A method and apparatus for accelerating port fingerprint scanning

Abstract

This invention discloses a method and apparatus for accelerating port fingerprint scanning, relating to the field of network security technology. The method includes: establishing a complete TCP connection with the target port; sending application-layer probe data and performing streaming fingerprint matching within a first timeout period; if a match is unsuccessful, actively closing the write direction of the TCP connection, entering a half-closed state, and continuing streaming matching of the response data returned by the server in this state within a second timeout period; and determining the service fingerprint based on the matching result. Furthermore, an intelligent half-connection scanning strategy is proposed, dynamically selecting between half-closed and full-connection scanning modes based on probe attributes. This invention utilizes the TCP half-closed state to break server read blocking, effectively inducing it to return more fingerprint information, significantly improving the efficiency of port fingerprint recognition while maintaining a high detection rate.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for accelerating port fingerprint scanning. Background Technology

[0002] Port scanning is a core technology in the field of cybersecurity. It is not only the first step for attackers to discover potential attack surfaces, but also the foundation for defenders to conduct asset management and risk self-assessment. A complete port scanning process typically includes two core stages: port activation detection and service fingerprinting. With the advent of high-speed scanners, the efficiency of port activation detection has been greatly improved, and the bottleneck is mainly concentrated in the service fingerprinting stage.

[0003] Current mainstream port fingerprinting technologies are primarily based on TCP full-connection scanning. In this mode, after establishing a complete TCP connection with the target port, the scanner sends specific application-layer probe data, then waits for and receives the server's response. The response content is then parsed to match a pre-built fingerprint database to identify the service type. To improve efficiency, existing technologies generally employ two strategies: one is to send simplified probes, but this method has poor universality and is only effective for a few services; the other is to significantly increase the number of concurrent threads to process multiple connections in parallel, but this already approaches the limits of hardware and network resources, leaving limited room for improvement and leading to significant resource consumption and increased costs.

[0004] Furthermore, another technical drawback of existing technologies is that many network services enter a read-blocking state after receiving probe data, waiting to receive the complete request data or until an internal timeout mechanism is triggered before returning valid response data. Scanners often need to wait a relatively long fixed timeout after sending probes to ensure sufficient response data can be collected for identification. This passive waiting, reliant on the server's own logic, results in significant wasted time, severely hindering the efficiency of large-scale asset mapping and rapid attack surface discovery.

[0005] Therefore, there is an urgent need for an innovative port fingerprint acceleration scanning method that can fundamentally reduce the waiting time of a single probe while maintaining recognition accuracy, break through the ceiling of existing concurrent optimization modes, and achieve a substantial leap in scanning efficiency. Summary of the Invention

[0006] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a port fingerprint accelerated scanning method and apparatus, which aims to break the read blocking of the server application by actively intervening in the TCP connection state and inducing it to return feature data in advance, thereby significantly improving the port fingerprint recognition speed without significantly affecting the detection rate.

[0007] In a first aspect, the present invention provides a port fingerprinting acceleration scanning method, comprising the following steps: establishing a TCP connection between a local port and a target port; sending application layer probe data to the target port and waiting for parallel streaming matching response data within a first preset timeout period; if no valid fingerprint is matched, closing the write direction of the TCP connection, causing the TCP connection to enter a half-closed state; and continuing to wait for parallel streaming matching of the response data returned by the target port in the half-closed state within a second preset timeout period, and determining the service fingerprint of the target port based on the matching result.

[0008] A second aspect of the present invention also provides a port fingerprint accelerated scanning method, comprising: assigning different priorities to different probes in a probe fingerprint library based on historical port fingerprint scanning data, and periodically reordering them; acquiring multiple probes and probe attributes for a target port, and selecting the probe with the highest priority for port fingerprint scanning; wherein, the probe attribute includes a scanning mode identifier, the scanning mode identifier being used to indicate whether a TCP half-closed scanning mode or a TCP full-connection scanning mode is used for the probe; if the scanning mode identifier of the probe attribute indicates that a TCP half-closed scanning mode is used for the probe, then the aforementioned port fingerprint accelerated scanning method is executed; if the scanning mode identifier of the probe attribute indicates that a TCP full-connection scanning mode is used for the probe, then after establishing a TCP connection with the target port, waiting for and streaming matching response data within a third preset timeout period, and if no valid fingerprint is matched, then closing the TCP connection.

[0009] A third aspect of the present invention also provides a port fingerprinting acceleration scanning device, comprising: a first module for establishing a TCP connection between a local port and a target port; a second module for sending application layer probe data to the target port and waiting for parallel streaming matching response data within a first preset timeout period, and if no valid fingerprint is matched, closing the write direction of the TCP connection to make the TCP connection enter a half-closed state; and a third module for continuing to wait for parallel streaming matching of the response data returned by the target port in the half-closed state within a second preset timeout period, and determining the service fingerprint of the target port based on the matching result.

[0010] A fourth aspect of the present invention also provides a port fingerprint accelerated scanning device, comprising: a probe priority processing module, configured to assign different priorities to different probes in a probe fingerprint database based on historical port fingerprint scanning data, and periodically reorder them; a probe selection module, configured to acquire multiple probes and probe attributes for a target port, and select the probe with the highest priority for port fingerprint scanning; wherein, the probe attribute includes a scanning mode identifier, the scanning mode identifier being used to indicate whether a TCP half-closed scanning mode or a TCP full-connection scanning mode is used for the probe; a half-closed policy execution module, configured to execute one of the port fingerprint accelerated scanning methods if the scanning mode identifier of the probe attribute indicates that a TCP half-closed scanning mode is used for the probe; and a full-connection policy execution module, configured to wait for and stream match response data within a third preset timeout period after establishing a TCP connection with the target port if the scanning mode identifier of the probe attribute indicates that a TCP full-connection scanning mode is used for the probe, and close the TCP connection if no valid fingerprint is matched.

[0011] The present invention provides a port fingerprint accelerated scanning method and apparatus, which has the following beneficial effects:

[0012] (1) In response to the bottleneck of scanning efficiency caused by passive waiting of TCP connection, the first method was to actively send FIN packets to trigger TCP half-close state, forcibly break the server read blocking, change passive waiting timeout to active trigger response, solve the problem of invalid waiting, and significantly shorten the single probe time.

[0013] (2) An intelligent hybrid scanning scheduling strategy is proposed. By pre-setting scanning mode identifiers, semi-closed or fully connected modes are dynamically selected for different probes, achieving a balance between efficiency and accuracy.

[0014] (3) To address the problem of blind probe selection, dynamic priority scheduling is performed based on historical data and runtime context. The probe priority arrangement rules, such as default port priority enhancement, associated fingerprint priority enhancement, and TLS mode filtering, are integrated to achieve accurate resource allocation and scanning path optimization.

[0015] (4) Combining streaming matching technology, the response data is analyzed in real time and incrementally, which effectively reduces the unnecessary delay after identification and forms a complete acceleration engine in conjunction with the semi-closed strategy. Attached Figure Description

[0016] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0017] Figure 1 This is a flowchart illustrating the port fingerprint accelerated scanning method provided in Embodiment 1 of this application;

[0018] Figure 2 This is a schematic flowchart of the port fingerprint accelerated scanning method provided in Embodiment 2 of this application;

[0019] Figure 3 This is a schematic diagram of the port fingerprint accelerated scanning device provided in Embodiment 3 of this application;

[0020] Figure 4 This is a schematic diagram of the port fingerprint accelerated scanning device provided in Embodiment 4 of this application;

[0021] Figure 5 This is a schematic diagram of the structure of the electronic device provided in Embodiment 5 of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Example 1

[0024] This invention provides a method for accelerating port fingerprint scanning based on TCP half-close. After establishing a TCP connection and sending a probe, this method actively sends a FIN packet to the server, placing the TCP connection in a half-closed state. This operation utilizes the TCP / IP protocol stack mechanism to transmit an EOF signal to the server process, forcibly releasing any potential read blocking, thereby triggering the server to execute subsequent logic and return feature response data related to the port fingerprint. This significantly reduces waiting time and achieves rapid fingerprint identification.

[0025] It should be noted that the "TCP half-close" in this invention is a completely different concept from "TCP half-connection scanning" in the field of communications. "TCP half-connection scanning" is an active port probing technique where the scanner sends a SYN packet but does not complete a three-way handshake. It determines the port status by the RST packet returned by the target port or by no response. Because a complete TCP connection is not established, the scanning speed is fast but it is easily blocked by firewalls. "TCP half-close," on the other hand, refers to one party in an established TCP connection closing the write-direction data transmission by sending a FIN packet, while keeping the read-direction open. The closing party can still receive data until the other end also closes the connection.

[0026] Therefore, this invention closes the data transmission in the write direction on the basis of an established complete TCP connection, and only retains the listening on the port. The operation of closing the write direction is equivalent to no longer simply waiting, but making a fake action to the server. This fake action will trigger the server to make more specific reactions related to the port fingerprint, thereby greatly shortening the waiting time and significantly improving the efficiency of port fingerprint recognition.

[0027] See Figure 1 The port fingerprint accelerated scanning method of this embodiment includes the following steps:

[0028] Step S101: Establish a TCP connection between the local machine and the target port.

[0029] In this step, the system's port fingerprint scanner (hereinafter referred to as the "scanner") initiates a TCP three-way handshake to the specified port of the target host, attempting to establish a complete TCP connection. This step may include retry logic (e.g., a maximum of 2 retries) and connection timeout settings (e.g., 3 seconds). If the connection establishment fails, the fingerprinting of that port is skipped.

[0030] Step S102: Send application layer probe data to the target port, and wait for and stream match response data within a first preset timeout period. If no valid fingerprint is matched, close the write direction of the TCP connection, so that the TCP connection enters a half-closed state.

[0031] Specifically, after a TCP connection is successfully established, the scanner sends pre-defined application-layer probe data through that connection. Probe data refers to network packet payloads that simulate the behavior of a client for a specific protocol, such as HTTP GET requests, SSL / TLSClientHello messages, SSH protocol version negotiation strings, etc., rather than TCP layer control packets (such as SYN and FIN).

[0032] After the probe data is sent, the scanner starts the first preset timeout timer (e.g., T1 = 500 milliseconds) and enters a waiting state. Simultaneously, the scanner activates its streaming fingerprint matching engine. This engine continuously listens for the response data stream from the target port. Streaming matching means that the matching process is incremental and real-time; that is, each new data packet or byte received is immediately partially matched against all fingerprint rules that have not yet been excluded.

[0033] If the received data sequence fully meets the matching conditions of a certain fingerprint rule (e.g., contains a specific keyword or conforms to a specific byte pattern), the engine immediately determines that the match is successful. This step aims to capture services that respond quickly to the probe and have obvious characteristics. Setting a short first preset timeout timer T1 (e.g., 500ms) is an empirical value based on a large number of experiments, which can quickly identify friendly services in most cases, while avoiding slowing down the overall scanning speed due to excessive waiting time. If a match is successful at this stage, there is no need to enter the subsequent more time-consuming semi-closed process, achieving optimal time overhead for fast-responding services.

[0034] If no valid fingerprint is matched within the first preset timeout T1, and the streaming matching engine determines, based on the currently received data, that other fingerprint rules still have the potential to match (i.e., the current data has not yet caused these rules to be ultimately excluded), the scanner decides to enter the half-close scanning phase. In the half-close scanning phase, the scanner actively performs the operation of closing the TCP connection in the write direction. Specifically, the scanner calls the system API, which causes the local operating system to send a FIN packet to the peer (target service). According to the TCP protocol specification, the end sending the FIN packet indicates that it has no more data to send, but can still continue to receive data. At this time, the local TCP connection state will enter the FIN_WAIT_1 state (i.e., the active closing party enters this state after sending the FIN packet, waiting for the peer's ACK confirmation), and may then transition to the FIN_WAIT_2 state (i.e., the active closing party enters this state after receiving the peer's ACK confirmation for the FIN, waiting for the peer to send a FIN packet), thus entering the TCP half-close state.

[0035] The core innovation of this invention is port scanning in a half-closed state. Its technical principle lies in actively intervening in the TCP communication state to break the server-side blocking. Many network services, especially those based on simple socket programming or using blocking I / O models, wait to receive client data on recv() or read() system calls. When the probe data sent by the scanner is short or does not fully meet the service's expectations, the service process may remain blocked on read calls because it has not read the expected end-of-file marker, fixed-length data, or specific protocol instructions. In this embodiment, the scanner sending a FIN packet causes the server's TCP stack to pass an end-of-file (EOF) indication to the socket. For a service process blocked in a read operation, receiving EOF means that the other end has closed the connection and there is no more data to read. The read call will immediately return (usually returning 0 or an error code), thus unblocking the process and allowing it to continue executing its subsequent logic code. This is equivalent to the scanner politely informing the server that it has finished speaking in a manner specified by the protocol, thereby forcibly waking the server from meaningless waiting, thus providing a direct and effective mechanism to solve the technical problem of "long wait caused by read blocking".

[0036] Step S103: Within the second preset timeout period, continue to wait and stream match the response data returned by the target port in the half-closed state, and determine the service fingerprint of the target port based on the matching result.

[0037] Specifically, after entering the half-closed state, the scanner starts a second preset timeout timer (e.g., T2 = 2500 milliseconds). During this time period, the scanner continues to listen for and match data from the target port through the streaming matching engine. The data received at this time is the response generated by the server process after being woken up from read blocking and executing its subsequent logic. The streaming matching engine seamlessly connects the incomplete matching data stream received in step S102 with the newly received data stream in this step, performing a complete matching as a continuous byte stream. This design ensures that even if the service woken up after the half-closed state sends response packets multiple times, its complete response can still be correctly identified.

[0038] This step, by carefully setting a second preset timeout timer T2, provides the awakened service with sufficient but limited time to complete its internal processing and return feature data. Compared to traditional fully connected scanning, which requires waiting for a longer total timeout covering the worst-case scenario, this invention significantly reduces aimless, blind waiting time by decomposing the waiting phase (i.e., T1 active probing and T2 half-close induction) and precisely controlling the start of T2 after triggering the server-side action (i.e., sending FIN), thus achieving precise allocation of waiting time. Experiments show that for a large number of services, although the total time of T1 and T2 may be the same as or similar to the fully connected timeout, because the T2 phase is the effective induction period, actual fingerprint matching success often occurs in the early stages of T2, resulting in a significant reduction in average waiting time.

[0039] Step S104: If a valid fingerprint is matched within the second preset timeout period, an RST message is actively sent to close the TCP connection.

[0040] Specifically, if the streaming matching engine successfully matches a valid service fingerprint at any point in step S102 or S103, the scanner immediately records the fingerprint result. Subsequently, in order to quickly release system resources, the scanner proactively sends an RST message to the target port, forcibly and immediately terminating the TCP connection. If no valid fingerprint is matched after the entire process of the first preset timeout T1 and the second preset timeout T2 has ended, the scanner also sends an RST message to close the connection and marks the port fingerprint recognition as failed or unknown.

[0041] Example 2

[0042] See Figure 2 This embodiment provides an intelligent scheduling method for accelerating port fingerprint scanning. This method is an optimization and extension of the method described in Embodiment 1 above, and includes the following steps:

[0043] Step S201: Based on the historical scanning data of port fingerprints, assign different priorities to different probes in the probe fingerprint library and reorder them periodically.

[0044] The system maintains a structured probe fingerprint database. Each probe entry in the database contains not only probe data but also a set of important attributes. One of the key attributes is the scan pattern identifier, which indicates the most suitable or permitted scanning strategy for that probe. The system runs a background task that periodically analyzes historical scan log data and calculates and updates a dynamic priority score for each probe in the probe fingerprint database based on the statistical results.

[0045] The priority sorting rules include:

[0046] Basic rule: Probes corresponding to fingerprints with higher historical detection frequencies are assigned higher priority by default. This step solves the inefficiency problem caused by the average allocation of scanning resources. Through data-driven approaches, the scanner can prioritize trying probes with high hit rates, thus probabilistically reducing the average number of attempts required to find valid fingerprints.

[0047] Default port elevation rule: If the port number of the scanned port matches the default port number of a specific fingerprint, the priority of the probe corresponding to that specific fingerprint is elevated to the highest in this port fingerprint scanning task. This rule leverages common deployment habits of network services, greatly improving the first-round hit rate for standardized deployment services.

[0048] Associative fingerprint enhancement rule: If, during port fingerprint scanning, the identified port fingerprint has a port reuse relationship with another fingerprint, the probe corresponding to that other fingerprint is given the highest priority, and the scanning of other fingerprints is skipped (i.e., other low-priority fingerprints are no longer scanned). This rule solves the recognition efficiency problem in scenarios involving composite services or multiple protocols running on the same port, using context awareness for intelligent inference.

[0049] TLS mode filtering rules: If a port is identified as providing TLS protocol services during port fingerprinting, all probes that do not support TLS scanning mode are skipped, and the fingerprints that were previously scanned in non-TLS scanning mode and support TLS protocol services are re-scanned using probes that support TLS scanning mode.

[0050] Step S202: Obtain multiple probes and probe attributes for the target port, and select the probe with the highest priority for port fingerprint scanning; wherein, the probe attribute includes a scan mode identifier, which is used to indicate whether the probe is scanned in TCP half-closed scan mode or TCP full-connection scan mode.

[0051] Specifically, the scheduling module selects the probe with the highest current priority from the probe list after dynamic sorting in step S201 and reads its probe attributes. The probe attributes include a scan mode identifier, which indicates whether a TCP half-close scan mode or a TCP full-connection scan mode is used for the probe.

[0052] Step S203: If the scanning mode identifier of the probe attribute indicates that the probe is in TCP half-closed scanning mode, then the port fingerprint accelerated scanning method of Embodiment 1 is executed.

[0053] If the scan mode identifier indicates that the probe is scanned in TCP half-close mode, the scheduling module calls the half-close policy execution module to execute the TCP half-close-based port fingerprinting accelerated scanning method as described in steps S101-S104.

[0054] Step S204: If the scanning mode identifier of the probe attribute indicates that the probe adopts the TCP full connection scanning mode, then after establishing a TCP connection with the target port, wait for and stream match response data within a third preset timeout period, and determine the service fingerprint of the target port based on the matching result.

[0055] Specifically, if the probe's scanning mode identifier indicates that a TCP full-connection scan mode is used, the scheduling module calls the full-connection strategy execution module. The execution logic of this module is as follows: First, a TCP connection is established with the target port. Then, the probe's data content is sent, and a third preset timeout timer is started (e.g., T3 = 3000 milliseconds). During this time, the module waits for and stream-matches response data. If a valid fingerprint is matched within T3, an RST message is sent to close the connection and the result is returned. If no match is found after T3 timeout, an RST message is also sent to close the TCP connection, marking the probe as failed. The full-connection mode serves as a safety net, ensuring reliable identification capabilities for services that are not sensitive to half-close, have special response logic, or are not yet included in the half-close adaptation list.

[0056] Furthermore, it also includes step S205: iterative selection or termination of the probe.

[0057] Specifically, regardless of whether the fully connected mode or the half-closed mode is executed, either a fingerprint is matched or the match fails. If a fingerprint is successfully matched, the entire scanning task ends successfully; if the match fails, the scheduling module removes it from the probe list or marks it as attempted, and then selects the next highest priority probe to try, until the probe list is exhausted or a match is successfully achieved.

[0058] Example 2 implements an intelligent scheduling loop, combining pre-sorting based on historical statistics, dynamic adjustment based on runtime context, and pattern splitting based on probe attributes to form a highly adaptive scanning decision system. It ensures that in most cases, the efficient half-closed mode is prioritized for attacking high-probability targets, while seamlessly switching to a robust fully connected mode when necessary. Furthermore, it can optimize subsequent strategies in real time based on acquired information during the scanning process. This maximizes the value of each connection attempt at the system scheduling level and is a key pillar for achieving overall scanning acceleration.

[0059] To provide a deeper understanding of the present invention, the following specific implementation scenario illustrates the implementation process of the present invention:

[0060] Suppose that the intelligent scanning device needs to perform port fingerprint recognition on the target 192.168.1.100:8080.

[0061] (1) Task initialization

[0062] The scheduling module receives the target (192.168.1.100, 8080). It queries the historical priority list, assuming that the probe with the highest global priority is P_http_get, whose scan_mode_flag is marked as HALF_CLOSE.

[0063] (2) Dynamic adjustment of probe priority

[0064] Application runtime rules:

[0065] Rule A: Port 8080 is a common alternative port for HTTP services, therefore all HTTP-related fingerprint probes are temporarily given a higher priority.

[0066] Rule B: Historical data shows that RPC and NFS network protocol services often appear together. If RPC is detected subsequently, the NFS probe will be given higher priority.

[0067] Rule C: There are no historical TLS records currently, so Rule C is not triggered.

[0068] (3) First scan

[0069] Select the probe with the highest current priority, assuming it's still P_http_get, and the mode is HALF_CLOSE. Call the half-closed module to execute:

[0070] 1) Establish a TCP connection with 192.168.1.100:8080;

[0071] 2) Sending the P_http_get probe and waiting for 500ms, during which no response was received, the streaming matching engine failed to determine the port fingerprint type;

[0072] 3) Enter half-close, send FIN, close the write direction, wait 2500ms (T2), the server wakes up from read blocking and sends a complete response including headers such as Server: Apache-Coyote / 1.1. When the streaming matching engine receives the Server header, it successfully matches the HTTP fingerprint. The half-close module immediately sends an RST message to terminate the connection and returns the matching result F_http to the scheduling module.

[0073] 4) The scheduling module receives the successful matching result F_http, and the entire scanning task for 192.168.1.100:8080 is successfully completed.

[0074] The time consumption in this implementation scenario mainly occurs during connection establishment, T1 wait, and part of the T2 wait, which is far less than the situation in traditional methods where a fixed 3-second wait may still yield no results or a very late match. If using traditional full-connection scanning, a fixed 3-second wait is required after sending the same probe to collect a complete response and match, resulting in even longer processing time. If a pure half-closed strategy is used without intelligent scheduling, it may attempt some low-priority non-HTTP probes first, wasting a significant amount of time. This implementation scenario demonstrates the efficient process of intelligent scheduling prioritizing high-probability HTTP probes and combining this with a half-closed mode to quickly trigger and identify HTTP services.

[0075] See Figure 3 In another embodiment of the present invention, a port fingerprint accelerated scanning device 300 is provided, including a communication connection establishment module 301, a half-closed startup module 302 and a half-closed scanning module 303. The port fingerprint accelerated scanning device 300 is capable of executing the port fingerprint accelerated scanning method in Embodiment 1.

[0076] Specifically, the port fingerprint acceleration scanning device 300 includes:

[0077] The communication connection establishment module 301 is used to establish a TCP connection between the local port and the target port;

[0078] The half-closed startup module 302 is used to send application layer probe data to the target port and wait for and stream match response data within a first preset timeout period. If no valid fingerprint is matched, the write direction of the TCP connection is closed, so that the TCP connection enters a half-closed state.

[0079] The half-closed scanning module 303 is used to continue waiting and streaming the response data returned by the target port in the half-closed state within a second preset timeout period, and determine the service fingerprint of the target port based on the matching result.

[0080] It should be noted that the port fingerprint acceleration scanning device 300 provided in this embodiment can be used to execute the technical solution of Embodiment 1. Its implementation principle and technical effects and methods are similar, and will not be repeated here.

[0081] See Figure 4 In another embodiment of the present invention, a port fingerprint accelerated scanning device 400 is provided, including a probe priority processing module 401, a probe selection module 402, a half-closed policy execution module 403, and a fully connected policy execution module 404. The port fingerprint accelerated scanning device 400 is capable of executing the port fingerprint accelerated scanning method in Embodiment 2.

[0082] Specifically, the port fingerprint acceleration scanning device 400 includes:

[0083] The probe priority processing module 401 is used to assign different priorities to different probes in the probe fingerprint library based on the historical scanning data of the port fingerprint, and to reorder them periodically.

[0084] The probe selection module 402 is used to acquire multiple probes and probe attributes for the target port, and select the probe with the highest priority for port fingerprint scanning; wherein, the probe attribute includes a scanning mode identifier, which is used to indicate whether the probe is subjected to TCP half-close scanning mode or TCP full-connection scanning mode.

[0085] The half-closed policy execution module 403 is used to execute a port fingerprint accelerated scanning method as described in the method embodiment if the scanning mode identifier of the probe attribute indicates that the probe is subjected to a TCP half-closed scanning mode; the full-connection policy execution module 404 is used to wait for and stream match response data within a third preset timeout period after establishing a TCP connection with the target port if the scanning mode identifier of the probe attribute indicates that the probe is subjected to a TCP full-connection scanning mode, and determine the service fingerprint of the target port based on the matching result.

[0086] It should be noted that the port fingerprint acceleration scanning device 400 provided in this embodiment can be used to execute the technical solution of Embodiment 2. Its implementation principle and technical effects and methods are similar, and will not be repeated here.

[0087] See Figure 5 Another embodiment of the present invention provides an electronic device 500. This electronic device 500 is used to implement the port fingerprint accelerated scanning method in Embodiments 1 and 2. The electronic device 500 in the embodiments of the present invention may include, but is not limited to, a PC, server, laptop computer, smartphone, tablet computer, etc. Figure 5 The electronic device 500 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0088] like Figure 5 As shown, electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes to implement the methods of embodiments of the present invention according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. Various programs and data required for the operation of electronic device 500 are also stored in RAM 503. The processing device 501, ROM 502, and RAM 503 are interconnected via bus 505. Input / output (I / O) interface 504 is also connected to bus 505.

[0089] Typically, the following devices can be connected to I / O interface 504: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0090] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method of port-fingerprint accelerated scanning, the method comprising: The method comprises the following steps: establishing a TCP connection between a local and a target port; sending application layer probe data to the target port and waiting for and stream matching response data within a first preset timeout period, and if no valid fingerprint is matched, closing the write direction of the TCP connection to make the TCP connection enter a half-closed state; continuing to wait for and stream matching response data returned by the target port in the half-closed state within a second preset timeout period, and determining the service fingerprint of the target port according to the matching result.

2. The method of claim 1, wherein, The step of closing the write direction of the TCP connection comprises: sending a FIN message to the target port to make the local TCP connection enter a FIN_WAIT state.

3. The method of claim 1, wherein, The method further comprises: if a valid fingerprint is matched within the second preset timeout period, actively sending an RST message to close the TCP connection.

4. A method of port-fingerprint accelerated scanning, the method comprising: The method comprises: assigning different priorities to different probes in a probe fingerprint library based on historical scanning data of port fingerprints, and periodically reordering the probes; obtaining a plurality of probes and probe attributes for a target port, and selecting a probe with the highest priority to perform port fingerprint scanning; wherein the probe attribute comprises a scanning mode identifier, and the scanning mode identifier is used to indicate that the probe adopts a TCP half-closed scanning mode or a TCP full connection scanning mode; if the scanning mode identifier of the probe attribute indicates that the probe adopts the TCP half-closed scanning mode, performing the port fingerprint accelerated scanning method according to any one of claims 1-3; if the scanning mode identifier of the probe attribute indicates that the probe adopts the TCP full connection scanning mode, waiting for and stream matching response data within a third preset timeout period after establishing a TCP connection with the target port, and determining the service fingerprint of the target port according to the matching result.

5. The method of claim 4, wherein, The step of assigning different priorities to different probes in the probe fingerprint library comprises: defaulting higher priorities to probes corresponding to fingerprints with higher historical detection frequencies; if the port number of a scanned port matches the default port number of a specific fingerprint, the priority of the probe corresponding to the specific fingerprint is promoted to the highest in the current port fingerprint scanning task; if it is determined based on historical scanning data that the currently detected fingerprint has a port multiplexing relationship with another fingerprint, the priority of the probe corresponding to the other fingerprint is promoted to the highest, and the scanning of other fingerprints is skipped; if it is identified in the port fingerprint scanning process that the port provides a TLS protocol service, all probes that do not support a TLS scanning mode are skipped, and a probe that supports the TLS scanning mode is used to rescan a fingerprint that has been scanned in a non-TLS scanning mode and supports the TLS protocol service.

6. A port-fingerprinting accelerated scanning apparatus, comprising: The method comprises: a communication connection establishing module for establishing a TCP connection between a local and a target port; a half-closed starting module for sending application layer probe data to the target port and waiting for and stream matching response data within a first preset timeout period, and if no valid fingerprint is matched, closing the write direction of the TCP connection to make the TCP connection enter a half-closed state; The semi-close scanning module is configured to continue waiting for and stream-matching response data returned by the target port in the semi-close state within a second preset timeout period, and determine the service fingerprint of the target port according to a matching result.

7. A port-fingerprinting accelerated scanning apparatus as claimed in claim 6, wherein, The semi-close starting module is further configured to: Send a FIN packet to the target port, so that the local TCP connection state enters a FIN_WAIT state.

8. The port-fingerprinting accelerated scanning apparatus of claim 6, wherein, Further comprising: A communication connection closing module configured to actively send an RST packet to close the TCP connection if a valid fingerprint is matched within the second preset timeout period.

9. A port-fingerprinting accelerated scanning apparatus, comprising: Comprising: A probe priority processing module configured to assign different priorities to different probes in a probe fingerprint library based on historical scanning data of port fingerprints, and periodically reorder the probes; A probe selection module configured to obtain a plurality of probes and probe attributes for a target port, and select a probe with the highest priority to perform port fingerprint scanning, wherein the probe attributes include a scanning mode identifier, and the scanning mode identifier is used to indicate that the probe adopts a TCP semi-close scanning mode or a TCP full connection scanning mode; A semi-close strategy execution module configured to perform a port fingerprint acceleration scanning method according to any one of claims 1-3 if the scanning mode identifier of the probe attribute indicates that the probe adopts the TCP semi-close scanning mode; and a full connection strategy execution module configured to wait for and stream-match response data within a third preset timeout period after establishing a TCP connection with the target port if the scanning mode identifier of the probe attribute indicates that the probe adopts the TCP full connection scanning mode, and determine the service fingerprint of the target port according to a matching result.

10. The port-fingerprinting accelerated scanning apparatus of claim 9, wherein, The probe priority processing module is further configured to: Assign a higher priority to a probe corresponding to a fingerprint with a higher historical detection frequency by default; If a port number of a scanned port matches a default port number of a specific fingerprint, the priority of a probe corresponding to the specific fingerprint is promoted to the highest in the current port fingerprint scanning task; If it is determined based on historical scanning data that a currently detected fingerprint has a port multiplexing relationship with another fingerprint, the priority of a probe corresponding to the other fingerprint is promoted to the highest, and scanning of other fingerprints is skipped; If it is identified in the port fingerprint scanning process that a port provides a TLS / SSL protocol service, all probes that do not support a TLS scanning mode are skipped, and a probe that supports the TLS scanning mode is used to rescan a fingerprint that has been scanned in a non-TLS scanning mode and supports the TLS protocol service.

Images