Network asset recommendation method and system based on multi-data-source concurrent fusion

Abstract

The invention provides a network asset recommendation method and system based on multi-data-source concurrent fusion, and relates to the technical field of network security, and the method comprises the steps: determining a plurality of data sources; constructing a concurrent query task to perform asset query on each data source, and generating asset query data; performing multi-dimensional feature extraction on the asset query data to generate an identifier; obtaining a first identifier existing in the asset record in the identifiers, and fusing the asset query data corresponding to the first identifier with the stored asset data to generate fused asset data; obtaining a second identifier which does not exist in the asset record in the identifiers, and creating newly-added asset data corresponding to the second identifier; and calculating a first recommendation coefficient of the fused asset data and a second recommendation coefficient of the newly added asset data, and generating a network asset recommendation result in combination with the first recommendation coefficient and the second recommendation coefficient. The technical effect of the invention is that the asset data processing efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a network asset recommendation method and system based on concurrent fusion of multiple data sources. Background Technology

[0002] With the rapid development of network infrastructure and the deepening of digital transformation, enterprises and organizations face increasingly complex challenges in network asset management. Network assets are diverse, including domain names, IP addresses, port services, and certificate information. This asset data is scattered across different data sources, such as threat intelligence platforms, vulnerability scanning systems, and asset discovery tools. Traditional network asset management methods mainly rely on manual querying and organization, which is inefficient and prone to missing critical information, failing to meet the urgent needs of modern network security management for asset visualization and intelligent recommendations. Therefore, how to achieve automated integration and intelligent recommendation of network assets from multiple data sources has become a crucial technical problem that urgently needs to be solved in the field of network security.

[0003] Existing technologies establish a unified asset management platform, employing data acquisition interfaces to obtain network asset information from various data sources, and achieving centralized storage and retrieval of asset information through data standardization processing. However, due to significant differences in data formats, update frequencies, and access interfaces among different data sources, and the dynamic and massively distributed nature of network asset data, existing technologies generally lack effective data processing mechanisms when handling the integration of assets from multiple data sources, resulting in low asset data processing efficiency. Summary of the Invention

[0004] This application provides a network asset recommendation method and system based on concurrent fusion of multiple data sources to improve asset data processing efficiency.

[0005] Firstly, this application provides a method for recommending network assets based on concurrent fusion of multiple data sources. The method includes: receiving network asset query clues input by a user through a query interface; determining multiple data sources according to the type of the network asset query clues; constructing concurrent query tasks corresponding to each of the data sources; performing asset queries on each of the data sources according to the concurrent query tasks to generate asset query data; extracting multi-dimensional features from the asset query data to generate identifiers for each of the asset query data; obtaining a first identifier that already exists in an asset record from the identifiers; fusing the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate fused asset data; obtaining a second identifier that does not exist in the asset record from the identifiers; creating new asset data corresponding to the asset query data of the second identifier in the asset record; obtaining a first data feature of the fused asset data and a second data feature of the new asset data; calculating a first recommendation coefficient of the fused asset data based on the first data feature; calculating a second recommendation coefficient of the new asset data based on the second data feature; and combining the first recommendation coefficient and the second recommendation coefficient to generate a network asset recommendation result.

[0006] By adopting the above technical solution, and by determining multiple data sources based on the type of network asset query clues and constructing corresponding concurrent query tasks, asset query data can be obtained from multiple data sources simultaneously, significantly improving data acquisition efficiency. By extracting multi-dimensional features from the asset query data to generate identifiers, and using these identifiers to determine whether an asset already exists in the asset record, intelligent identification and deduplication of duplicate assets are achieved. For existing first identifiers, their corresponding asset query data is merged with stored asset data to generate merged asset data, avoiding data redundancy and enriching the completeness of asset information. For non-existent second identifiers, new asset data is created, ensuring timely recording of newly discovered assets. By separately acquiring the first data features of the merged asset data and the second data features of the newly added asset data, and calculating the corresponding first and second recommendation coefficients, differentiated evaluation based on the characteristics of different asset types is achieved. Finally, the network asset recommendation results generated by combining the two recommendation coefficients have higher accuracy and practicality, improving asset data processing efficiency.

[0007] Secondly, this application provides a network asset recommendation system based on concurrent fusion of multiple data sources. The system includes: a receiving module, a construction module, an extraction module, a first acquisition module, and a second acquisition module; wherein... The receiving module is used to receive network asset query clues input by users through a query interface, and determine multiple data sources according to the type of the network asset query clues; the construction module is used to construct concurrent query tasks corresponding to each of the data sources, perform asset queries on each of the data sources according to the concurrent query tasks, and generate asset query data; the extraction module is used to perform multi-dimensional feature extraction on the asset query data and generate identifiers for each of the asset query data; the first acquisition module is used to acquire a first identifier that already exists in the asset record from the identifiers, merge the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate merged asset data; acquire a second identifier that does not exist in the asset record from the identifiers, and create new asset data corresponding to the asset query data of the second identifier in the asset record; the second acquisition module is used to acquire a first data feature of the merged asset data and a second data feature of the new asset data, calculate a first recommendation coefficient of the merged asset data according to the first data feature, calculate a second recommendation coefficient of the new asset data according to the second data feature, and generate network asset recommendation results by combining the first recommendation coefficient and the second recommendation coefficient.

[0008] Thirdly, this application provides an electronic device that adopts the following technical solution: it includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes a computer program such as any of the above-mentioned network asset recommendation methods based on concurrent fusion of multiple data sources.

[0009] Fourthly, this application provides a computer-readable storage medium that employs the following technical solution: storing a computer program capable of being loaded by a processor and executing any of the above-mentioned network asset recommendation methods based on concurrent fusion of multiple data sources.

[0010] In summary, this application includes at least one of the following beneficial technical effects: By identifying multiple data sources based on the type of online asset query clues and constructing corresponding concurrent query tasks, asset query data can be obtained from multiple data sources simultaneously, significantly improving data acquisition efficiency. By extracting multi-dimensional features from asset query data to generate identifiers, and using these identifiers to determine whether an asset already exists in the asset record, intelligent identification and deduplication of duplicate assets are achieved. For existing first identifiers, their corresponding asset query data is merged with stored asset data to generate merged asset data, avoiding data redundancy and enriching the completeness of asset information. For non-existent second identifiers, new asset data is created, ensuring timely recording of newly discovered assets. By separately acquiring the first data features of the merged asset data and the second data features of the newly added asset data, and calculating the corresponding first and second recommendation coefficients, differentiated evaluation based on different asset type characteristics is achieved. Finally, the online asset recommendation results generated by combining the two recommendation coefficients have higher accuracy and practicality, improving asset data processing efficiency. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a network asset recommendation method based on concurrent fusion of multiple data sources provided in an embodiment of this application; Figure 2 This is a schematic diagram of the complete technical implementation architecture of a network asset intelligent recommendation system based on multiple data sources provided in this application embodiment; Figure 3 This is a schematic diagram of the complete execution flow of a network asset intelligent recommendation method based on multiple data sources provided in an embodiment of this application; Figure 4 This is a schematic diagram of the layered storage and data processing architecture of an intelligent recommendation system for network assets provided in an embodiment of this application; Figure 5 This is a schematic diagram of the concurrent processing and load balancing mechanism of an intelligent network asset recommendation system provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a network asset recommendation system based on concurrent fusion of multiple data sources provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0012] Explanation of reference numerals in the attached figures: 1000, electronic device; 1001, processor; 1002, communication bus; 1003, user interface; 1004, network interface; 1005, memory. Detailed Implementation

[0013] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0014] In the description of the embodiments in this application, words such as "illustrative," "for example," or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "illustrative," "for example," or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the use of words such as "illustrative," "for example," or "for example" is intended to present the relevant concepts in a specific manner.

[0015] Figure 1 This is a flowchart illustrating a network asset recommendation method based on concurrent fusion of multiple data sources, as provided in an embodiment of this application. Figure 1 As shown, the method includes S101-S105: S101 receives network asset query clues input by users through the query interface and determines multiple data sources based on the type of network asset query clues.

[0016] The system first receives user-input network asset query clues through a pre-defined query interface. This interface serves as a unified data entry point, enabling standardized processing of query requests from different channels. Network asset query clues refer to key information provided by users for discovering and identifying network assets, including but not limited to domain names, IP addresses, certificate information, ICP filing information, keywords, and other types. Because traditional network asset discovery methods typically rely on a single data source, such as using only a single platform like FOFA or Shodan, the coverage of asset discovery is limited, easily overlooking important assets. Therefore, this invention intelligently matches multiple data sources based on clue type to expand the coverage of asset discovery.

[0017] Upon receiving network asset query leads, the system automatically identifies and analyzes the specific characteristics of the leads. For domain name leads, the system marks them as suitable for domain name resolution data sources, subdomain discovery data sources, and certificate transparency log data sources; for IP address leads, the system associates them with port scanning data sources, geolocation data sources, and threat intelligence data sources; for certificate information leads, the system prioritizes certificate transparency data sources and SSL / TLS configuration detection data sources; for ICP filing information leads, the system matches filing query data sources and enterprise information data sources; and for keyword leads, the system selects full-text search engine data sources and product fingerprinting data sources. This intelligent data source matching mechanism based on lead type ensures that each type of lead receives the most suitable combination of data sources for querying, avoiding the waste of resources caused by blindly querying all data sources.

[0018] In determining multiple data sources, the system also considers factors such as data source availability, response speed, and historical query success rate. The system maintains a dynamic data source status table, recording the health status, API call limits, current load, and data quality assessment results of each data source in real time. When a data source fails or responds slowly, the system automatically adjusts its data source selection strategy, enabling a backup data source or reducing the query priority of that data source to ensure the continuity and stability of query tasks. Simultaneously, the system estimates the computational resources and time costs required for queries based on the complexity of the clues and the expected amount of assets, and rationally allocates resource quotas for concurrent query tasks to prevent system performance degradation due to excessive resource consumption.

[0019] S102, construct concurrent query tasks corresponding to each data source, perform asset queries on each data source according to the concurrent query tasks, and generate asset query data.

[0020] This invention constructs concurrent query tasks from multiple identified data sources to overcome the inefficiency of traditional serial query methods. Traditional network asset query methods employ a serial processing approach, accessing each data source one by one. This method is not only time-consuming but also fails to fully utilize the parallel computing capabilities of modern multi-core processors, severely limiting overall query efficiency and failing to meet the real-time requirements of large-scale network asset discovery. Therefore, this invention adopts a concurrent query architecture based on a lightweight coroutine mechanism, enabling parallel queries on multiple data sources simultaneously, significantly improving data acquisition efficiency.

[0021] The system uses a lightweight coroutine mechanism to create independent concurrent query tasks for each data source. Lightweight coroutines are lightweight threads implemented using Go's goroutine mechanism. Compared to traditional operating system threads, goroutines offer advantages such as lower creation overhead, lower memory consumption, and higher scheduling efficiency. Each concurrent query task corresponds to an independent goroutine execution unit. The system allocates appropriate execution resources and priorities to each task based on the characteristics of the target data source and the query complexity. During task creation, the system synchronously initializes necessary query parameters, including API keys, query string formatting rules, response data parsing templates, and error handling strategies, ensuring that each concurrent query task can independently complete a full query cycle.

[0022] The system simultaneously launches concurrent query tasks via a non-blocking asynchronous communication mechanism. This mechanism utilizes Go's channels to achieve asynchronous data transfer between goroutines. The core advantage of this non-blocking asynchronous communication mechanism is that it avoids the performance bottlenecks and deadlock risks caused by traditional locking mechanisms. Each goroutine can independently execute query operations and transmit the query results to the main control program through a dedicated result channel. The system configures independent result and error channels for each data source query task. The result channel is used to transmit successfully retrieved asset query data, while the error channel is used to transmit exception information and error states encountered during the query process. Simultaneously, the system employs a context mechanism to achieve unified lifecycle management of query tasks, supporting task cancellation, timeout control, and graceful exit. When a query task exceeds the preset timeout or encounters an unrecoverable error, the system can promptly terminate the task and release related resources to avoid affecting the normal execution of other tasks.

[0023] To prevent excessive concurrent query tasks from exhausting system resources, the system employs a semaphore mechanism to precisely control the number of concurrent query tasks. This mechanism maintains a fixed-capacity semaphore pool to limit the number of goroutines executing simultaneously. When system load is high or available resources are insufficient, new query tasks wait in the semaphore pool until idle resources become available. The system dynamically adjusts the semaphore pool size based on factors such as current system load, memory usage, and network bandwidth, maximizing the efficiency of concurrent queries while ensuring system stability. Furthermore, the system implements an intelligent task scheduling strategy, prioritizing data source tasks with fast response times and high query success rates, while placing slower-responding or frequently error-prone data source tasks with lower priority, ensuring optimal overall query performance.

[0024] During execution, each concurrent query task continuously monitors its query status and progress, acquiring asset query data returned by various data sources in real time. Asset query data refers to the raw network asset information obtained from various data sources, including multi-dimensional attribute data such as IP address, domain name, port, service type, certificate information, geographical location, and organizational information. Due to differences in data format and structure returned by different data sources, the system performs standardized data parsing and format conversion processing for each data source, uniformly converting heterogeneous raw data into a standard internal data format. The system also performs preliminary data quality checks during data acquisition, filtering out obviously erroneous or incomplete data records to ensure the data quality of subsequent data fusion processing.

[0025] Based on the above embodiments, as an optional implementation method, in S102, constructing concurrent query tasks corresponding to each data source, and performing asset queries on each data source according to the concurrent query tasks to generate asset query data specifically includes S21-S23: S21 creates independent concurrent query tasks for each data source based on a lightweight coroutine mechanism.

[0026] The system uses a lightweight coroutine mechanism to create independent concurrent query tasks for each data source. Lightweight coroutines are execution units with lower resource consumption and higher concurrency capabilities compared to traditional threads. The system creates an independent goroutine execution unit for each specific data source. Each goroutine is responsible for handling the complete query process for its corresponding data source, including connection establishment, request sending, response reception, and data parsing. This independent task design ensures that the query processes between different data sources do not interfere with each other; if one data source experiences a delay or error, it will not affect the normal query progress of other data sources.

[0027] S22 uses a non-blocking asynchronous communication mechanism to simultaneously launch concurrent query tasks and perform asset queries on various data sources.

[0028] The system simultaneously launches concurrent query tasks to query assets from various data sources using a non-blocking asynchronous communication mechanism. This mechanism, implemented using Go's channels, configures independent result and error channels for each query task, avoiding performance blocking issues caused by traditional synchronous waiting mechanisms. The system uses a unified task scheduler to simultaneously trigger the execution of all goroutines. Each task runs in parallel and asynchronously returns query results through its respective channel. The main control program uses select statements to monitor data returns from multiple channels, achieving true concurrent processing.

[0029] S23 uses a semaphore mechanism to control the number of concurrent query tasks and obtain asset query data returned by each data source.

[0030] The system employs a semaphore mechanism to control the number of concurrent query tasks and retrieve asset query data returned from various data sources. By maintaining a fixed-capacity resource pool, the semaphore mechanism limits the number of goroutines executing simultaneously, preventing excessive concurrency from exhausting system resources and causing performance degradation. When the system detects high load, new query tasks are queued in the semaphore pool, ensuring the system always operates at optimal performance. Simultaneously, the system uses a result aggregator to uniformly collect asset query data returned from various channels and performs preliminary format standardization.

[0031] S103, perform multi-dimensional feature extraction on the asset query data to generate identifiers for each asset query data.

[0032] Because of significant differences in data formats, field naming, and data representation methods among various data sources, the same network asset may appear in different forms in different data sources. For example, IPv6 addresses may use different compression formats, domain names may contain different subdomain levels, and port information may be presented with different protocol identifiers. These differences can lead to the inability to accurately identify duplicate assets during subsequent data fusion, resulting in data redundancy and inconsistency.

[0033] The system first extracts multi-dimensional feature information from the asset query data. This multi-dimensional feature information includes core attributes such as IP address, network protocol, port number, subdomain, and task identifier. The IP address, as the basic identifier of network assets, includes both IPv4 and IPv6 formats and is a key feature distinguishing different network nodes. The network protocol refers to the type of communication protocol the asset uses, such as HTTP, HTTPS, FTP, and SSH, determining the asset's service nature and access method. The port number represents the network port on which the asset provides services and is an important basis for identifying different services under the same IP address. The subdomain refers to the specific domain name information to which the asset belongs, which is particularly important for web-based assets. The task identifier is the unique number of the current query task, used to distinguish asset data generated by different query sessions, ensuring data isolation and traceability. This multi-dimensional feature extraction mechanism can comprehensively capture the core attributes of network assets, laying the foundation for subsequent accurate deduplication and intelligent fusion.

[0034] During feature extraction, the system places particular emphasis on address integrity processing of IP addresses to generate standardized IP addresses. Address integrity processing refers to the process of converting IP addresses of various formats into a unified standard format. For IPv4 addresses, the system removes leading zeros and ensures that dotted decimal notation is used. For IPv6 addresses, the system uses the RFC5952 standard for integrity processing, including padding omitted zeros, standardizing case, and normalizing compression representation. For example, the IPv6 address "2001:0db8::1" will be completed to "2001:0db8:0000:0000:0000:0000:0000:0001", ensuring that the same IPv6 address has a consistent representation across different data sources. This standardization process eliminates the difficulty of duplicate identification caused by differences in address formats, providing a reliable guarantee for accurate data deduplication.

[0035] The system then concatenates the standardized IP address, network protocol, port number, subdomain, and task identifier according to a preset format to generate a feature string. The preset format uses a fixed delimiter and arrangement order to ensure that the same feature combination always produces the same feature string. Specifically, the format is "standardized IP address + network protocol + port number + subdomain + task identifier," where each field is connected using a specific delimiter. During the concatenation process, the system standardizes empty fields to ensure string consistency and integrity. For example, when the subdomain is empty, the system fills it with a predefined placeholder; when protocol information is missing, the system infers the possible protocol type based on the port number. This standardized string concatenation mechanism ensures the uniqueness and consistency of the feature string, providing a reliable input source for subsequent hash calculations.

[0036] The system then performs hash calculations on the feature strings to generate identifiers for each asset query data. The hash calculation uses the MD5 algorithm to perform a digest operation on the feature strings, generating a 128-bit hexadecimal string as the asset's unique identifier. The MD5 algorithm has advantages such as fast computation speed, low collision probability, and fixed output length, enabling the conversion of feature strings of arbitrary length into fixed-length unique identifiers. Through MD5 hash calculations, the system can quickly determine whether two assets belong to the same entity, even if they come from different data sources or have different data representation formats. For example, asset records from the FOFA data source and asset records from the Shodan data source, if they represent the same online asset, will generate the same identifier after multi-dimensional feature extraction and hash calculations, thus achieving accurate duplicate identification.

[0037] During identifier generation, the system maintains an identifier index table, recording the original asset information and data source information corresponding to each identifier. The identifier index table is implemented using an efficient hash table structure, supporting O(1) time complexity lookup operations to ensure query performance in large-scale data processing scenarios. Simultaneously, the system verifies the uniqueness of the generated identifiers. Although the probability of MD5 collisions is extremely low, the system still detects and handles potential hash collisions to ensure the absolute uniqueness of the identifiers. When a hash collision is detected, the system adds additional distinguishing information to the feature string and recalculates the hash value until a unique identifier is obtained.

[0038] Based on the above embodiments, as an optional implementation method, in S103, multi-dimensional feature extraction is performed on the asset query data to generate identifiers for each asset query data, specifically including S31-S34: S31. Extract multi-dimensional feature information from asset query data. The multi-dimensional feature information includes IP address, network protocol, port number, subdomain, and task identifier.

[0039] The system extracts multi-dimensional feature information from asset query data, including core attributes such as IP address, network protocol, port number, subdomain, and task identifier. Multi-dimensional feature information refers to a combination of key attributes that uniquely identifies network assets. The IP address serves as the basic identifier of the network node, the network protocol and port number determine the specific service type, the subdomain provides precise location at the domain level, and the task identifier distinguishes the data source of different query sessions. The system extracts these standardized features from raw data of different formats using a unified data parsing engine, ensuring data consistency in subsequent processing.

[0040] S32 performs address integrity processing on IP addresses to generate standardized IP addresses.

[0041] The system performs address integrity processing on the extracted IP addresses to generate standardized IP addresses. Address integrity processing primarily addresses the inconsistency in the representation formats of IPv4 and IPv6 addresses across different data sources. For IPv4 addresses, the system uniformly adopts dotted decimal format and removes redundant leading zeros; for IPv6 addresses, the system performs complete expansion and format standardization according to RFC standards, ensuring that the same IP address has a consistent representation across different sources. This standardization process is a crucial prerequisite for accurately identifying duplicate assets.

[0042] S33 concatenates standardized IP addresses, network protocols, port numbers, subdomains, and task identifiers according to a preset format to generate a feature string.

[0043] The system concatenates standardized IP addresses, network protocols, port numbers, subdomains, and task identifiers according to a preset format to generate a feature string. The preset format uses a fixed field order and delimiter rules to ensure that the same combination of features always produces the same string result. The system standardizes placeholders for empty fields and infers missing protocol types based on port information, guaranteeing the integrity and consistency of the feature string.

[0044] S34, perform hash calculation on the feature string to generate identifiers for each asset query data.

[0045] The system performs hash calculations on feature strings to generate identifiers for each asset query data. The hash calculation uses the MD5 algorithm to convert feature strings of arbitrary length into fixed-length unique identifiers. The MD5 algorithm has the advantages of high computational efficiency and low collision probability, enabling the generation of a unique identifier for each unique asset. The system also maintains an identifier index table, supporting rapid duplicate checking and asset matching operations.

[0046] S104, obtain the first identifier that already exists in the asset record from the identifiers, merge the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate merged asset data; obtain the second identifier that does not exist in the asset record from the identifiers, and create new asset data corresponding to the asset query data of the second identifier in the asset record.

[0047] Network assets are dynamic and diverse. The same asset may be discovered by different data sources at different times, or different attribute information of the same asset may be scattered across multiple data sources. Traditional simple data overlay or accumulation methods cannot effectively handle such complex data relationships, easily leading to the loss of valuable information or data inconsistency. Therefore, this invention adopts an intelligent data fusion mechanism based on identifier matching, which can accurately distinguish between newly discovered assets and known assets, and perform incremental information fusion on known assets to ensure data integrity and consistency.

[0048] The system first uses an efficient index lookup mechanism to retrieve the first identifier already existing in the asset records. Asset records refer to the historical asset database maintained by the system, containing all network asset information discovered and stored in previous query tasks. Each asset record corresponds to a unique identifier as its primary key. The first identifier refers to an identifier that appears in the current query results and already exists in the asset records, indicating that these assets are known assets previously discovered and recorded by the system. By performing identifier matching queries on the asset records, the system quickly identifies these recurring assets, avoiding the performance overhead of traversing the entire dataset. To improve query efficiency, the system employs a hash table-based index structure, using identifiers as keys to establish a fast lookup mapping, thus reducing the time complexity of a single identifier lookup.

[0049] For the first identified identifier, the system intelligently merges the corresponding asset query data with the stored asset data in the asset records. This process first requires obtaining the data source information and recommendation reason information from the asset query data corresponding to the first identifier. The data source information records the traceability attributes of the asset data, such as the source platform identifier, query timestamp, and data version. The recommendation reason information includes the recommendation logic chain, such as the asset discovery path, the source of the query clue, and the asset association relationship. The asset discovery path refers to the specific technical path that led to the discovery of the asset, such as through subdomain enumeration, port scanning, or certificate association. The source of the query clue records the original clue information that triggered the asset query. The asset association relationship describes the logical connection between the asset and other known assets, such as the same IP address but different ports, or the same domain name but different subdomains.

[0050] The system simultaneously retrieves historical data source information and historical recommendation reason information from the stored asset data in the asset records. This information reflects the discovery records and recommendation logic of the asset in historical queries. During the fusion process, the system first performs a deduplication and merging operation on the current data source information and the historical data source information, ensuring that each data source appears only once in the merged record, avoiding data redundancy caused by duplicate records. The deduplication and merging uses an exact matching algorithm based on data source identifiers. When the same data source is found, the system compares the data timestamps, retains the latest data version, and maintains a complete historical record of the data source in the data source traceability array. This processing method generates the initial fused asset data, ensuring the integrity and accuracy of the data source information.

[0051] Next, the system intelligently merges the current recommendation reason information with historical recommendation reason information to generate the target recommendation reason. The recommendation reason merging employs an algorithm based on recommendation logic deduplication, analyzing the similarity and relevance of recommendation paths to avoid the accumulation of logically redundant recommendation reasons. The system establishes a semantic mapping table for recommendation reasons, merging those with the same logical meaning but different expressions, while maintaining the integrity and traceability of the recommendation chain. During the merging process, the system also prioritizes recommendation reasons based on their timeliness and importance, ensuring that the most valuable recommendation information is displayed first. Finally, the system combines the initial fused asset data and the target recommendation reason to generate complete fused asset data, which includes all historical and current information of the asset, possessing a complete data hierarchy and recommendation logic chain.

[0052] For second identifiers not present in the asset records among the acquired identifiers, the system identifies these as newly discovered network assets. These second identifiers represent assets discovered for the first time in the current query; these assets were not previously recorded by the system and are considered newly discovered network assets. The system creates a corresponding new asset data record in the asset records for each second identifier. This new asset data contains complete attribute information extracted from the asset query data, including basic network information, service configuration, security features, geographical location, and other multi-dimensional data. During the creation process, the system standardizes and verifies the quality of the new asset data to ensure data format consistency and information integrity. Simultaneously, the system assigns a unique internal number to each new asset, establishes a mapping relationship with the identifier, and initializes the asset's lifecycle management attributes, such as creation time, last update time, query frequency, and other statistical information.

[0053] During data fusion and addition processes, the system also implements a time-priority conflict resolution mechanism. When multiple data sources provide different versions of the same asset, the system prioritizes the data based on timestamps, selecting the latest version as the primary information while retaining historical data source records to maintain a complete data change history. This time-priority strategy ensures the timeliness of asset information, while a comprehensive data source traceability mechanism guarantees the verifiability and traceability of the information.

[0054] Based on the above embodiments, as an optional implementation, in S104, the asset query data corresponding to the first identifier is merged with the corresponding stored asset data in the asset record to generate merged asset data, specifically including S41-S45: S41, obtain the data source information and recommendation reason information from the asset query data corresponding to the first identifier; the recommendation reason information includes the asset discovery path, the source of the query clues, and the asset association relationship.

[0055] The system retrieves data source information and recommendation reason information from the asset query data corresponding to the first identifier. The data source information records traceability attributes such as the platform identifier, query timestamp, and data version that led to the discovery of the asset in the current query. The recommendation reason information includes three core dimensions: asset discovery path, query clue source, and asset association. The asset discovery path refers to the specific technical path that led to the discovery of the asset, such as subdomain enumeration or port scanning. The query clue source records the original clue information that triggered the asset query. The asset association describes the logical connection between this asset and other known assets. This information provides crucial evidence for asset traceability and recommendation logic.

[0056] S42, retrieve historical data source information and historical recommendation reason information from the corresponding stored asset data in the asset record.

[0057] The system retrieves historical data source information and historical recommendation reason information from the stored asset data in the asset records. The historical data source information reflects the asset's discovery records and data source history in previous queries, while the historical recommendation reason information records the logical basis and association path for each recommendation of the asset. By obtaining this historical information, the system can gain a comprehensive understanding of the asset's discovery history and evolution.

[0058] S43 deduplicatively merges the data source information with the historical data source information to generate initial merged asset data.

[0059] The system deduplicates and merges current data source information with historical data source information to generate initial merged asset data. The deduplication and merging process employs an exact matching algorithm based on data source identifiers. When identical data sources are found, the system compares data timestamps, retaining the most recent data version while maintaining a complete update history in the data source records. This approach ensures the accuracy of data source information and avoids data redundancy issues caused by duplicate records.

[0060] S44: Merge the recommendation reason information with the historical recommendation reason information to generate the target recommendation reason.

[0061] The system intelligently merges the recommendation reason information with historical recommendation reason information to generate the target recommendation reason. The recommendation reason merging employs a deduplication algorithm based on semantic similarity. The system identifies recommendation reasons with the same logical meaning but different expressions and merges them. Simultaneously, the system ranks the recommendation reasons according to their timeliness and importance, ensuring that the most valuable recommendation information is retained and displayed first.

[0062] S45, combine the initial merged asset data and the reasons for the target recommendation to generate merged asset data.

[0063] The system combines initial merged asset data with the reasons for the target recommendation to generate complete merged asset data. This merged asset data includes all historical and current information about the asset, possessing a complete data hierarchy and recommendation logic chain. During the merging process, the system performs data consistency verification to ensure logical consistency of the merged data and establishes a time-series index to support historical tracing of data changes.

[0064] S105, obtain the first data feature of the integrated asset data and the second data feature of the newly added asset data, calculate the first recommendation coefficient of the integrated asset data based on the first data feature, calculate the second recommendation coefficient of the newly added asset data based on the second data feature, and generate the network asset recommendation result by combining the first recommendation coefficient and the second recommendation coefficient.

[0065] Because the process of discovering online assets often generates massive amounts of asset data, including a large number of ordinary assets with low value or low risk, without an effective recommendation mechanism, users would need to manually sift through this vast amount of data to find important assets. This is not only inefficient but also prone to overlooking crucial high-risk or high-value assets. Traditional simple ranking methods typically prioritize assets based on a single dimension, failing to comprehensively consider the diverse characteristics and complex relationships of assets, resulting in insufficient accuracy and practicality of the recommendation results. Therefore, this invention employs an intelligent recommendation algorithm based on multidimensional feature analysis, which can comprehensively evaluate multiple key attributes of assets, providing users with accurate asset recommendation services.

[0066] The system first acquires the primary data features of the integrated asset data. These primary data features are specifically extracted from the historically accumulated information of existing assets. The primary data features include four core dimensions: number of data sources, data timeliness, data completeness, and number of recommendation reasons. These features reflect the credibility and importance of the integrated asset data. The number of data sources refers to the statistical number of different data sources used to discover the asset; a higher number indicates that the asset has been confirmed by multiple independent platforms, signifying higher credibility and importance. Data timeliness refers to the time difference between the latest update of the asset data and the current time, reflecting the freshness and timeliness of the asset information. Data completeness refers to the completeness of the asset's various attribute information, quantified by calculating the ratio of filled attribute fields to total attribute fields. The number of recommendation reasons refers to the total number of different logical reasons leading to the asset's recommendation, including different discovery paths, relationships, and recommendation chains; a higher number indicates richer association value and recommendation basis for the asset.

[0067] Simultaneously, the system acquires second data features of newly added asset data. This feature system is specifically designed for the assessment of newly discovered assets. The second data features include four key dimensions: asset importance, port risk level, service type, and discovery clue type. These features primarily focus on the intrinsic value and potential risks of new assets. Asset importance is an indicator that comprehensively assesses an asset's network location, service scale, and business criticality, determined by analyzing factors such as the importance of IP address ranges, domain authority, and certificate issuing authorities. Port risk level is a graded assessment based on the security risk of open ports; high-risk ports, such as database ports and management ports, receive higher risk level scores. Service type refers to the specific network service category provided by the asset, such as web services, database services, and file transfer services. Different service types have different security concerns and business values. Discovery clue type refers to the category and importance of the original clue that led to the discovery of the asset; for example, assets discovered through high-value domain names typically have higher value than assets discovered through random scanning.

[0068] After acquiring complete feature information, the system calculates the first recommendation coefficient for the fused asset data based on the first data features. The calculation process first determines the corresponding first, second, third, and fourth scores based on the number of data sources, data timeliness, data completeness, and the number of recommendation reasons. Each score uses a standardized scoring algorithm to map the original feature values ​​to a standard score range of 0-100, ensuring effective comparison and fusion of features with different dimensions. The data source quantity score is smoothed using a logarithmic function to avoid excessive influence of extreme values ​​on the score; the data timeliness score uses an exponential decay function, allowing more recent data to receive higher scores; the data completeness score directly uses a linear mapping of the completeness ratio; and the recommendation reason quantity score also uses logarithmic smoothing.

[0069] The system then performs a weighted summation of the first, second, third, and fourth scores to generate the initial recommendation coefficient for the integrated asset data. During the weighted summation, each scoring dimension has a different weight coefficient, which is optimized based on statistical analysis of extensive historical data and expert experience. Generally, the number of data sources and data timeliness have relatively high weights because they directly reflect the credibility and timeliness value of the assets; data completeness and the number of reasons for recommendation have relatively low weights, serving as auxiliary evaluation factors. After obtaining the initial recommendation coefficient, the system acquires the timeliness differences between different data sources in the integrated asset data and calculates a timeliness adjustment factor. This adjustment factor is inversely proportional to the timeliness difference; that is, when the time difference between different data sources is large, the adjustment factor is small, reflecting the uncertainty of data consistency; when the time difference is small, the adjustment factor is large, indicating that the data has good time consistency. Finally, the system arithmetically multiplies the initial recommendation coefficient by the timeliness adjustment factor to generate the first recommendation coefficient for the integrated asset data.

[0070] For newly added asset data, the system calculates a second recommendation coefficient based on the second data characteristics. The calculation process also begins by determining the corresponding fifth, sixth, seventh, and eighth scores based on asset importance, port risk level, service type, and discovery clue type. The asset importance score is based on a comprehensive assessment of multi-dimensional importance indicators, including the geographical importance of the IP address, the business scale of the organization, and the authority of the domain name; the port risk level score is based on a port security risk database, quantifying the security risks of different ports; the service type score is assessed based on the business criticality and security concern of the service; and the discovery clue type score is assessed based on the credibility and importance of the clue source. The system then weights and sums the fifth, sixth, seventh, and eighth scores to generate the basic recommendation coefficient for the new asset data. Port risk level and asset importance typically have higher weights because they directly relate to the security and business value of the asset.

[0071] Based on the basic recommendation coefficient, the system obtains the asset risk level corresponding to the newly added asset data and calculates a risk adjustment factor accordingly. The asset risk level is a risk assessment result derived from a comprehensive analysis of factors such as asset security vulnerabilities, service configuration, and network environment. The risk adjustment factor is directly proportional to the asset risk level; that is, assets with higher risk levels receive a larger adjustment factor, thus gaining higher priority in the recommendation results and ensuring that high-risk assets receive timely attention and handling. The system then arithmetically multiplies the basic recommendation coefficient and the risk adjustment factor to generate a second recommendation coefficient for the newly added asset data.

[0072] After calculating the first and second recommendation coefficients, the system combines these two coefficients to generate the final network asset recommendation result. This result is an intelligently sorted list of assets, incorporating a comprehensive ranking of both merged and newly added asset data. The system uses normalization to ensure the comparability of the first and second recommendation coefficients, and then performs a global sorting based on descending order of the coefficients. During the sorting process, the system also considers the balance of asset types, preventing any particular type of asset from being overly concentrated at the top of the recommendation results, ensuring diversity and comprehensiveness. The final recommendation result includes not only basic asset information but also detailed explanations of the recommendation rationale, risk assessment results, and suggested remedial measures, providing users with comprehensive decision support information.

[0073] Based on the above embodiments, as an optional implementation, in S105, the first data features include: the number of data sources, data timeliness, data integrity, and the number of recommendation reasons; the second data features include: asset importance, port risk level, service type, and discovery clue type. The calculation of the first recommendation coefficient for the fused asset data based on the first data features, and the calculation of the second recommendation coefficient for the newly added asset data based on the second data features, specifically includes S51-S54: S51. Determine the first score of the integrated asset data based on the number of data sources; determine the second score of the integrated asset data based on the timeliness of the data; determine the third score of the integrated asset data based on the completeness of the data; and determine the first score of the integrated asset data based on the number of reasons for recommendation.

[0074] The system performs multi-dimensional scoring based on the historical accumulation characteristics of integrated asset data. The first score is determined by the number of data sources, using a logarithmic function to map the number of data sources to a standard scoring range; more data sources indicate that the asset has been confirmed by multiple parties, and thus higher credibility. The second score is determined by data timeliness, using an exponential decay function to calculate the timeliness value of the latest update time; the more recent the time, the higher the score. The third score is determined by data completeness, using a linear mapping by calculating the ratio of filled attributes to total attributes; higher completeness results in a higher score. The fourth score is determined by the number of recommendation reasons, using logarithmic smoothing to avoid the influence of extreme values; more recommendation reasons indicate higher asset association value.

[0075] S52 combines the first, second, third, and fourth scores to generate the first recommendation coefficient for the integrated asset data.

[0076] The system combines the first, second, third, and fourth scores to generate a first recommendation coefficient for the integrated asset data. The system employs a weighted summation algorithm, where the number of data sources and data timeliness have high weights, reflecting the credibility and timely value of the integrated assets; data completeness and the number of recommendation reasons have secondary weights, serving as supplementary factors for the comprehensive evaluation. The system also calculates an adjustment factor based on the timeliness differences between different data sources; when there are significant time differences between data sources, the recommendation coefficient is reduced to ensure consistency in the recommendation results.

[0077] Based on the above embodiments, as an optional implementation method, in S52, combining the first score, the second score, the third score, and the fourth score to generate the first recommendation coefficient for the fused asset data specifically includes S521-S523: S521, the first, second, third and fourth scores are weighted and summed to generate the initial recommendation coefficient for the integrated asset data.

[0078] The system calculates a weighted sum of the first, second, third, and fourth scores to generate an initial recommendation coefficient for the integrated asset data. The weighted sum uses a preset weight configuration: the data source quantity score has a weight of 0.3, reflecting the importance of multi-source confirmation; the data timeliness score has a weight of 0.35, emphasizing the key role of timeliness; the data completeness score has a weight of 0.2, reflecting the auxiliary value of information completeness; and the number of recommendation reasons score has a weight of 0.15, reflecting the supplementary role of rich associations. The system obtains the initial recommendation coefficient through linear weighting, which reflects the basic value level of the integrated assets under the standard evaluation dimensions.

[0079] S522, Obtain the timeliness difference of the data source in the integrated asset data, and calculate the timeliness adjustment factor based on the timeliness difference; wherein, the timeliness adjustment factor is inversely proportional to the timeliness difference.

[0080] The system acquires the timeliness differences among various data sources in the integrated asset data and calculates a timeliness adjustment factor based on these differences. Timeliness difference refers to the time interval between the latest and earliest updates of the same asset across different data sources. A large time difference indicates poor consistency between data sources, potentially suggesting information lag or asynchrony. The timeliness adjustment factor employs an inverse proportional function design. The specific formula is: the adjustment factor equals the baseline value divided by the logarithm of the timeliness difference plus one. This ensures that the larger the timeliness difference, the smaller the adjustment factor, thereby reducing the recommendation coefficient and reflecting the credibility risk arising from data inconsistency.

[0081] S523, the initial recommendation coefficient is arithmetically multiplied by the timeliness adjustment factor to generate the first recommendation coefficient of the integrated asset data.

[0082] The system arithmetically multiplies the initial recommendation coefficient with a timeliness adjustment factor to generate the final first recommendation coefficient for the merged asset data. This arithmetic multiplication ensures the direct impact of the adjustment factor on the recommendation coefficient. When the data sources have consistent timeliness, the adjustment factor is close to 1, having a minimal impact on the initial recommendation coefficient. Conversely, when the data sources have significant differences in timeliness, the adjustment factor is significantly less than 1, effectively reducing the recommendation coefficient and preventing assets with inconsistent timeliness from receiving excessively high recommendation priority.

[0083] S53. Based on asset importance, determine the fifth score for newly added asset data; based on port risk level, determine the sixth score for newly added asset data; based on service type, determine the seventh score for newly added asset data; based on the type of clue discovered, determine the eighth score for newly added asset data.

[0084] The system performs risk-oriented scoring based on the discovery characteristics of newly added asset data. A fifth score is determined based on asset importance, assessed through a comprehensive analysis of factors such as the importance of IP address ranges, domain authority, and the size of the organization to which they belong. A sixth score is determined based on port risk level, quantifying the risk of open ports using a port security risk database. A seventh score is determined based on service type, tiered according to the service's business criticality and security focus. An eighth score is determined based on the type of discovered clues, assessing their value based on the credibility and importance of the clue's source.

[0085] S54 combines the fifth, sixth, seventh, and eighth ratings to generate a second recommendation coefficient for new asset data.

[0086] The system combines the fifth, sixth, seventh, and eighth scores to generate a second recommendation coefficient for newly added asset data. The system also employs a weighted summation algorithm, with port risk level and asset importance having higher weights to highlight the security and business value of new assets; service type and discovery clue type have secondary weights. The system also calculates a risk adjustment factor based on the comprehensive risk level of new assets, with higher-risk assets receiving a larger adjustment coefficient to ensure they receive priority attention.

[0087] Based on the above embodiments, as an optional implementation method, in S54, the second recommendation coefficient for generating new asset data by combining the fifth, sixth, seventh, and eighth scores specifically includes S541-S543: S541 calculates a weighted sum of the fifth, sixth, seventh, and eighth ratings to generate the basic recommendation coefficient for new asset data.

[0088] The system weights and sums the fifth, sixth, seventh, and eighth scores to generate a basic recommendation coefficient for new asset data. The weighted sum uses a risk-oriented weighting configuration: asset importance score has a weight of 0.25, reflecting its fundamental role in business value; port risk level score has a weight of 0.4, emphasizing the core position of security risk; service type score has a weight of 0.2, reflecting the auxiliary value of service characteristics; and discovery clue type score has a weight of 0.15, reflecting supplementary information about the discovery path. The system calculates the basic recommendation coefficient through weighted summation, which primarily reflects the initial value level of the new asset under the standard evaluation dimensions.

[0089] S542, obtain the asset risk level corresponding to the newly added asset data, and calculate the risk adjustment factor based on the asset risk level; wherein, the risk adjustment factor is directly proportional to the asset risk level.

[0090] The system acquires the asset risk level corresponding to newly added asset data and calculates a risk adjustment factor based on the asset risk level. The asset risk level is a risk assessment result derived from a comprehensive analysis of multiple factors such as asset security vulnerabilities, service configuration, network environment, and threat intelligence, and is typically divided into four levels: low, medium, high, and severe. The risk adjustment factor is directly proportional to the asset risk level, employing a tiered adjustment strategy: a low-risk level corresponds to an adjustment factor of 0.8, a medium-risk level to 1.0, a high-risk level to 1.3, and a severe-risk level to 1.6, ensuring that high-risk assets receive a significant recommendation advantage.

[0091] S543 generates a second recommendation coefficient for new asset data by arithmetically multiplying the base recommendation coefficient by the risk adjustment factor.

[0092] The system arithmetically multiplies the base recommendation coefficient with the risk adjustment factor to generate the final second recommendation coefficient for newly added asset data. This arithmetic multiplication operation directly amplifies the recommendation coefficient based on risk level. When the asset risk level is low, the adjustment factor is less than or equal to 1, having a limited impact on the base recommendation coefficient. When the asset risk level is high, the adjustment factor is significantly greater than 1, effectively increasing the recommendation coefficient and ensuring that high-risk new assets receive priority in the recommendation results, promptly attracting the attention of safety management personnel.

[0093] Figure 2 This is a schematic diagram of the complete technical implementation architecture of a network asset intelligent recommendation system based on multiple data sources, as provided in the embodiments of this application. Figure 2As shown, the system's data flow begins at the clue input layer, receiving network asset query clues from different channels. The clue preprocessing module standardizes and unifies the format of the raw input clues, laying the foundation for subsequent concurrent queries. The load balancer, as the core scheduling component of the system, realizes intelligent distribution of query tasks and optimized resource allocation, ensuring the stable operation of the system under high-concurrency scenarios.

[0094] The concurrent query scheduler and weight adjustment module work together to dynamically adjust query strategies based on the response characteristics and reliability of different data sources. The system employs four independent data source adapters, corresponding to data sources A, B, C, and D, respectively. Each adapter is equipped with a dedicated goroutine pool, enabling true parallel query processing. This design not only improves query efficiency but also avoids excessive consumption of system resources through the resource management mechanism of the goroutine pool.

[0095] The data collection channel serves as a buffer between each goroutine and subsequent processing stages, employing an asynchronous communication mechanism to ensure smooth data transmission. The intelligent data fusion processor implements the core algorithms of the aforementioned technical solution, including multi-dimensional feature extraction to generate asset identifiers, intelligent identification and fusion of duplicate assets, and accurate calculation of differentiated recommendation coefficients.

[0096] At the data processing level, the system integrates three core components: a data deduplication algorithm, a data merging algorithm, and a conflict resolution mechanism. The data deduplication algorithm achieves accurate deduplication based on the aforementioned hash identifier mechanism; the data merging algorithm handles the intelligent updating of merged asset data; and the conflict resolution mechanism addresses data conflicts between different data sources. These three algorithm modules work together to ensure the accuracy and consistency of the merged data.

[0097] The tiered storage system adopts a two-tier architecture of a distributed cache layer and a memory cache layer. The distributed cache layer is responsible for the persistent storage of large-capacity data and cross-node data synchronization, while the memory cache layer provides high-speed data access capabilities, supporting real-time queries and fast recommendation calculations.

[0098] The final recommendation output integrates the results of all processing stages, including a deduplicated asset list, merged asset details, calculated recommendation coefficients, and ranked recommendation results. The entire system architecture, connected by dotted lines, demonstrates the unified control of each processing stage by the load balancer and weight adjustment module. This enables dynamic optimization of system performance and rational allocation of resources, ensuring the efficiency and accuracy of network asset recommendations.

[0099] Figure 3 This is a schematic diagram illustrating the complete execution flow of a network asset intelligent recommendation method based on multiple data sources, as provided in an embodiment of this application. Figure 3As shown, the process begins with user data input and the generation of a unified identifier. The system first standardizes the input asset query data. During the MD5 index calculation stage, the system executes the multi-dimensional feature extraction process described in the aforementioned technical solution, extracting key information such as IP address, network protocol, port number, subdomain, and task identifier from the asset query data. After address completion processing and feature string concatenation, a unique asset identifier is generated through hash calculation.

[0100] The system determines the asset's age by checking if the identifier exists in the asset record; this determination is the core branch point of the entire process. When the existence of the asset is detected, the process enters the data merging processing branch, executing the fused asset data generation mechanism in the aforementioned technical solution. The system obtains the data source information and recommendation reason information of the current asset query data, and simultaneously extracts the historical data source information and historical recommendation reason information of the stored assets. Through deduplication and intelligent merging algorithms, it generates complete fused asset data.

[0101] At the AI ​​AssetsSource decision point, the system employs different processing strategies based on the data source type. If the data source does not exist, the system adds a new data source; if the data source already exists, the system performs data fusion. Both branches ultimately converge at the merge recommendation reason stage, ensuring that all relevant information is fully preserved and integrated.

[0102] In subsequent checks for duplicate decision points in the recommendation reasons, the system deduplicates the recommendation reason information. When a duplicate is found, a new reason is added; when no duplicate is found, data fusion is performed, ultimately forming a complete set of recommendation reasons without duplicates.

[0103] The key computational step in the process lies in the decision-making process of comparing data time points. The system selects different recommendation coefficient calculation paths based on the timeliness characteristics of the data. For newly added data types, the system performs a process of retaining and merging new data information, employing the second recommendation coefficient calculation method based on asset importance, port risk level, service type, and discovery clue type, as described in the aforementioned technical solution. For existing data types, the system performs a process of retaining and merging existing data information, employing the first recommendation coefficient calculation method based on the number of data sources, data timeliness, data integrity, and the number of recommendation reasons.

[0104] The two parallel recommendation coefficient calculation branches correspond to three processing modes: direct storage in the database, retaining new data while merging information, and retaining old data while merging information. This reflects the system's refined management strategy for different data states. All branches ultimately converge on the intelligent result ranking stage, where the system prioritizes assets based on the calculated recommendation coefficients, achieving intelligent recommendation decisions.

[0105] Figure 4 This is a schematic diagram of the layered storage and data processing architecture of a network asset intelligent recommendation system provided in an embodiment of this application, such as... Figure 4 As shown, the system's data flow originates from the account manager, which integrates core components such as the security level protection database, account identification mechanism, automatic TTL expiration, and LRU eviction policy. The security level protection database stores security level classification information of network assets, providing basic data for subsequent risk assessment; the account identification mechanism ensures data isolation and access control in multi-user environments; the automatic TTL expiration mechanism implements lifecycle management of cached data; and the LRU eviction policy automatically cleans up the least used data when cache space is insufficient, ensuring system memory efficiency.

[0106] At the core decision points in data processing, the system checks the memory cache to determine whether data needs to be loaded from external storage. When data misses the memory cache, the system enters the miss branch and performs a query on the external data source. This process corresponds to the multi-data source concurrent query mechanism in the aforementioned technical solution. The system ensures data format uniformity through serialization, and then stores the processing results in both the deserialization database and the external database, achieving dual data backup and fast access.

[0107] When data hits the memory cache, the system enters the hit branch and further optimizes the data access path by checking the distributed cache. The system is designed with four dedicated distributed caching layers, including query result cache (TTL: 12 hours), query count data storage (TTL: 12 hours), CDN route cache (TTL: 30 days), and resolved domain name cache (TTL: 24 hours). Each caching layer has a different time-to-live configuration, reflecting the fine-grained management of the timeliness requirements of different types of data.

[0108] At the memory storage level, the system integrates four core components: thread data storage, recommendation result cache (sync.Map), object pool cache (sync.Pool), and reasonMap cache. sync.Map provides thread-safe storage for recommendation results, ensuring that multiple goroutines can safely read and write recommendation data; sync.Pool implements an object reuse mechanism, reducing the performance overhead caused by frequent object creation and destruction; and the reasonMap cache specifically stores recommendation reason information, supporting fast retrieval and merging operations of recommendation reasons in the aforementioned technical solutions.

[0109] The system's final processing flow achieves persistent data storage through two parallel branches. The deserialization database branch handles the storage and retrieval of structured data, supporting complex query and analysis operations; the storage to an external database branch is responsible for backing up and archiving the original data, ensuring data integrity and traceability. Both branches ultimately converge at the cached result return stage, returning the processed data to the user.

[0110] Figure 5 This is a schematic diagram illustrating the concurrent processing and load balancing mechanism of a network asset intelligent recommendation system provided in an embodiment of this application. Figure 5 As shown, the system begins with a query request and a load balancer. The load balancer, as the core scheduling component, is responsible for assessing the current system load and resource allocation. At critical decision points in the system load assessment, the system determines the appropriate processing strategy based on current concurrency, memory usage, and network bandwidth.

[0111] When the system load is low, the process enters the light-load branch on the left, where the system allocates a goroutine pool to perform concurrent query control. The goroutine pool uses a pre-allocation mechanism, maintaining a certain number of worker goroutines to handle query tasks, avoiding the performance overhead of frequently creating and destroying goroutines. In the decision-making process for using goroutines, the system further optimizes resource allocation. When goroutine resources are sufficient, goroutines are allocated to execute specific data source query tasks; when goroutine resources are scarce, they enter a queuing state to ensure system stability.

[0112] When the system load is high, the process enters the high-load branch on the right, and the system activates the load balancing mechanism for more granular resource management. The system adopts three processing strategies according to different load conditions: container isolation prevents a single data source from affecting overall performance by controlling the frequency of API calls and resource allocation; the synchronous billing module ensures that resource usage is reasonably billed under high load conditions; and the storage pause mechanism suspends non-critical operations under extreme load conditions to prioritize the normal operation of core query functions.

[0113] During the query execution phase, the system verifies the validity and completeness of the query results by generating a data source check. When the check finds incomplete data, the system enters an error handling process, performing error processing and query re-control operations, and ensuring data integrity through a retry mechanism. When the check result is normal, the system continues data processing and priority scheduling.

[0114] The system's core processing capability lies in its data time-separation and fusion control module, which implements the intelligent data fusion mechanism described in the aforementioned technical solution. The system uniformly collects and processes query results from different data sources, executing core algorithms such as multi-dimensional feature extraction, duplicate asset identification, and data fusion.

[0115] During the priority scheduling phase, the system intelligently sorts the processed asset data based on the recommendation coefficient calculation results in the aforementioned technical solution. The system comprehensively considers the historical accumulated value of the integrated asset data and the risk characteristics of the newly added asset data to achieve differentiated priority allocation.

[0116] The final step in the process is to release goroutines and update merge statistics. After completing the query task, the system promptly releases goroutine resources and updates the system's performance statistics. The load monitoring component includes four key monitoring dimensions: number of goroutines generated, API call statistics, system response time, and error rate statistics, providing data support for continuous system optimization.

[0117] The entire process, through dynamic load awareness and adaptive resource scheduling, ensures that the system maintains stable performance under different load conditions, effectively supporting the efficient execution of concurrent queries from multiple data sources and intelligent recommendation calculations in the aforementioned technical solutions.

[0118] Based on the above method, this application also discloses a network asset recommendation system based on concurrent fusion of multiple data sources, such as... Figure 6 As shown, Figure 6 This is a schematic diagram of the structure of a network asset recommendation system based on concurrent fusion of multiple data sources provided in an embodiment of this application. The system includes: a receiving module, a building module, an extraction module, a first acquisition module, and a second acquisition module; wherein, The receiving module is used to receive network asset query clues input by users through the query interface, and determine multiple data sources according to the type of network asset query clues. The construction module is used to build concurrent query tasks for each data source, perform asset queries on each data source according to the concurrent query tasks, and generate asset query data. The extraction module is used to extract multi-dimensional features from asset query data and generate identifiers for each asset query data. The first acquisition module is used to acquire the first identifier that already exists in the asset record, merge the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate merged asset data; acquire the second identifier that does not exist in the asset record, and create new asset data corresponding to the asset query data of the second identifier in the asset record. The second acquisition module is used to acquire the first data features of the integrated asset data and the second data features of the newly added asset data. Based on the first data features, it calculates the first recommendation coefficient of the integrated asset data and the second recommendation coefficient of the newly added asset data. Combining the first recommendation coefficient and the second recommendation coefficient, it generates network asset recommendation results.

[0119] It should be noted that the system provided in the above embodiments is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0120] Please see Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 1000 may include: at least one processor 1001, at least one network interface 1004, a user interface 1003, a memory 1005, and at least one communication bus 1002.

[0121] The communication bus 1002 is used to realize the connection and communication between these components.

[0122] The user interface 1003 may include a display screen and a camera. Optionally, the user interface 1003 may also include a standard wired interface and a wireless interface.

[0123] The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0124] The processor 1001 may include one or more processing cores. The processor 1001 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1005, and by calling data stored in the memory 1005. Optionally, the processor 1001 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 1001 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 1001 and may be implemented as a separate chip.

[0125] The memory 1005 may include random access memory (RAM) or read-only memory. Optionally, the memory 1005 may include a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 1005 may also be at least one storage device located remotely from the aforementioned processor 1001. Figure 7 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program based on a network asset recommendation method that integrates multiple data sources concurrently.

[0126] exist Figure 7In the electronic device 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and obtain the user input data; while the processor 1001 can be used to call an application stored in the memory 1005 that is a network asset recommendation method based on concurrent fusion of multiple data sources. When executed by one or more processors, the electronic device executes one or more of the methods described in the above embodiments.

[0127] An electronic device readable storage medium stores instructions that, when executed by one or more processors, cause the electronic device to perform one or more of the methods described in the above embodiments.

[0128] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0129] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0130] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some service interfaces; indirect couplings or communication connections between devices or units may be electrical or other forms.

[0131] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0133] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0134] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Other embodiments of this disclosure will be readily apparent to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

Claims

1. A network asset recommendation method based on concurrent fusion of multiple data sources, characterized in that, The method includes: Receive network asset query clues input by users through the query interface, and determine multiple data sources based on the type of the network asset query clues; Concurrent query tasks are constructed for each of the aforementioned data sources. Asset queries are performed on each of the aforementioned data sources according to the concurrent query tasks to generate asset query data. Multidimensional feature extraction is performed on the asset query data to generate identifiers for each asset query data. Obtain a first identifier that already exists in the asset record from the identifiers, merge the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate merged asset data; obtain a second identifier that does not exist in the asset record from the identifiers, and create new asset data corresponding to the asset query data of the second identifier in the asset record; The system acquires a first data feature of the fused asset data and a second data feature of the newly added asset data. Based on the first data feature, it calculates a first recommendation coefficient for the fused asset data and a second recommendation coefficient for the newly added asset data. Combining the first recommendation coefficient and the second recommendation coefficient, the system generates a network asset recommendation result.

2. The network asset recommendation method based on concurrent fusion of multiple data sources according to claim 1, characterized in that, The step of constructing concurrent query tasks corresponding to each of the data sources, performing asset queries on each of the data sources according to the concurrent query tasks, and generating asset query data includes: Independent concurrent query tasks are created for each of the aforementioned data sources based on a lightweight coroutine mechanism; The concurrent query tasks are launched simultaneously using a non-blocking asynchronous communication mechanism to perform asset queries on each of the data sources. A semaphore mechanism is used to control the number of concurrent query tasks executed, and to obtain asset query data returned by each of the data sources.

3. The network asset recommendation method based on concurrent fusion of multiple data sources according to claim 1, characterized in that, The step of performing multi-dimensional feature extraction on the asset query data to generate identifiers for each asset query data includes: Multidimensional feature information is extracted from the asset query data, including IP address, network protocol, port number, subdomain, and task identifier; The IP address is processed to complete the address and generate a standardized IP address; The standardized IP address, the network protocol, the port number, the subdomain, and the task identifier are concatenated according to a preset format to generate a feature string; The feature string is hashed to generate an identifier for each asset query data.

4. The network asset recommendation method based on concurrent fusion of multiple data sources according to claim 1, characterized in that, The step of fusing the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate fused asset data includes: Obtain the data source information and recommendation reason information from the asset query data corresponding to the first identifier; the recommendation reason information includes the asset discovery path, the source of query clues, and the asset association relationship. Obtain historical data source information and historical recommendation reason information from the stored asset data in the asset record; The data source information and the historical data source information are deduplicated and merged to generate initial fused asset data; The recommendation reason information is merged with the historical recommendation reason information to generate the target recommendation reason; The initial fused asset data and the target recommendation reasons are combined to generate fused asset data.

5. The network asset recommendation method based on concurrent fusion of multiple data sources according to claim 1, characterized in that, The first data features include: number of data sources, data timeliness, data completeness, and number of recommendation reasons. The second data features include: asset importance, port risk level, service type, and discovery clue type. The calculation of a first recommendation coefficient for the integrated asset data based on the first data features, and a second recommendation coefficient for the newly added asset data based on the second data features, includes: Based on the number of data sources, a first score is determined for the integrated asset data; based on the timeliness of the data, a second score is determined for the integrated asset data; based on the completeness of the data, a third score is determined for the integrated asset data; and based on the number of reasons for recommendation, a fourth score is determined for the integrated asset data. By combining the first score, the second score, the third score, and the fourth score, a first recommendation coefficient for the fused asset data is generated. Based on the asset importance, a fifth score is determined for the newly added asset data; based on the port risk level, a sixth score is determined for the newly added asset data; based on the service type, a seventh score is determined for the newly added asset data; and based on the type of discovered clues, an eighth score is determined for the newly added asset data. The second recommendation coefficient for the newly added asset data is generated by combining the fifth, sixth, seventh, and eighth scores.

6. The network asset recommendation method based on concurrent fusion of multiple data sources according to claim 5, characterized in that, The process of combining the first score, the second score, the third score, and the fourth score to generate a first recommendation coefficient for the integrated asset data includes: The first score, the second score, the third score, and the fourth score are weighted and summed to generate the initial recommendation coefficient for the fused asset data; The timeliness differences of the data sources in the fused asset data are obtained, and a timeliness adjustment factor is calculated based on the timeliness differences; wherein, the timeliness adjustment factor is inversely proportional to the timeliness differences; The initial recommendation coefficient is arithmetically multiplied by the timeliness adjustment factor to generate the first recommendation coefficient of the fused asset data.

7. The network asset recommendation method based on concurrent fusion of multiple data sources according to claim 5, characterized in that, The process of combining the fifth, sixth, seventh, and eighth scores to generate a second recommendation coefficient for the newly added asset data includes: The fifth, sixth, seventh, and eighth scores are weighted and summed to generate the basic recommendation coefficient for the new asset data. Obtain the asset risk level corresponding to the newly added asset data, and calculate the risk adjustment factor based on the asset risk level; wherein, the risk adjustment factor is directly proportional to the asset risk level; The second recommendation coefficient for the newly added asset data is generated by arithmetically multiplying the basic recommendation coefficient with the risk adjustment factor.

8. A network asset recommendation system based on concurrent fusion of multiple data sources, characterized in that, The system includes: a receiving module, a constructing module, an extracting module, a first acquisition module, and a second acquisition module; wherein, The receiving module is used to receive network asset query clues input by users through the query interface, and determine multiple data sources according to the type of network asset query clues; The construction module is used to construct concurrent query tasks corresponding to each of the data sources, perform asset queries on each of the data sources according to the concurrent query tasks, and generate asset query data. The extraction module is used to perform multi-dimensional feature extraction on the asset query data and generate identifiers for each asset query data. The first acquisition module is used to acquire a first identifier that already exists in the asset record from the identifiers, merge the asset query data corresponding to the first identifier with the corresponding stored asset data in the asset record to generate merged asset data; acquire a second identifier that does not exist in the asset record from the identifiers, and create new asset data corresponding to the asset query data of the second identifier in the asset record; The second acquisition module is used to acquire the first data feature of the fused asset data and the second data feature of the newly added asset data, calculate the first recommendation coefficient of the fused asset data based on the first data feature, calculate the second recommendation coefficient of the newly added asset data based on the second data feature, and generate a network asset recommendation result by combining the first recommendation coefficient and the second recommendation coefficient.

9. An electronic device, characterized in that, The device includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1-7.

Images