network segment, a first asset set is obtained; by passively monitoring network traffic, asset feature information is extracted to obtain a second asset set; and an asset list is generated based on the first asset set and the second asset set.

[0011] Based on the asset list, the port scanning tasks of each asset are distributed and scheduled in parallel to multiple scanning nodes. Combined with the port scanning optimization model based on risk prediction, dynamic port scanning is performed in descending order according to multiple preset key elements, and a full port risk map is constructed.

[0012] Vulnerability detection is performed by selecting at least one dimension that matches the asset feature information, the asset list, and / or the response data from port scanning; the dimension includes a static layer and a dynamic layer; the static layer matches known vulnerabilities based on a dynamically updated full port risk map; the dynamic layer identifies suspicious behaviors that deviate from the normal behavior baseline through anomaly detection algorithms, and obtains asset vulnerability detection results by combining cross-validation.

[0013] By adopting the above technical solutions, this application provides a more comprehensive, real-time, and accurate asset detection technology, focusing on the core aspects of asset discovery, port scanning, and vulnerability detection, including active detection and passive monitoring based on fingerprint recognition. Specifically, in terms of asset discovery, a complete asset list is generated through a dual-mode discovery mechanism that combines active detection and passive monitoring to eliminate blind spots in hidden assets and solve the existing problem of "incomplete asset profiling." The port scanning efficiency and targeting are improved through a scanning method that combines parallel processing and intelligent sorting, breaking through the traditional serial scanning mode. A dual strategy of "parallel processing and risk prediction" is adopted: multi-threaded parallel scanning is implemented based on a distributed architecture, breaking down large-scale port scanning tasks into sub-tasks and distributing them to multiple scanning nodes, significantly shortening scanning time; and a deep neural network model enhances the device fingerprint recognition capabilities for local features and global temporal correlation features, strengthening the adaptability of this application's asset detection mechanism in complex environments. Then, a dual-dimensional detection approach of "static knowledge and dynamic behavior" is constructed: the static layer relies on a dynamically updated full-port risk graph, such as entity associations of "device model-applicable vulnerability-attack path," to quickly match known vulnerabilities; the dynamic layer deploys a behavior analysis engine to establish normal baseline behavior for each asset, such as normal port communication frequency, process call relationships, and data transmission volume. Then, anomaly detection algorithms (such as isolated forest) are used to identify suspicious behaviors that deviate from the baseline, such as unauthorized port opening and abnormal encrypted data transmission. The results of the two are cross-validated: known vulnerabilities are directly located through the knowledge graph, and unknown threats (such as zero-day vulnerability exploits) are marked by behavioral anomalies, solving the pain points of "reliance on known databases and slow response to new threats." Thus, this application meets the detection needs of full asset coverage and early threat discovery in complex network environments, further improving scanning speed and fingerprint matching accuracy.

[0014] In a preferred embodiment of this application, the construction of the full port risk map includes:

[0015] Based on the asset list, collect system logs and network traffic data for each asset;

[0016] Based on the process startup records and port binding information in the system log, as well as the abnormal communication sources, destination ports and data packet characteristics in the network traffic data, non-standard ports or dynamically allocated ports not covered by port scanning are mined through preset association rules to obtain ports to be scanned.

[0017] The ports to be scanned are added to the supplementary scan task, and the full port risk map is updated in combination with the historical port scan results to eliminate port scan blind spots.

[0018] By adopting the above technical solution, process startup records, port binding information and abnormal communication characteristics in network traffic are collected from system logs. Non-standard ports are actively discovered using preset association rules. Non-standard ports are temporary ports and private service ports, which effectively make up for the scanning blind spots caused by traditional port scanning only covering well-known ports (such as commonly used ports in 1–65535). The discovered ports to be supplemented are then included in the dynamic scanning task, and the full port risk map is continuously updated, so that the risk map has the ability to evolve.

[0019] In a preferred example, the implementation of the port scan optimization model for risk prediction includes:

[0020] Construct a port risk feature matrix that includes protocol type risk coefficient, historical vulnerability density, service version vulnerability index, and network topology sensitivity parameters;

[0021] The port risk feature matrix is ​​trained using the LightGBM algorithm to obtain the port scanning optimization model. The top-K key features are selected and retained based on the feature importance evaluation results, where K is greater than or equal to 15.

[0022] The features of the port to be scanned are input into the port risk prediction model to obtain the corresponding risk prediction probability; when the risk prediction probability is greater than the preset dynamic risk threshold, an emergency scan is triggered; otherwise, the ports are prioritized and scheduled in descending order of risk prediction probability.

[0023] By adopting the above technical solution, the port risk feature matrix integrates multi-dimensional port risk feature data. Training with efficient gradient boosting tree models such as LightGBM enables risk prediction to possess strong interpretability and high generalization ability. TOP-K (K≥15) key features are retained through feature importance screening. An emergency scanning mechanism triggered by a dynamic risk threshold enables rapid response to high-risk ports, while low-risk ports are scheduled according to priority, significantly optimizing the efficiency of scanning resource allocation.

[0024] In a preferred example, after obtaining the asset list, the method further includes:

[0025] Based on historical traffic logs and real-time network behavior data of the target network segment, a time-series graph model of network behavior is constructed using a graph neural network, and behavioral feature vectors of device nodes are extracted.

[0026] The behavioral feature vectors are input into a pre-trained abnormal behavior detection model to identify suspicious asset nodes that deviate from the normal behavior baseline and generate a high-risk asset candidate set.

[0027] For the high-risk asset candidate set, an automated simulation attack engine is invoked to dynamically generate multi-dimensional attack payloads that match the protocol characteristics of the suspicious asset nodes, and targeted penetration testing is performed.

[0028] Based on the response results of the penetration test, combined with the vulnerability knowledge graph and expert rule base, the suspected vulnerabilities are dynamically evaluated by multiple indicators, including the actual risk level, propagation capability, scope of impact, remediation difficulty, and degree of business impact.

[0029] Based on the evaluation results, a vulnerability confidence score is generated, and vulnerabilities with a confidence score higher than a preset threshold are marked as real vulnerabilities, and a structured vulnerability report is output.

[0030] By adopting the above technical solution, after completing device fingerprint identification in the asset discovery stage, a network behavior temporal modeling and automated simulated attack verification mechanism based on graph neural networks is further introduced to form a closed-loop detection process of "initial screening of abnormal behavior and active penetration verification". This application can not only identify suspicious asset nodes that deviate from the normal baseline, but also verify whether they actually have exploitable vulnerabilities through targeted penetration testing, effectively distinguishing between two scenarios: "abnormal behavior but no vulnerability" and "real high-risk vulnerability". Combining vulnerability knowledge graph and expert rule base for multi-indicator dynamic evaluation and outputting structured vulnerability reports, the accuracy and interpretability of vulnerability assessment are greatly improved.

[0031] In a preferred embodiment of this application, the method of constructing a time-series graph model of network behavior using a graph neural network includes:

[0032] A multi-layered heterogeneous graph structure is constructed using network devices as nodes and communication sessions as edges, where each layer corresponds to a different protocol level or time window.

[0033] Each layer of the graph structure is encoded by node embedding, and the static attributes of the device and the dynamic traffic statistics features are integrated;

[0034] By aggregating multi-layer graph information through a spatiotemporal attention mechanism, a device behavior representation vector with context awareness is generated.

[0035] By adopting the above technical solutions, static attributes of the device, such as device type and manufacturer; dynamic traffic statistics, such as connection frequency and data packet size distribution; the multi-layer heterogeneous graph structure constructed in this application, which is layered according to protocol level or time window, can accurately depict the interaction relationship of network devices in different dimensions; node embedding encoding of each layer of graph structure can enhance the representation capability; by introducing a spatiotemporal attention mechanism to adaptively aggregate multi-layer information, the generated device behavior representation vector has context awareness capability, which can effectively capture complex attack chain behaviors such as lateral movement and C2 communication across protocols and time periods.

[0036] In a preferred embodiment of this application: the automated simulated attack engine dynamically generates multi-dimensional attack payloads, including:

[0037] Based on protocol fuzz testing, the protocol stack used by the open ports of the target asset is subjected to syntactic and semantic mutations to generate probe payloads that cover boundary conditions, abnormal fields and private extensions.

[0038] By combining reinforcement learning strategies and using vulnerability exploitation success rate and resource consumption as reward functions, the attack path selection and payload combination are optimized.

[0039] The attack payload is pre-executed in an isolated sandbox environment to verify its security and effectiveness before being sent to a real target.

[0040] By adopting the above technical solutions, the protocol stack is subjected to dual syntactic and semantic mutations based on protocol fuzzing technology to generate probe payloads covering boundary conditions, abnormal fields, and private extensions. This overcomes the limitations of traditional attack simulations based on signatures or fixed PoCs, and improves the ability to detect unknown protocol vulnerabilities. By combining reinforcement learning strategies to optimize attack paths and payload combinations, and using "vulnerability exploitation success rate" and "resource consumption" as dual-objective reward functions, Pareto optimality of attack efficiency and stealth is achieved. Through isolation sandboxes and execution verification mechanisms, the security and effectiveness of attack payloads are ensured. This effectively avoids target system downtime or compliance risks caused by invalid or destructive payloads.

[0041] In a preferred embodiment of this application: the multi-index dynamic evaluation is implemented through a deep Q-network, including:

[0042] Construct an action library for selecting evaluation indicators, with each action corresponding to a combination of at least two evaluation indicators;

[0043] Define a vulnerability assessment reward function that comprehensively considers the degree of risk reduction, the effectiveness of propagation control, the degree of business impact, and resource consumption.

[0044] Using a deep Q-network, the optimal evaluation action is selected from the action library based on the current vulnerability type and context information. After execution, the multi-indicator fusion evaluation result is output.

[0045] By adopting the above technical solutions, the evaluation index selection action library is used to transform multi-index evaluation into an action selection problem in reinforcement learning, avoiding subjective bias caused by manually setting weights; by defining a vulnerability evaluation reward function that considers the degree of comprehensive risk reduction, propagation control effect, business impact, and resource consumption, the evaluation results are made more in line with actual security operation needs; then, the Deep Q Network (DQN) is used to intelligently select the optimal evaluation action based on vulnerability type and context information, realizing adaptive optimization of the evaluation strategy, so that the multi-index fusion evaluation results can not only reflect technical risks, but also take into account business impact and remediation costs.

[0046] Secondly, the objective of this invention is achieved through the following technical solution:

[0047] Asset vulnerability detection device, the device comprising:

[0048] The asset discovery module is used to obtain a first asset set by actively sending multi-protocol probe packets to scan the target network segment; to obtain a second asset set by passively monitoring network traffic and extracting asset feature information; and to generate an asset list based on the first asset set and the second asset set.

[0049] The vulnerability detection module is used to select a dimension that matches at least one of the asset feature information, the asset list, and / or port scan response data for vulnerability detection; the dimension includes a static layer and a dynamic layer; the static layer matches known vulnerabilities based on a dynamically updated full port risk map; the dynamic layer identifies suspicious behaviors that deviate from the normal behavior baseline through anomaly detection algorithms, and obtains asset vulnerability detection results by combining cross-validation.

[0050] Thirdly, the objective of this invention is achieved through the following technical solution:

[0051] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the asset vulnerability detection method described above.

[0052] Fourthly, the objective of this invention is achieved through the following technical solution:

[0053] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the asset vulnerability detection method described above.

[0054] In summary, this application includes the following beneficial technical effects:

[0055] 1. This application generates an asset inventory by integrating active detection and passive traffic monitoring, overcoming the technical shortcomings of traditional methods that rely solely on active scanning, which easily misses hidden assets, and rely solely on traffic mirroring, which is difficult to cover offline devices. This significantly improves the completeness and accuracy of asset discovery. Based on the asset inventory, risk-driven dynamic port scanning scheduling is implemented to avoid indiscriminate full scanning of low-risk ports, greatly reducing system resource consumption and network disturbance. By introducing a deep neural network device fingerprinting model that includes local features and global temporal correlation features, the accuracy of identifying fuzzy, disguised, or proprietary protocol devices is effectively improved. Finally, a collaborative verification mechanism of static layer (known vulnerability matching) and dynamic layer (abnormal behavior detection) is adopted to ensure efficient coverage of known vulnerabilities and to discover unknown risks such as zero-day vulnerabilities or configuration anomalies. Combined with cross-validation, the false positive rate and false negative rate are significantly reduced, achieving high-precision, low-interference, and full-coverage asset vulnerability detection. Attached Figure Description

[0056] Figure 1 This is a flowchart of an asset vulnerability detection method in one embodiment of this application. Detailed Implementation

[0057] The present application will be further described in detail below with reference to the accompanying drawings.

[0058] In one embodiment, such as Figure 1 As shown, this application discloses an asset vulnerability detection method, which specifically includes the following steps:

[0059] S1: Actively send multi-protocol probe packets to scan the target network segment to obtain the first asset set; passively monitor network traffic to extract asset feature information to obtain the second asset set; generate an asset list based on the first and second asset sets.

[0060] In this embodiment, actively sending multi-protocol probe packets refers to the vulnerability detection system proactively sending probe data packets of various network protocol types to IP addresses in the target network segment (e.g., 192.168.0.0 / 24), including but not limited to: ICMPEcho Request (for host liveness detection), TCP SYN packets (for port open detection), UDP empty packets (for UDP service detection), and handshake request packets for specific application layer protocols (e.g., HTTP, FTP, SSH, Modbus, CoAP, etc.). Each probe packet carries standard or variant fields to trigger different response behaviors from the target device. The first asset set refers to the list of active network assets identified through the above active detection. Each asset record contains structured information such as IP address, MAC address (if available), list of open ports, response protocol type, response timestamp, TTL value, and operating system fingerprint clues (e.g., TCP window size, option order). Passively monitoring network traffic refers to deploying traffic acquisition probes on critical links of the target network, capturing bidirectional network communication data packets in real time using technologies such as libpcap or eBPF, without actively sending any data, only parsing the traffic content. Key links include the mirror port of the core switch and the cloud VPC stream log exit.

[0061] In this embodiment, the passive monitoring end deploys a traffic capture engine to analyze asset characteristics in network data packets in real time, such as device MAC addresses, application fingerprints, and communication protocol identifiers, to perform device fingerprinting operations. This is achieved using a pre-trained deep neural network model and / or a pre-stored device fingerprint information database. The pre-trained deep neural network model is a hybrid of a 1D convolutional neural network (CNN) and a bidirectional long short-term memory neural network (LSTM). The 1D CNN processes the response byte sequence to extract local patterns such as protocol fields and keys to obtain local feature inputs. The bidirectional LSTM network then processes the time series of multi-port responses to capture cross-port behavioral correlations, obtaining global time-series inputs. For example, a device might respond to SSH on port 22 and return a specific web fingerprint on port 80. The device fingerprinting results include device type, operating system and version, application service and version, service port, protocol interaction features, and confidence score. During the deep neural network model training phase, a contrastive learning strategy is used: two response samples collected from the same device at different times are considered positive samples, and samples from different devices are considered negative samples. The NT-Xent loss function is used for optimization. Asset characteristic information includes the results based on device fingerprint recognition.

[0062] Specifically, the local feature input is defined as The response string of each port is encoded at the byte or word level and formed into a fixed-length sequence L, such as L=256 bytes. If the length is insufficient, it is padded with 0s; if it exceeds the length, it is truncated. This sequence is then mapped to a vector through an embedding layer, where V is the embedding dimension. The global temporal input is defined as... T represents the number of port interactions within the observation time window, and F represents the statistical feature dimension of each interaction; local features are input... and global timing input Feature fusion and classification are performed. Based on a classification head using a fully connected layer combined with a Softmax activation function, the device category probability distribution is output, followed by the device fingerprint recognition result.

[0063] Extracting asset characteristic information can include, but is not limited to: parsing source / destination IP, port, protocol type and identifier, TLS SNI field, HTTP User-Agent, DNS query domain name, NetBIOS name, mDNS service broadcast, device manufacturer OUI code, and firmware layer identification characteristics, protocol interaction characteristics, communication behavior characteristics, and security configuration characteristics from traffic, all of which can be used to identify the device. Simultaneously, traffic behavior characteristics such as connection frequency, session duration, packet size distribution, and protocol interaction sequences are statistically analyzed. The second asset set is a list of assets composed of asset characteristics obtained through passive monitoring, suitable for discovering assets that do not respond to active probing.

[0064] In this embodiment, the asset list may include software assets and hardware assets; software assets may include, but are not limited to, system software, application software, support software, software licenses and configuration files, scripts and code assets; hardware assets may include, but are not limited to, terminal devices, network devices, server devices, storage devices, peripherals and dedicated hardware.

[0065] For example, system software can be an operating system, firmware, or driver; supporting software can be database software, message queues, etc.; code assets can be open-source code components; and software licenses can be software license certificates, activation keys, etc.

[0066] For example, the terminal device can be an IoT terminal, an industrial control computer, a computer, or a mobile terminal; the storage device can be a hard disk, a storage array, an optical disc drive, etc.; and the peripheral device can be a printer, a scanner, etc.

[0067] Specifically, the first asset set and the second asset set are merged and deduplicated according to IP address. For the same IP, if there are differences between the results of active probing and passive monitoring (such as inconsistent ports), the passive monitoring results are used as a supplement to form a unified asset list.

[0068] S2: Based on the asset list, the port scanning tasks of each asset are distributed and scheduled in parallel to multiple scanning nodes. Combined with the port scanning optimization model based on risk prediction, dynamic port scanning is performed in sequence according to multiple preset key elements, and a full port risk map is constructed.

[0069] In this embodiment, distributed parallel scheduling refers to breaking down the port scanning task for each asset in the asset list into sub-tasks, such as scanning ports 1–65535 for IP A. Several preset key elements include risk severity, probability of occurrence, asset importance, and network topology sensitivity. Tasks are distributed to scanning nodes deployed on different physical machines or containers via a task queue, with each scanning node performing the scan independently. The port scanning optimization model is a machine learning model; this embodiment uses an XGBoost-based machine learning model, with input being a port-level feature vector and output being the probability of a port having a high-risk vulnerability. The calculation of the probability of risk severity is based on the port risk feature matrix. Each row 'n' corresponds to the number of ports to be scanned, and each column 'd' corresponds to the number of port risk features. Risk factor for protocol type; Historical vulnerability density is calculated as the number of CVEs associated with a port in the past year / the average number of CVEs for similar ports, normalized to the [0-1] range. The Service Version Vulnerability Index is based on the highest CVSS score for the vulnerability corresponding to this service version in the NVD database and is normalized. For example, Service Version Vulnerability Index = CVSS score / 10; for example, OpenSSH 7.2p2 has a base CVSS score of 9.8, so it is normalized to 0.98. This represents network topology sensitivity, ranging from 0 to 1. Network topology sensitivity is determined by the location of the asset within the network; for example, 0.9 for DMZ servers, 0.3 for intranet office terminals, 1.0 for core databases, and 0.6 for IoT edge devices.

[0070] Port scan optimization model output: in, Let x be the port risk feature vector, w be the weight vector, and b be the parameters obtained from model training. The weight vector w is a d-dimensional column vector.

[0071] Specifically, performing dynamic port scanning in descending order of risk severity probability means first calculating all ports to be scanned for each asset. Sort by high to low, for example, set Ports with a value greater than 0.7 are considered high-risk ports, and these ports should be scanned first. The full port risk map is a global data structure that uses asset IP addresses and port numbers as keys to store information such as risk probability, scan status, and vulnerability matching results, in the form of a graph database.

[0072] Furthermore, constructing a full-port risk map includes:

[0073] S21: Based on the asset list, collect system logs and network traffic data for each asset.

[0074] In this embodiment, system logs refer to log data obtained from the operating system or application services of the target asset; network traffic data refers to raw communication data or metadata captured on the critical links of the target network, including source IP, destination IP, source port, destination port, protocol type, packet length, flag bits, and traffic session records. The collection tool can be an open-source probe.

[0075] S22: Based on process startup records and port binding information in the system log, as well as abnormal communication sources, destination ports and packet characteristics in network traffic data, non-standard ports or dynamically allocated ports not covered by port scanning are mined through preset association rules to obtain ports to be scanned.

[0076] In this embodiment, process startup records refer to application startup events recorded in the system log; port binding information refers to the binding relationship between a process and a network port; abnormal communication source and destination ports refer to ports that appear in network traffic but are not found in the initial port scan results. For example, the initial scan only found ports 22 and 80 open; however, the traffic log shows that the asset frequently communicates with external parties using destination port 32768 or source port, or communication occurs using uncommon ports such as the range 20000–65535. Non-standard ports refer to ports not in the IANA official registered port list (such as 1–1023); dynamically allocated ports refer to ports temporarily allocated by the operating system (such as ports 32768–65535), which are often used for client-initiated connections, but may also be used as service ports in scenarios such as NAT traversal and reverse shell.

[0077] The default association rules are a set of heuristic rules defined by security experts or automated systems to correlate logs and traffic data to identify potential hidden ports. For example, association rule RU1 is: if "Started *on port X" appears in the system log, and X is not in the initial scan port list, then X is a port to be supplemented; association rule RU2 is: if an asset in network traffic responds to a connection on port Y as a server (i.e., receiving SYN packets), but Y is not scanned, then Y is a port to be supplemented; association rule RU3 is: if an asset communicates with multiple external IPs using the same high-risk port Z (e.g., Z∈[10000, 65535]) within a short period, and Z has no known service, then Z is marked as a suspicious port to be scanned; association rule RU4 is: if the Server Hello in the TLS handshake record comes from port P, but P is not open, then P may be an HTTPS spoofing port and needs to be scanned.

[0078] S23: Add the ports to be scanned to the supplementary scan task, and update the full port risk map based on the historical port scan results to eliminate port scan blind spots.

[0079] In this embodiment, the update operation of the full port risk map includes: adding newly scanned open ports to the map; marking ports as "closed" or "filtered" if they are unresponsive; recalculating their risk probability based on the service information of the new ports, and establishing a chain of association "asset → new port → service → potential vulnerability" in the map. The effect of eliminating port scanning blind spots means that services that were previously missed due to the use of non-standard ports are successfully discovered; dynamically allocated temporary service ports (such as random ports mapped by Docker containers) are promptly included in monitoring.

[0080] Furthermore, the implementation of the port scan optimization model for risk prediction includes:

[0081] S201: Construct a port risk feature matrix that includes protocol type risk coefficient, historical vulnerability density, service version vulnerability index, and network topology sensitivity parameters.

[0082] In this embodiment, the risk factor for protocol types is as follows: SSH protocol has a risk factor of 0.85, RDP protocol has a risk factor of 0.90, HTTP protocol has a risk factor of 0.60, CoAP protocol has a risk factor of 0.60, and custom private protocol has a risk factor of 0.95.

[0083] S202: The LightGBM algorithm is used to train the port risk feature matrix to obtain the port scanning optimization model. Based on the feature importance evaluation results, the top TOP-K key features are selected and retained, where K is greater than or equal to 15.

[0084] In this embodiment, the LightGBM algorithm is an efficient gradient boosting decision tree (GBDT) framework that supports large-scale data. The training data samples of the port scan optimization model include the aforementioned port risk feature vectors and labels y∈{0,1}, where y=1 indicates that the port is subsequently confirmed to have an exploitable vulnerability (e.g., verified through penetration testing); y=0 indicates no vulnerability or low risk. The LightGBM classifier is trained with AUC or F1-score as the optimization objective, outputting probability values.

[0085] Specifically, after training, LightGBM automatically calculates the split gain or coverage of each feature as its importance score. The system sorts the features from high to low and selects the top-K features (K≥15). For example, the top 15 port risk features include protocol type risk coefficient, historical vulnerability density, service version vulnerability index, network topology sensitivity, whether it is exposed to the public network, whether the port is an IANA registered port, whether the banner contains version information, whether it has been attacked in the past 30 days, whether the asset belongs to a core business system, port response latency, service banner entropy, whether TLS / SSL is used, the remaining percentage of TLS certificate validity, whether it appears in the threat intelligence IOC, and the duration of port openness.

[0086] S203: Input the features of the port to be scanned into the port risk prediction model to obtain the corresponding risk prediction probability; when the risk prediction probability is greater than the preset dynamic risk threshold, trigger an emergency scan; otherwise, prioritize the ports according to the descending order of risk prediction probability.

[0087] In this embodiment, the dynamic risk threshold is dynamically adjusted based on the current system load, asset importance, and threat intelligence. The base risk threshold is set to 0.7. If an active RDP brute-force attack (from the threat intelligence platform) is detected across the entire network, the threshold for all RDP ports is temporarily lowered to 0.5; if scanning node resources are strained, the threshold is raised to 0.8, and only extremely high-risk ports are scanned.

[0088] Specifically, prioritizing ports by descending order of risk prediction probability means adding ports that have not reached the emergency threshold to the regular scanning queue; the queue is then sorted according to... Sort by high to low; when a scanning node is idle, prioritize processing high-risk tasks at the head of the queue.

[0089] S3: Select at least one dimension that matches the asset characteristic information, asset list, and / or port scan response data for vulnerability detection; the dimension includes a static layer and a dynamic layer; the static layer matches known vulnerabilities based on a dynamically updated full port risk map; the dynamic layer identifies suspicious behaviors that deviate from the normal behavior baseline through anomaly detection algorithms, and obtains asset vulnerability detection results by combining cross-validation.

[0090] In this embodiment, a device fingerprint information database is pre-configured to store device fingerprint information of different types of devices. The division rules between the static layer and the dynamic layer are as follows: if the device fingerprint matches a known model and the service version is clear in the device fingerprint information database, it is classified into the static layer; if the device fingerprint is ambiguous, the version is unknown, or there is a non-standard protocol such as a self-developed industrial control protocol, it is classified into the dynamic layer.

[0091] For example, when performing vulnerability detection based on asset characteristic information: the system matches the asset characteristic information against a pre-stored device fingerprint database. If the specific device model and service version can be identified, the static layer dimension is selected, directly comparing it with the CVE / NVD vulnerability database and the device fingerprint information database. If the characteristics are ambiguous or the version cannot be parsed, the dynamic layer dimension is selected, only recording its communication behavior for subsequent anomaly analysis. For example, when the User-Agent is parsed as "Hikvision-IPC / 1.2", a static match for CVE-2023-XXXX is triggered; if it is only "IoT-Device v1.0", the CVE is not matched, and only behavior monitoring is included.

[0092] When performing vulnerability detection based on an asset inventory, the system selects the detection dimension according to the type tags in the inventory: for known asset types, a static layer is used for precise vulnerability matching; for unknown or generalized asset types such as temporary endpoints, a dynamic layer is used for behavioral baseline modeling. For example, assets marked as "core web server" in the inventory are automatically matched for Apache / Nginx-related CVEs; assets marked as "unknown IoT" are not matched for version, and only their port communication is observed for abnormalities.

[0093] When performing vulnerability detection based on port scan response data, the response data includes the service banner, protocol negotiation result, and response content. The system parses this response data. If it contains a clear service version, the static layer dimension is selected for precise matching with the vulnerability database. If the response is empty, times out, or returns a non-standard protocol, it is classified as a dynamic layer dimension, which does not rely on version matching but instead focuses on whether its subsequent interactions deviate from the normal pattern. For example, receiving "Dropbear_2020.80" matches CVE-2021-XXXX; if port 502 has no response or returns garbled characters, it does not match the CVE and is only marked as an object to be analyzed.

[0094] Static layer matching of known vulnerabilities refers to precisely matching the service version in the device fingerprint with the CVE / NVD vulnerability database. If a corresponding CVE entry exists, it is marked as a potential vulnerability, and the confidence score is weighted by combining the risk probability in the full port risk map. The confidence weighting process includes: obtaining the CVSS score of the CVE in the NVD or internal vulnerability knowledge base as the basic vulnerability risk score; calculating the risk severity probability corresponding to the asset-port combination in the full port risk map; associating the basic vulnerability risk score and risk severity probability with corresponding weight coefficients; and performing weighted fusion scoring to obtain the final vulnerability confidence score. The anomaly detection algorithm adopts a multi-dimensional behavioral modeling method based on Gaussian mixture models (GMM).

[0095] Dynamic layer anomaly detection refers to continuously collecting network behavior data (such as target IP distribution, packet rate, and protocol interaction patterns) of assets classified as dynamic layers to construct a normal behavior baseline (e.g., using a Gaussian Mixture Model, GMM). When real-time behavior deviates from the baseline by more than a corresponding threshold, it is judged as suspicious behavior.

[0096] Specifically, dynamic anomaly detection includes: continuously recording the network behavior of the asset during a period when the asset is in a known safe state, including: the number of different IPs connecting to the outside per minute, the number of data packets sent and received per second, the types of protocols used, and whether unused ports are frequently accessed. This data is then aggregated into a set of normal behavior samples within a fixed time window. Statistical analysis is performed on multiple sets of normal behavior samples, and a normal range is calculated for each behavior indicator. For example, the normal value for data packet sending rate is typically 10–100 packets / second; the number of external IPs typically does not exceed 5; and the proportion of abnormal port communication is typically 0%. Next, a Gaussian Mixture Model (GMM) is used to model the multidimensional behavioral data. The GMM can automatically learn the typical behavioral patterns of the device under different operating states and provide an overall normal probability distribution as the baseline for the asset's normal behavior. During the training phase of the GMM, the likelihood score of all normal behavior samples under the GMM model is calculated. The lower the score, the less likely it is to be normal behavior. The lowest 5% of all normal scores is taken as the anomaly threshold. For example: if 95% of normal behavior scores are higher than -12.0, then set the threshold to -12.0.

[0097] Cross-validation refers to the logical fusion of vulnerability matching results from the static layer and anomaly detection results from the dynamic layer. For example, if the static layer reports a vulnerability (CVE-2023-1234) in an SSH service, and the dynamic layer detects that the device frequently attempts to connect to an external C2 server, then the cross-validation passes, confirming it as a high-risk vulnerability; if only the static layer shows a match but no abnormal behavior, it is downgraded to "low-risk, under observation".

[0098] If there is an anomaly only in the dynamic layer but no known vulnerability matches, the simulated attack verification process is triggered.

[0099] In one embodiment, after obtaining the asset list, the method further includes:

[0100] S10: Based on the historical traffic logs and real-time network behavior data of the target network segment, a time-series graph model of network behavior is constructed using a graph neural network, and behavioral feature vectors of device nodes are extracted.

[0101] In this embodiment, the target network segment refers to the range of IP addresses to be detected. Each IP address is first treated as a node. If two nodes communicate within a fixed time window (e.g., 5 minutes), an edge with attributes is established. Edge attributes include protocol type, data volume, and communication direction; node attributes include device fingerprinting results, open ports, and operating system. Then, a graph neural network, such as a GCN+LSTM combination structure, is used to encode the time-series graph sequence, generating a high-dimensional behavioral feature vector for each device node.

[0102] Specifically, step S10 includes: constructing a time-series graph model of network behavior using a graph neural network, including:

[0103] S101: Construct a multi-layered heterogeneous graph structure with network devices as nodes and communication sessions as edges, where each layer corresponds to a different protocol level or time window.

[0104] In this embodiment, raw communication data is acquired, including NetFlow / sFlow stream records, Zeek connection logs (conn.log), TLS logs (ssl.log), and HTTP logs (http.log). Each record contains fields such as source / destination IP, port, protocol, number of bytes, number of packets, timestamp, and application layer identifier (e.g., HTTP Host, TLS SNI). Each IP address is considered a device node. If the same IP address exhibits different roles in different subnets (e.g., acting as both a client and a server), it is still considered a single node, but distinguished by attributes. If two nodes have a communication session under specific conditions, a directed edge is established. The definition of the edge depends on the layer type, which includes layering by protocol level. For example, Layer 1 (L4) is based on TCP / UDP sessions, and edges represent raw transport layer connections; Layer 2 (L7) is based on application layer protocols (such as HTTP, DNS, RTSP), and edges are established only when valid application semantics are resolved; Layer 3 (encrypted traffic layer) establishes edges based on TLS fingerprints (JA3 / JA3S) and certificate information to identify encrypted service behavior.

[0105] Alternatively, layer by time window: divide the most recent 60 minutes into T=6 non-overlapping windows (each window is 10 minutes), and construct a graph for each window. This forms a time series graph stack. Each subgraph They share the same set of nodes V (all network devices), but the edge set Edge properties vary by layer.

[0106] S102: Node embedding encoding is performed on each layer of the graph structure, and the static attributes of the device and the dynamic traffic statistics features are integrated.

[0107] In this embodiment, for each layer of the graph The system performs node embedding encoding to generate a preliminary node representation. The process integrates static device attributes with dynamic traffic statistics. The static device attributes include device manufacturer, operating system type and version, list of known open ports, and asset tags. These static attributes are concatenated and then encoded using MLP to form static embeddings. Dynamic traffic statistics are calculated within the time window or protocol context corresponding to the current layer, including: number of inbound / outbound connections, total number of communication bytes and packets, destination IP entropy, proportion of communication on high-risk ports, protocol distribution vector, and whether it is the first communication. These dynamic traffic statistics are then normalized to form a dynamic feature vector. Static and dynamic features are concatenated, and the initial node representation within the layer is obtained through a linear transformation. , This is a vector concatenation operation; Initial embeddings are performed for nodes in layer l. Then, a Graph Convolutional Network (GCN) is used to perform message passing independently for each layer of the graph: ,in Let L be the set of neighbors of node i in the l-th layer graph, where i is the node index and L is the number of layers. Let be the learnable weight matrix for the graph convolution of the l-th layer; AGGREGATE is a function for aggregating neighbor information; it can be a mean, max, or LSTM aggregator. This is the ReLU activation function.

[0108] S103: Aggregate multi-layer graph information through a spatiotemporal attention mechanism to generate device behavior representation vectors with context awareness capabilities.

[0109] In this embodiment, to fuse information from multiple heterogeneous graphs, the system introduces a spatio-temporal attention mechanism to perform spatio-temporal attention on the embeddings of each layer. Weighted aggregation is performed. Cross-protocol layer weighting is based on spatial attention, meaning different protocol layers contribute differently to risk assessment (e.g., L7 layer is more sensitive to web vulnerabilities). The system calculates the importance weight for each layer: Where k is the layer index; , , These are learnable parameters; specifically, For the learnable projection matrix of the attention mechanism; This is the attention projection bias term; This is the attention query vector.

[0110] Weighting across time windows is performed based on a time attention mechanism. If soil layers are divided by time, a time decay factor is further introduced, assuming the time offset corresponds to layer l. ( (where is the number of seconds since the current time), then the time decay weight is... Where λ > 0 is the attenuation coefficient, with a default value of 0.001. Then, combining spatial and temporal weights, the normalized spatiotemporal attention coefficient is calculated: , The final device behavior representation vector is a weighted sum: Final device behavior representation vector It also captures the consistency of device behavior across different protocol layers, the temporal evolution trend of behavior, and the joint semantics of static identity and dynamic interaction. For example, the embedding dimension... ,in For static embedding dimensions; For dynamic feature dimensions; This is the initial embedding dimension; Output dimension for GNN.

[0111] S20: Input the behavioral feature vector into the pre-trained abnormal behavior detection model to identify suspicious asset nodes that deviate from the normal behavior baseline and generate a high-risk asset candidate set.

[0112] In this embodiment, a two-stage anomaly detection architecture is adopted: the first stage is unsupervised anomaly scoring, using a VAE model pre-trained on historical normal traffic. The VAE encoder is a 3-layer MLP (512→256→64), and the decoder is symmetrical. The input is... The output reconstructed vector is The expression for abnormal scores is: The second stage is the semi-supervised screening stage: by introducing a small number of labeled anomalous samples, a lightweight One-Class SVM is trained, using the VAE reconstruction error and the original feature subset as input, and outputting the final anomalous probability. ∈[0, 1]. The threshold setting adopts the dynamic percentile method: All satisfied The node is added to the high-risk asset candidate set C, along with an explanation of its top-k anomalous behavior, such as "47 new IPs were connected outward in the past 5 minutes, with an entropy value of 5.2".

[0113] S30: For a high-risk asset candidate set, invoke the automated simulation attack engine to dynamically generate multi-dimensional attack payloads that match the protocol characteristics of suspicious asset nodes, and perform targeted penetration testing.

[0114] In this embodiment, a protocol context descriptor is constructed for each asset in the high-risk asset candidate set C. The context descriptor includes the application layer protocol, banner string, TLS fingerprint, and known service version. Based on the context descriptor, the attack engine retrieves matching probe templates from the payload knowledge base. The knowledge base is stored in a YAML structure, and each template contains an identifier, template name, variable placeholders in the template, default values ​​of the variable placeholders, formatting instructions, conditional logic, loop / repetition structures, descriptions, or comments, etc. The attack engine supports probe, exploit, and obfuscation payload types. All attack tasks are managed by a distributed scheduler (such as Celery + Redis), which limits the number of concurrent requests and records complete request and response logs for auditing.

[0115] Specifically, in step S30, the automated simulation attack engine dynamically generates multi-dimensional attack payloads, including:

[0116] S301: Based on protocol fuzz testing, perform syntax and semantic mutations on the protocol stack used by the open ports of the target asset to generate probe payloads that cover boundary conditions, abnormal fields and private extensions.

[0117] In this embodiment, protocol fuzzing is a black-box / grey-box testing technique that discovers potential vulnerabilities by sending a large number of non-standard, malformed, or boundary-value-constructed protocol data packets to the target service, triggering unhandled exceptions. The protocol stack refers to the application-layer protocol implementation running on a specific port of the target asset; syntax variation modifies the format structure of protocol fields; semantic variation maintains the validity of the protocol syntax but changes the semantic logic. Private extensions are vendor- or user-defined protocol fields or commands.

[0118] Specifically, the corresponding protocol specification model is first loaded based on the device fingerprint recognition results, defining the protocol state machine, message format, legal value range, and vendor-specific fields. The asset detection system also incorporates a multi-dimensional mutation rule library, including boundary value mutation, buffer overflow inducement, field missing / duplicate, encoding obfuscation, and private command injection. For example, boundary value mutation involves setting integer fields to 0, -1, MAX_INT, or MAX_INT+1; buffer overflow inducement involves filling string fields with excessively long random bytes; field missing / duplicate includes deleting required headers or repeating the same field multiple times; encoding obfuscation includes URL encoding, Unicode escaping, and Base64 nesting; and private command injection includes attempting undocumented API paths or methods.

[0119] The payload generation process includes: for each target port, the engine executes:

[0120] Step 1: Generate a set of basic valid requests (used to establish a session);

[0121] Step 2: Apply the above mutation rules to each variable field to generate N sets of probe payloads (N≈50–200, configurable).

[0122] Step 3: Attach expected response characteristics to each load group (e.g., "If a 500 error is returned and contains 'stacktrace', it may be an RCE").

[0123] S302: Combining reinforcement learning strategies, using vulnerability exploitation success rate and resource consumption as reward functions, optimizes attack path selection and payload combination.

[0124] In this embodiment, reinforcement learning (RL) is a machine learning paradigm in which an agent learns strategies to maximize cumulative rewards by interacting with the environment. An attack path refers to a sequence of actions from initial probing to final exploitation, such as first probing a web path, then attempting file inclusion, and finally command execution. Resource consumption includes system overhead such as network bandwidth, CPU time, and the number of concurrent connections.

[0125] Specifically, in an automated simulated attack engine, the attack agent interacts with the target environment to select attack actions. ∈A (such as load type, path, parameter combination) to maximize long-term cumulative reward. The strategy optimization objective expression is as follows: Where π represents the attack strategy, namely the payload generation and path selection strategy; Let be the reward function, where ∈[0,1] represents an attack action. The success rate of vulnerability exploitation is obtained from the sandbox pre-execution feedback; ≥0 indicates the system resources consumed in performing this action. These are the weighting coefficients. ∈(0,1] is the discount factor; T is the maximum step size of the attack session.

[0126] S303: Pre-execute the attack payload in an isolated sandbox environment, verify its security and effectiveness, and then send it to the real target.

[0127] In this embodiment, a virtual machine such as QEMU is used to clone a digital twin of the target asset, including the same OS image, the same service version, and the same network configuration.

[0128] Specifically, for each attack payload p to be sent, a copy of the target service is first deployed in a sandbox. The attack payload p is then executed, and service availability, side effects, and response characteristics are monitored. Service availability includes whether the service crashes, restarts, or refuses new connections. Side effects include whether files are written to, configurations are modified, or external C2 connections are established. Response characteristics include whether expected vulnerability evidence is returned. If any of the following conditions are met: the service process exits and cannot automatically recover, a write operation is triggered, or an external connection to a non-whitelisted IP is established, the attack payload is rejected from being sent to the real target.

[0129] The validity determination rules include: Validity is determined by a response pattern observed in the sandbox that is consistent with the vulnerability knowledge graph. Invalidity is determined by no response, a general error, or protection blocking; Suspiciousness is determined by a response delay > 5 seconds, which must be marked as "requires manual review".

[0130] S40: Based on the response results of penetration testing, combined with vulnerability knowledge graphs and expert rule bases, perform dynamic multi-indicator assessments of suspected vulnerabilities. These multi-indicators include actual risk level, propagation capability, scope of impact, remediation difficulty, and degree of business impact.

[0131] In this embodiment, the vulnerability knowledge graph is a structured semantic network that organizes security entities such as vulnerabilities, products, versions, and attack patterns, as well as their interrelationships, in the form of a graph database. The core entity node types include CVE, Product, Version, CWE, and Exploit, and the core relationship edge types include AFFECTS, HAS_VERSION, BELONGS_TO_CWE, HAS_CVSS, EXPLOIT_AVAILABLE, and RUNS_ON. The expert rule base is implemented using the Drools rule engine and is a set of business logic rules written by security experts to map raw penetration test evidence into risk semantics. The business logic rules include rule structure and fact objects. The rule structure includes rule identifier, trigger condition part, and action part. The penetration test response is parsed to extract verification evidence such as successful regular expression matching, sudden increase in response time, and connection being RST. Then, the vulnerability knowledge graph and expert rule base are queried, and quantitative indicators of five dimensions, namely actual risk level, propagation capability, scope of impact, remediation difficulty, and business impact degree, are calculated and normalized to [0, 1].

[0132] For example, the calculation logic for the actual risk level R1 is as follows: if there is direct evidence of exploitation, a value of 1.0 is assigned; if only version matching is used, a value of 0.4 is assigned. The propagation capability R2 is defined according to the CWE type; for example, worm-like (e.g., 119) is assigned a value of 1.0; requiring certification, it is assigned a value of 0.3. The scope of impact R3 = min(1.0, number of affected assets / 100). The difficulty of remediation R4 is assigned a value of 0.2 when there is an official patch and no restart is required; without a patch, it is assigned a value of 1.0. The degree of business impact is derived from the CMDB; the core transaction system is assigned a value of 1.0; the test environment is assigned a value of 0.3.

[0133] In this embodiment, in step S40, the dynamic evaluation of multiple indicators is implemented through a deep Q-network, including:

[0134] S401: Construct an action library for selecting evaluation metrics, where each action corresponds to a combination of at least two evaluation metrics.

[0135] In this embodiment, during the multi-indicator vulnerability assessment phase, the system selects an action library from the assessment indicators. Select the optimal action m*, where each action m* corresponds to a set of evaluation indicators (such as {risk level, transmission capability}).

[0136] S402: Define a vulnerability assessment reward function that takes into account the degree of risk reduction, the effectiveness of propagation control, the degree of business impact, and resource consumption.

[0137] S403: Utilizes a deep Q network to select the optimal evaluation action from the action library based on the current vulnerability type and context information, and outputs a multi-indicator fusion evaluation result after execution.

[0138] In this embodiment, the deep Q-network outputs the expected cumulative reward for each action, and the optimal action is selected as follows:

[0139] Where state s encodes the current vulnerability context, and the Q-value function is defined as: ,in These are quantitative scores for the degree of risk reduction, the effectiveness of communication control, the degree of business impact, and resource consumption, respectively. The dynamic weights are ≥0 and can be adjusted according to the vulnerability type or time. The final output multi-index fusion evaluation result is as follows: Confidence score after mapping.

[0140] S50: Generate vulnerability confidence scores based on the assessment results, mark vulnerabilities with confidence scores higher than a preset threshold as real vulnerabilities, and output a structured vulnerability report.

[0141] In this embodiment, the preset threshold is a dynamic threshold with a default value of 0.70, a value of 0.60 in high-sensitivity mode, and a value of 0.80 in low-false-report mode. The structured vulnerability report is a structured report conforming to the CSAF (Common Security Advisory Framework) standard, which includes vulnerability identifier, asset fingerprint, verification evidence, five-dimensional assessment details, remediation suggestions, confidence score, and judgment criteria.

[0142] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0143] In one embodiment, an asset vulnerability detection device is provided, which corresponds to the asset vulnerability detection method in the above embodiments.

[0144] The asset vulnerability detection device includes an asset discovery module, a scan scheduling module, a device fingerprinting module, and a vulnerability detection module. Detailed descriptions of each functional module are as follows:

[0145] The asset discovery module is used to actively scan the target network segment by sending multi-protocol probe packets to obtain a first asset set; and to passively monitor network traffic to extract asset feature information to obtain a second asset set, and to generate an asset list based on the first and second asset sets.

[0146] The scan scheduling module is used to distribute and schedule port scanning tasks of each asset to multiple scan nodes in parallel based on the asset list. It also combines a port scanning optimization model based on risk prediction to perform dynamic port scanning in descending order of risk severity probability and construct a full port risk map.

[0147] The vulnerability detection module is used to perform vulnerability detection based on the asset feature information and / or the dimensions matched by the asset list; the dimensions include a static layer and a dynamic layer; the static layer matches known vulnerabilities based on a dynamically updated full port risk map; the dynamic layer identifies suspicious behaviors that deviate from the normal behavior baseline through anomaly detection algorithms, and obtains asset vulnerability detection results by combining cross-validation.

[0148] For specific limitations regarding the asset vulnerability detection device, please refer to the limitations of the asset vulnerability detection method mentioned above, which will not be repeated here. Each module in the above asset vulnerability detection device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in the processor of the computer device in hardware form or independent of it, or it can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0149] In one embodiment, a computer device is provided, which may be a server. The computer device includes a processor, memory, a network interface, and a database connected via a system bus. When the processor executes a computer program, it implements the steps of the asset vulnerability detection method described above. The processor of the computer device provides computational and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores protocol fuzzing parameters, reinforcement learning strategies, etc. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the asset vulnerability detection method.

[0150] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the asset vulnerability detection method described above.

[0151] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Furthermore, any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory.

[0152] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0153] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An asset vulnerability detection method, characterized in that, include: The first asset set is obtained by actively sending multi-protocol probe packets to scan the target network segment; By passively monitoring network traffic, asset characteristic information is extracted to obtain a second asset set, and an asset list is generated based on the first asset set and the second asset set; Based on the asset list, the port scanning tasks of each asset are distributed and scheduled in parallel to multiple scanning nodes. Combined with the port scanning optimization model based on risk prediction, dynamic port scanning is performed in descending order according to multiple preset key elements, and a full port risk map is constructed. Vulnerability detection is performed by selecting at least one dimension that matches the asset feature information, the asset list, and / or the response data from port scanning; the dimension includes a static layer and a dynamic layer; the static layer matches known vulnerabilities based on a dynamically updated full port risk map; The dynamic layer identifies suspicious behaviors that deviate from the normal behavior baseline through anomaly detection algorithms, and obtains asset vulnerability detection results by combining cross-validation.

2. The asset vulnerability detection method according to claim 1, characterized in that, The construction of the full port risk map includes: Based on the asset list, collect system logs and network traffic data for each asset; Based on the process startup records and port binding information in the system log, as well as the abnormal communication sources, destination ports and data packet characteristics in the network traffic data, non-standard ports or dynamically allocated ports not covered by port scanning are mined through preset association rules to obtain ports to be scanned. The ports to be scanned are added to the supplementary scan task, and the full port risk map is updated in combination with the historical port scan results to eliminate port scan blind spots.

3. The asset vulnerability detection method according to claim 1, characterized in that, The implementation of the port scan optimization model for risk prediction includes: Construct a port risk feature matrix that includes protocol type risk coefficient, historical vulnerability density, service version vulnerability index, and network topology sensitivity parameters; The port risk feature matrix is ​​trained using the LightGBM algorithm to obtain the port scanning optimization model. The top-K key features are selected and retained based on the feature importance evaluation results, where K is greater than or equal to 15. The features of the port to be scanned are input into the port scanning optimization model to obtain the corresponding risk prediction probability; when the risk prediction probability is greater than the preset dynamic risk threshold, an emergency scan is triggered; otherwise, the ports are prioritized and scheduled in descending order of risk prediction probability.

4. The asset vulnerability detection method according to claim 1, characterized in that, After obtaining the asset list, the method further includes: Based on historical traffic logs and real-time network behavior data of the target network segment, a time-series graph model of network behavior is constructed using a graph neural network, and behavioral feature vectors of device nodes are extracted. The behavioral feature vectors are input into a pre-trained abnormal behavior detection model to identify suspicious asset nodes that deviate from the normal behavior baseline and generate a high-risk asset candidate set. For the high-risk asset candidate set, an automated simulation attack engine is invoked to dynamically generate multi-dimensional attack payloads that match the protocol characteristics of the suspicious asset nodes, and targeted penetration testing is performed. Based on the response results of the penetration test, combined with the vulnerability knowledge graph and expert rule base, the suspected vulnerabilities are dynamically evaluated by multiple indicators, including the actual risk level, propagation capability, scope of impact, remediation difficulty, and degree of business impact. Based on the evaluation results, a vulnerability confidence score is generated, and vulnerabilities with a confidence score higher than a preset threshold are marked as real vulnerabilities, and a structured vulnerability report is output.

5. The asset vulnerability detection method according to claim 4, characterized in that, The method of constructing a time-series graph model of network behavior using a graph neural network includes: A multi-layered heterogeneous graph structure is constructed using network devices as nodes and communication sessions as edges, where each layer corresponds to a different protocol level or time window. Each layer of the graph structure is encoded by node embedding, and the static attributes of the device and the dynamic traffic statistics features are integrated. By aggregating multi-layer graph information through a spatiotemporal attention mechanism, a device behavior representation vector with context awareness is generated.

6. The asset vulnerability detection method according to claim 4, characterized in that, The automated attack simulation engine dynamically generates multi-dimensional attack payloads, including: Based on protocol fuzz testing, the protocol stack used by the open ports of the target asset is subjected to syntactic and semantic mutations to generate probe payloads that cover boundary conditions, abnormal fields and private extensions. By combining reinforcement learning strategies and using vulnerability exploitation success rate and resource consumption as reward functions, the attack path selection and payload combination are optimized. The attack payload is pre-executed in an isolated sandbox environment to verify its security and effectiveness before being sent to a real target.

7. The asset vulnerability detection method according to claim 4, characterized in that, The multi-index dynamic evaluation is implemented through a deep Q-network, including: Construct an action library for selecting evaluation indicators, with each action corresponding to a combination of at least two evaluation indicators; Define a vulnerability assessment reward function that comprehensively considers the degree of risk reduction, the effectiveness of propagation control, the degree of business impact, and resource consumption. Using a deep Q-network, the optimal evaluation action is selected from the action library based on the current vulnerability type and context information. After execution, the multi-indicator fusion evaluation result is output.

8. An asset vulnerability detection device, characterized in that, The device includes: The asset discovery module is used to obtain a first asset set by actively sending multi-protocol probe packets to scan the target network segment; to obtain a second asset set by passively monitoring network traffic and extracting asset feature information; and to generate an asset list based on the first asset set and the second asset set. The scanning scheduling module is used to distribute and schedule the port scanning tasks of each asset to multiple scanning nodes in parallel based on the asset list, and combine it with the port scanning optimization model based on risk prediction to perform dynamic port scanning in descending order of risk severity probability, and construct a full port risk map. The vulnerability detection module is used to select a dimension that matches at least one of the asset feature information, the asset list, and / or port scan response data for vulnerability detection; the dimension includes a static layer and a dynamic layer; the static layer matches known vulnerabilities based on a dynamically updated full port risk map; the dynamic layer identifies suspicious behaviors that deviate from the normal behavior baseline through anomaly detection algorithms, and obtains asset vulnerability detection results by combining cross-validation.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the asset vulnerability detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the asset vulnerability detection method as described in any one of claims 1 to 7.

Images