Internet asset state evaluation method and device, equipment and storage medium

Abstract

The invention provides an Internet asset state evaluation method, device and equipment and a storage medium, and relates to the technical field of asset management. The method comprises the following steps: initiating a detection request for Internet assets in a current round, and obtaining a first response; according to the first response, applying a multi-dimensional label to the Internet assets, wherein the label dimensions comprise survival, failure, failure and to-be-confirmed; under the condition that at least one of the following preset conditions is met, verifying a label applied to the Internet assets in the current round, and determining that the label is correct or correcting the incorrect label according to a verification result, wherein the label is the to-be-confirmed type; and comparing the labels of the internet assets in the current round with the labels of the internet assets in the previous round, and determining that an abnormal event exists, the abnormal event at least comprising one of survival changing into failure, survival changing into failure and failure changing into survival. According to the method and the device, the Internet asset state can be quickly and accurately evaluated and maintained.

Description

Technical Field

[0001] This application relates to the field of asset management technology, specifically to an internet asset status assessment method, an internet asset status assessment device, a machine-readable storage medium, a computer device, and a computer program product. Background Technology

[0002] Currently, businesses require various internet applications to meet the production and daily life needs of diverse users. This vast internet application service system exposes a massive number of websites and domains to the outside world. If these websites and domains are not properly monitored and managed, they can become weak links in the overall security of a business, potentially creating vulnerabilities for intrusion and causing significant losses.

[0003] Given the above background and current situation, enterprises need to strengthen the management of their internet asset exposure and enhance monitoring of internet-facing domain names and application systems. Currently, enterprises rely on various methods to probe their internet domain name assets, such as purchasing third-party page monitoring services, periodically testing activity using scripts, and regularly maintaining and inspecting them through management methods. However, these common methods are insufficient to effectively maintain the state of an enterprise's exposed assets, lacking in the effectiveness, stability, and security of maintaining internet assets. The main reasons for this are insufficient confidence in internet domain name asset detection data, discrepancies between detection results and the actual state of the enterprise's internet assets, and reliance on manual verification for multiple rounds of detection data. Summary of the Invention

[0004] The purpose of this application is to provide an Internet asset status assessment method, an Internet asset status assessment device, a machine-readable storage medium, a computer device, and a computer program product to overcome one or more defects in the existing Internet asset status management.

[0005] To achieve the above objectives, a first aspect of this application provides a method for assessing the status of internet assets, characterized in that the method includes: initiating a detection request for an internet asset in the current round, obtaining a first response, wherein the first response is a response matching the detection request; applying labels to the internet asset based on the first response to distinguish different asset states, wherein the label corresponding to an asset in use is "alive," the label corresponding to an asset inactive state is "invalid," the labels corresponding to various real abnormal asset states are various failure types, and the labels corresponding to various suspected abnormal asset states are various pending confirmation types; verifying the labels applied to the internet asset in the current round and determining whether the label is correct or correcting incorrect labels based on the verification result if at least one of the following preset conditions is met: the label is the pending confirmation type; comparing the labels of the internet asset in the current round and in previous rounds to determine the existence of an abnormal event, wherein the abnormal event includes at least one of "alive becomes invalid," "alive becomes failed," and "invalid becomes live."

[0006] In a specific embodiment of this application, when the label applied to the Internet asset in the current round is of the unconfirmed type, the step of verifying the label applied to the Internet asset in the current round and determining whether the label is correct or correcting an incorrect label based on the verification result includes: Initiate a first manual verification command; obtain a response matching the first manual verification command; update the tag of the Internet asset based on the response matching the first manual verification command.

[0007] In a specific embodiment of this application, when the existence of the abnormal event is determined, the step of verifying the label applied to the Internet asset in the current round and determining whether the label is correct or correcting an incorrect label based on the verification result includes: performing compliance verification of the abnormal event, and updating the label of the Internet asset in the current round if the label of the Internet asset in the current round is determined to be non-compliant based on the compliance verification result.

[0008] In a specific embodiment of this application, the step of applying a label to the Internet asset to distinguish different asset states based on the first response includes: performing data inference on the first response using a pre-trained deep learning model to identify response features; matching the response features with each fingerprint in a preset response feature fingerprint database, determining the asset state corresponding to the fingerprint that best matches the response features as the state of the Internet asset; and applying a label to the Internet asset corresponding to the determined state of the Internet asset.

[0009] In a specific embodiment of this application, the step of applying a label to the Internet asset to distinguish different asset states based on the first response includes: performing data inference on the first response using a pre-trained deep learning model to identify response features; matching the response features with each fingerprint in a preset response feature fingerprint database; determining whether the matching degree between the fingerprint that best matches the response features and the response features is lower than a preset matching threshold; if so, initiating a second manual verification instruction and proceeding to the next step; otherwise, determining the asset state corresponding to the fingerprint that best matches the response features as the state of the Internet asset and applying a label corresponding to the determined state of the Internet asset to the Internet asset; obtaining a response matching the second manual verification instruction; determining the state of the Internet asset based on the response matching the second manual verification instruction, and applying a label corresponding to the determined state of the Internet asset to the Internet asset.

[0010] In a specific embodiment of this application, initiating the current round of detection request for the Internet asset and obtaining a first response includes: obtaining the port of the Internet asset from the exposure surface data of the Internet asset, initiating a network communication request to the port, and obtaining a response matching the network communication request; obtaining the URL of the Internet asset from the exposure surface data of the Internet asset, initiating an HTTP request to the URL, and obtaining a response matching the HTTP request; determining the port status and service fingerprint of the Internet asset based on the response matching the network communication request; obtaining response features from the response matching the HTTP request; if at least one of the preset verification rules is satisfied, proceeding to obtaining the port of the Internet asset from the exposure surface data of the Internet asset and initiating a network communication request to the port, otherwise proceeding to the next step; taking the latest state response matching the HTTP request as the first response; wherein, the verification rules include: when the port status is closed, determining the Internet asset as in use based on the response features; when the service fingerprint is normal, determining the Internet asset as disabled or abnormal based on the response features.

[0011] In a specific embodiment of this application, the detection request is an HTTP request; the method further includes: after obtaining the first response, performing dynamic JS loading to update the page content in the first response.

[0012] In a specific embodiment of this application, the detection request is an HTTP request, and the response features include a response code and page features.

[0013] In specific embodiments of this application, the response features further include HTTP header fingerprints, DOM structure features, and resource loading modes.

[0014] In specific embodiments of this application, the compliance verification includes at least one of the following: verifying whether the service exposing the Internet asset has been terminated; verifying whether the registration status of the domain name exposing the Internet asset is normal; verifying whether the Internet asset has been newly added or deleted from the asset list obtained or pre-entered; verifying whether the access control policy of the domain name exposing the Internet asset has been changed; verifying whether an unauthorized access portal closure event of the Internet asset has occurred; and assessing the impact of service shutdown or abnormal use of the service exposing the Internet asset.

[0015] In a specific embodiment of this application, the compliance verification of the abnormal event includes: in the event of an abnormal event that changes from failure to survival, if a preset first compliance condition is met, then the label of the Internet asset in the current round is determined to be compliant; otherwise, the label of the Internet asset in the current round is determined to be non-compliant, and the label of the Internet asset in the current round is updated to failure; wherein, the first compliance condition includes at least: the service exposing the Internet asset has not been terminated, and the registration status of the domain name exposing the Internet asset is normal, and it is determined that the Internet asset has been newly added to the asset list obtained or pre-entered.

[0016] In a specific embodiment of this application, the compliance verification of the abnormal event includes: in the event of an abnormal event where a live asset becomes invalid or fails, if a preset second compliance condition is met, the label of the Internet asset in the current round is determined to be compliant; otherwise, the label of the Internet asset in the current round is determined to be non-compliant, and the label of the Internet asset in the current round is updated to live. The second compliance condition includes at least: the access control policy of the domain name exposing the Internet asset has not been changed, and no unauthorized access entry closure event of the Internet asset has occurred, and the impact of the service shutdown or abnormal use of the Internet asset is assessed to be lower than a preset impact threshold.

[0017] A second aspect of this application provides an internet asset status assessment device, the device comprising: The first module is used to initiate a detection request for the Internet asset in the current round and obtain a first response, wherein the first response is a response matching the detection request; the second module is used to apply labels to the Internet asset to distinguish different asset states based on the first response, wherein the label corresponding to the in-use asset state is "alive", the label corresponding to the asset deactivated state is "invalid", the labels corresponding to various real abnormal asset states are various failure types, and the labels corresponding to various suspected abnormal asset states are various pending confirmation types; the third module is used to verify the label applied to the Internet asset in the current round and, based on the verification result, determine whether the label is correct or correct any incorrect labels if at least one of the following preset conditions is met: the label is the pending confirmation type; compare the labels of the Internet asset in the current round and the previous round to determine that there is an abnormal event, wherein the abnormal event includes at least one of "alive becomes invalid", "alive becomes failed", and "invalid becomes live".

[0018] A third aspect of this application provides a computer device comprising: a memory configured to store instructions; and a processor configured to retrieve the instructions from the memory and, when executing the instructions, to implement the Internet asset status assessment method according to a first aspect of this application.

[0019] A fourth aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the Internet asset status assessment method according to a first aspect of this application.

[0020] The fifth aspect of this application provides a computer program product, including a computer program, characterized in that the computer program, when executed by a processor, implements the Internet asset status assessment method according to the first aspect of this application.

[0021] In the aforementioned technical solution, internet assets are tagged based on multi-dimensional labels to distinguish internet assets in different states. These multi-dimensional labels cover various dimensions in the dynamic transformation process of internet asset states, comprehensively providing a preliminary identification of the internet asset state. Based on this, the verification operation of the current round of labels is performed, and the multi-dimensional labels facilitate the identification of multi-dimensional abnormal events. Therefore, this application achieves accurate identification and maintenance of internet asset states.

[0022] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0023] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 The diagram shown is a flowchart of the Internet asset status assessment method according to an embodiment of this application; Figure 2 The flowchart shown is for preparing the dataset; Figure 3 The diagram shows a flowchart for Internet asset detection and tagging; Figure 4 The diagram shown is an internal structural diagram of a computer device according to an embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0025] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0026] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0027] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant laws and regulations. Furthermore, it should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0028] Internet asset exposure typically includes URLs, domains, ports, services, IPs, filing information, domain registration information, components, and compliance status. Internal context data within an enterprise includes DNS resolution records, asset deployment locations, system ownership information, and public IP mappings. This internal context data usually originates from a CMDB (Configuration Management Database) management system.

[0029] In existing technologies, the process of detecting the survival of internet assets includes internet asset detection and survival status determination based on the detection data.

[0030] The main methods for detecting internet assets include the Ping command, the curl command, port scanning, and website anti-tampering. The Ping command, a basic network testing tool, is used to check domain name reachability by sending an ICP echo request to the target host and listening for the response to verify network connectivity. The curl command is a command-line tool that can be used to send various types of HTTP requests (GET, POST, etc.) and display the response results. Port scanning is a network security technology mainly used to probe open services or ports on a target host. The principle of port scanning is to send a network communication request to a specified port on the target host and then determine whether the port is open and the type of service running on it based on the received response. Website anti-tampering is a security technology that protects website content from unauthorized modification. It monitors website files and directories in real time, immediately triggering an alarm and logging any changes detected. This can be achieved through file integrity verification (such as MD5 or SHA-256 hash values) to ensure the consistency of file content.

[0031] The identification of the liveness status of internet assets mainly relies on security operations personnel, who verify the detection data obtained in the first step.

[0032] This application proposes improved technical solutions from the dimensions of Internet asset detection, labeling, and evaluation, and elaborates on them through the following embodiments.

[0033] Example 1 This application's first embodiment proposes an internet asset status assessment method based on an enterprise's existing internet asset domain name base table. Specifically, it refers to an internet asset status assessment method based on tagging internet assets with multi-dimensional labels.

[0034] Specifically, the aforementioned internet asset status assessment method includes: initiating a detection request for the internet asset in the current round, obtaining a first response, the first response being a response matching the detection request; applying labels to the internet asset based on the first response to distinguish different asset states, wherein the label corresponding to the in-use asset state is "alive," the label corresponding to the asset inactive state is "invalid," the labels corresponding to various real abnormal asset states are various failure types, and the labels corresponding to various suspected abnormal asset states are various pending confirmation types; verifying the labels applied to the internet asset in the current round under at least one of the following preconditions, and determining whether the label is correct or correcting any incorrect labels based on the verification result: the label is a pending confirmation type; comparing the labels of the internet asset in the current round with those in previous rounds to determine the existence of an abnormal event, the abnormal event including at least one of "alive becomes invalid," "alive becomes failed," and "invalid becomes live."

[0035] Understandably, a response to a matching detection request refers to the response from the receiving end of the detection request in response to that detection request.

[0036] In this regard, the above technical solution applies labels to internet assets based on the first response to distinguish different asset states. This involves labeling internet assets based on internet asset detection data and multi-dimensional label configuration information. The specific dimensions of the multi-dimensional labels include alive, invalid, failed, and pending confirmation, covering all dimensions of the dynamic transformation process of internet asset states. This provides a comprehensive initial identification of the internet asset state. Based on this, a verification operation for the current round of labels is performed. One trigger for verification is when the initially identified label is of the pending confirmation type; another trigger is when an abnormal event is determined through the time-series labels of the internet asset, such as alive becoming invalid, alive becoming failed, or invalid becoming alive. The verification operation is either a verification of the initial label or a correction after verification. Initially identifying internet assets based on the multi-dimensional label configuration matching the dynamic transformation process of internet asset states is the first step in improving the accuracy of internet state assessment. Verifying the initial label is the second step in improving the accuracy of internet state assessment. Furthermore, besides providing a more comprehensive identification of internet asset states, the multi-dimensional label configuration plays a crucial role in identifying diverse abnormal events in the second step, thus enhancing the maintainability of internet asset states. In summary, the above technical solutions achieve accurate identification of the status of Internet assets and have strong maintainability.

[0037] Based on the above technical solutions, such as Figure 1 As shown in one embodiment of this application, an Internet asset status assessment method is provided, including the following steps 202 to 206. Step 202: Initiate the current round of detection requests for Internet assets and obtain the first response, which is the response that matches the detection request.

[0038] In one specific implementation, the detection request is an HTTP request, which is a method of identifying the HTTP protocol.

[0039] In one specific implementation, the detection request is a network communication request initiated to the port of the Internet asset, hereinafter referred to as a port scanning request. The port scanning request is a TCP / UDP protocol identification method.

[0040] In one specific implementation, step 202 includes: invoking a protocol-based detection tool to initiate an HTTP detection request for the Internet asset in the current round based on the exposure surface data of the Internet asset, and obtaining the first response.

[0041] In one specific implementation, step 202 includes: invoking multiple protocol-based detection tools to initiate HTTP detection requests for the internet assets in the current round based on the exposure surface data of the internet assets, and obtaining multiple first responses; extracting response features of each first response; and using the response feature that appears most frequently among the multiple first responses as the final response feature, that is, the first response corresponding to the final response feature is used as the first response in subsequent steps. The exposure surface data of the internet assets is taken from the internet asset domain name base table, which stores internet asset information, including the exposure surface data of the internet assets and the actual context data of the enterprise.

[0042] Preferably, each HTTP request is made concurrently through multiple processes.

[0043] In an improved implementation, step 202 further includes: after obtaining the first response, performing dynamic JS loading to update the page content in the first response.

[0044] The improved technical solution described above introduces dynamic rendering crawler technology through dynamic loading of JS, which overcomes the shortcomings of traditional crawler technology in adapting to complex web scenarios. It can adapt to new web frameworks, thereby supporting the comprehensive extraction of response features.

[0045] Step 204: Based on the first response, apply labels to the internet assets to distinguish different asset states. Specifically, the label for assets in use is "alive," the label for assets out of use is "failed," the labels for various genuinely abnormal asset states are various failure types, and the labels for various suspected abnormal asset states are various pending confirmation types.

[0046] This is understandable, because response data obtained through detection methods such as protocol identification may contain various types of response anomalies. Therefore, there may be multiple true abnormal asset states, each corresponding to a label type defined through a pre-configuration process, i.e., a failure type label. Similarly, response data obtained through detection methods such as protocol identification may contain multiple suspected response anomalies awaiting confirmation. Therefore, there may be multiple suspected abnormal asset states, each corresponding to a label type defined through a pre-configuration process, i.e., a type of label awaiting confirmation.

[0047] In one specific implementation, a response feature fingerprint database is pre-constructed, where each record represents a different fingerprint, and a one-to-one correspondence is established between fingerprints representing response features and the states of internet assets. Based on this, step 204 includes: extracting response features from the first response; matching the response features with each fingerprint in the pre-constructed response feature fingerprint database, determining the asset state corresponding to the fingerprint that best matches the response features as the state of the internet asset; and applying a label to the internet asset corresponding to the internet asset state determined in the previous step.

[0048] For example, the similarity between the response feature and each fingerprint in the pre-set response feature fingerprint database is calculated, and the asset state corresponding to the fingerprint with the highest similarity to the response feature is determined as the state of the Internet asset.

[0049] For example, if the detection request is an HTTP request, the response characteristics include page features and response codes.

[0050] As is known, richer response features can more accurately tag internet assets. Therefore, in another example, response features include page features, response codes, HTTP header fingerprints, DOM structure features, and resource loading patterns. Among these, the HTTP header fingerprint refers to the combined characteristics and structural patterns of the request headers when initiating an HTTP detection request. DOM structure features refer to quantifiable or identifiable attributes extracted from the Document Object Model (DOM) that describe the structure and content organization of web pages.

[0051] Table 1 shows the pre-configured tag types in a specific embodiment of this application. Among them, "Live" corresponds to the asset in use status, "Invalid" corresponds to the asset out of use status, "Failure-Blank," "Failure," and "Failure-Special" each correspond to a failure type, and each failure type corresponds to a different real abnormal asset status. "Pending Confirmation" corresponds to the pending confirmation type, and the pending confirmation type corresponds to the suspected abnormal asset status. As can be seen from the aforementioned tag design, there is a certain dynamic transformation relationship between the tags, requiring multi-dimensional judgment.

[0052] Table 1

[0053] Step 206: If at least one of the preset conditions is met, verify the label applied to the Internet asset in the current round and determine whether the label is correct or correct any incorrect labels based on the verification results: The label applied to the Internet asset in the current round is a label of an unconfirmed type; compare the label of the Internet asset in the current round with at least one label in a previous round to determine that there is an abnormal event, and the abnormal event includes at least one of the following: survival changed to failure, survival changed to failure, and failure changed to survival.

[0054] In one specific implementation, when the label assigned to the Internet asset in the current round is of the type to be confirmed, the label assigned to the Internet asset in the current round is verified, and the label is determined to be correct or corrected if it is incorrect based on the verification result. Specifically, this includes: initiating a first manual verification instruction; obtaining a response that matches the first manual verification instruction; and updating the label of the Internet asset based on the response that matches the first manual verification instruction.

[0055] Understandably, the response to a manual verification instruction refers to the response made by security operations personnel in response to the manual verification instruction. The response content includes the verification result of the type label to be confirmed. The verification result can be: the status of the Internet asset is an asset in use, that is, the type label to be confirmed is corrected to an active label; or the verification result can be: the status of the Internet asset is an asset inactive, that is, the type label to be confirmed is corrected to an invalid label.

[0056] In the above technical solution, the label of the type to be confirmed is verified by manual verification.

[0057] In one specific implementation, when an abnormal event is determined to exist, the label applied to the Internet asset in the current round is verified, and the label is determined to be correct or corrected if it is incorrect based on the verification result. Specifically, this includes: performing compliance verification of the abnormal event, and updating the label of the Internet asset in the current round if the label is determined to be non-compliant based on the compliance verification result.

[0058] Specifically, compliance verification of internet asset status tags is based on internet asset information. By comparing the tags with various aspects of the internet asset information, it can be determined whether the tags for the current round of internet assets are compliant. Based on the aforementioned maintenance operations for internet asset status, the accuracy of internet asset status determination and the security performance of internet assets can be improved.

[0059] For example, compliance verification includes at least one of the following: verifying whether the service exposing the internet asset has been terminated; verifying whether the registration status of the domain name exposing the internet asset is normal; verifying whether internet assets have been newly added or deleted from the asset list obtained or pre-entered; verifying whether the access control policy of the domain name exposing the internet asset has been changed; verifying whether there has been an unauthorized event of closing the access portal of the internet asset; and assessing the impact of the service shutdown or abnormal use of the service exposing the internet asset.

[0060] In another specific implementation, step 206 includes steps a1 to a5.

[0061] Step a1: Initiate the first manual verification command.

[0062] Step a2: Obtain the response matching the first manual verification command.

[0063] Step a3: Update the tags of the Internet assets based on the response to the first manual verification instruction.

[0064] Step a4: Compare the tags of the current round and at least one of the previous rounds of Internet assets to determine whether there are any abnormal events. Abnormal events include at least one of the following: live changes to invalid, live changes to failure, invalid changes to live.

[0065] Step a5: If an abnormal event is identified, perform compliance verification for the abnormal event. If the compliance verification results indicate that the label of the current round of Internet assets is non-compliant, update the label of the current round of Internet assets.

[0066] Through steps a1 to a5, a human-machine collaborative assessment mechanism was implemented. This mechanism refers to the assessment and maintenance of the status of Internet assets through human-machine collaboration, which is more efficient than the existing technology that relies solely on manual verification.

[0067] In a specific implementation, the specific process of performing compliance verification for abnormal events includes: Step b1: In the event of an abnormal event that changes a failed asset to a live asset, if the pre-set first compliance condition is met, the label of the current round of Internet assets is determined to be compliant; otherwise, the label of the current round of Internet assets is determined to be non-compliant, and the label of the current round of Internet assets is updated to be invalid.

[0068] Specifically, the first compliance condition includes at least the following: the service exposing the internet asset has not been terminated, the domain name exposing the internet asset is in a normal filing status, and it is confirmed that the internet asset has been newly added to the asset list obtained or pre-entered.

[0069] In one example, if an abnormal event is detected in which a failure becomes a survival, a security control mechanism is also triggered, namely, a failure alarm is executed.

[0070] In the aforementioned technical solution, monitoring anomalies where a domain changes from invalid to active status can detect the "active" status of a "deactivated" domain. Domains that are normally deactivated cannot be active; this is due to errors such as incorrect access or lack of effective management records, requiring timely closure or status updates. Therefore, this application, upon identifying an anomaly where a domain changes from invalid to active status from multiple rounds of internet asset status analysis based on multi-dimensional tags, triggers an active status compliance verification. The response process for this active status compliance verification is as follows: judgment is made based on the first compliance condition. The first compliance condition considers at least three dimensions related to internet asset information: service termination verification, filing status check, and asset ledger update, thereby comprehensively evaluating the compliance of the active status.

[0071] In another specific implementation, the specific process for performing compliance verification of abnormal events includes: Step c1: In the event of an abnormal event where a live asset becomes invalid or fails, if the pre-defined second compliance condition is met, the label of the current round of internet assets is determined to be compliant; otherwise, the label of the current round of internet assets is determined to be non-compliant, and the label of the current round of internet assets is updated to live. Specifically, the second compliance condition includes at least the following: the access control policy of the domain name exposing the internet asset has not been changed, no unauthorized access to the internet asset has been closed, and the impact of the service shutdown or abnormal use of the exposed internet asset is assessed to be lower than the pre-defined impact threshold.

[0072] In the aforementioned technical solution, monitoring the abnormal events indicating a change from live to inactive or failed can detect anomalies in "in-use" services, specifically the "inactive or failed" status of "in-use" domains. Previously live services should continue to provide access; if failure or inactivity occurs (abnormal HTTP request response codes or service response interruptions), it may be due to unauthorized closure of access points or the addition of address access restrictions, requiring further investigation to avoid unauthorized offline impacts on user experience or erroneous maintenance. Therefore, this application, upon confirming an abnormal event of "live becoming inactive or failed" from multiple rounds of internet asset status analysis based on multi-dimensional tags, triggers a liveness status compliance verification. The response process for this liveness status compliance verification involves a second compliance condition. This second compliance condition considers at least three dimensions based on internet asset information: verification of whether access control policies have changed, investigation of unauthorized offline behavior, and assessment of the impact of service degradation, thereby comprehensively evaluating the compliance of the liveness status and meeting the requirements for service continuity assurance.

[0073] The aforementioned technical solution brings three improvements: 1) Enhanced accuracy in assessing the status of internet assets strengthens the effectiveness of internet asset status assessment; 2) Improved security of internet assets through compliance verification; and 3) Enhanced maintainability of internet asset status. These three improvements are primarily achieved through multi-dimensional tag design, the application of multi-dimensional tags in internet asset maintenance, and compliance verification combining multi-dimensional internet asset information.

[0074] The following is a specific application of the above embodiment, which mainly includes the following steps S1 to S3.

[0075] Step S1, Dataset Preparation. This mainly includes: accessing the exposure surface data of internet assets through a big data analytics platform; processing the exposure surface data; and integrating the exposure surface data with the CMDB management system data to form a comprehensive asset data fingerprint database.

[0076] like Figure 2 As shown in Table 2, step S1 specifically includes: exporting and manually collecting internet exposure surface data; data parsing; data standardization; and adding fields. The auxiliary fields added in the appended fields are used for security interactions in the subsequent internet asset detection process based on the detection request and response process. These auxiliary fields include the MD5 value of the request header, the MD5 value of the request body, and the request body length.

[0077] Table 2

[0078] Step S2 involves performing internet asset detection and tagging. See [link / reference] Figure 3Table 3 mainly includes the following steps: obtaining full asset information; starting a multi-threaded detection task; initiating an HTTP detection request based on the URL field content; tagging internet assets based on the tag configuration shown in Table 1 and the response to the HTTP detection request; and storing internet asset tags.

[0079] Table 3

[0080] Step S3: Perform an assessment and maintenance of the Internet asset status.

[0081] Mainly includes: 1) Maintenance of the "liveliness" of URLs for "non-discontinued" domains, i.e. manual verification for types to be confirmed, including steps a1 to a3.

[0082] 2) If the page feature of an Internet asset marked "Failure-Special" does not belong to the page feature corresponding to the inaccessible situation in the current "Error Page Feature Tag Library", then add the page feature to the Error Page Feature Tag Library to enrich the Error Page Feature Tag Library.

[0083] 3) Establish a whitelist of Internet assets marked as "alive" and continuously record the results of each probe to maintain the Internet asset whitelist.

[0084] 4) Focus on discovering the "liveliness" status of "discontinued" domain names, i.e., execute step b1 and trigger the security control mechanism, i.e., execute the failure alarm.

[0085] 5) Focus on identifying "invalid" or "failed" cases of "in-use" domain names, i.e., execute step c1.

[0086] This application can also detect abnormal events such as frequent online / offline cycles and the addition of new interfaces without proper registration.

[0087] Through the above steps S1 to S3, efficient and accurate assessment and maintenance of Internet asset status are achieved.

[0088] Example 2 This application's second embodiment proposes an internet asset status assessment method based on an enterprise's existing internet asset domain name base table, specifically a status assessment method based on an intelligent tag management system.

[0089] In the first specific implementation, the intelligent tag management system uses intelligent means to tag the status of Internet assets.

[0090] In the second specific implementation, the intelligent tagging management system uses a combination of intelligent methods and manual review to tag the status of internet assets.

[0091] In the third specific implementation, the intelligent tag management system combines intelligent methods and manual review to tag the status of Internet assets and establishes a connection between Internet asset tags and CMDB management system, vulnerability database, etc.

[0092] Regarding the first specific implementation, the difference between Embodiment 2 and Embodiment 1 of this application is as follows: The specific process of applying labels to internet assets to distinguish different asset states according to the first response includes: Step d1 involves using a pre-trained deep learning model to perform data inference on the first response and identify response features.

[0093] Step d2 involves matching the identified response features with each fingerprint in the pre-set response feature fingerprint database, and determining the asset status corresponding to the fingerprint that best matches the response features as the status of the Internet asset.

[0094] Step d3: Apply a label to the Internet asset corresponding to the determined Internet asset state.

[0095] In the above technical solution, given the high-precision recognition capability of deep learning models, the automatic, rapid and accurate recognition of response features is achieved.

[0096] For example, the deep learning model is integrated into the natural language model, and the response features are identified by calling the natural language model to perform data reasoning for the first response.

[0097] For example, after a natural language model identifies a response feature, it performs a similarity calculation between the response feature and each fingerprint in the response feature fingerprint database, and determines the asset state corresponding to the fingerprint with the highest similarity to the response feature as the state of the internet asset.

[0098] Based on the first specific implementation mentioned above, the efficiency and accuracy of internet asset status assessment and maintenance are further improved.

[0099] Regarding the second specific implementation described above, the difference between Embodiment 2 and Embodiment 1 of this application is as follows: The specific process of applying labels to internet assets to distinguish different asset states according to the first response includes: Step e1: Use a pre-trained deep learning model to perform data inference on the first response and identify response features.

[0100] Step e2 involves matching the identified response features with each fingerprint in a pre-set response feature fingerprint database.

[0101] Step e3: Determine whether the matching degree between the fingerprint that best matches the response feature and the response feature is lower than the preset matching threshold. If so, initiate the second manual verification instruction and execute step e4; otherwise, proceed to step e6.

[0102] Step e4: Obtain the response matching the second manual verification command.

[0103] Step e5: Determine the status of the Internet asset based on the response to the matching second manual verification instruction.

[0104] Step e6: Apply a label to the Internet asset corresponding to the determined Internet asset state.

[0105] The above technical solution combines the high-precision recognition capability of deep learning models with the accuracy of manual verification, achieving a fast and accurate labeling process.

[0106] Regarding the third specific implementation mentioned above, the difference between Embodiment 2 and Embodiment 1 is that: after applying a tag to the Internet asset to distinguish different asset states according to the first response, a one-to-one correspondence is established between the tag of the Internet asset and the Internet asset information in the CMDB management system.

[0107] For example, based on structured tags, the database establishes a mapping relationship between the structured tags of internet assets and the first response of internet assets. At the same time, it also establishes a mapping relationship between the structured tags of internet assets and the information of the internet assets in the CMDB management system, which facilitates the subsequent assessment and maintenance of the status of internet assets.

[0108] Specifically, in step c1, based on the structured tags of the Internet asset and the mapping relationship between the Internet asset information in the CMDB management system, the service status of the exposed Internet asset and the registration status of the domain name of the exposed Internet asset are obtained.

[0109] Specifically, in step d1, based on the structured tags of the Internet asset and the mapping relationship between the Internet asset information in the CMDB management system, the access control policy of the domain name exposing the Internet asset and the access entry status of the Internet asset are obtained.

[0110] Furthermore, a one-to-one correspondence is established between the tags of internet assets and the associated vulnerability data of those internet assets in the vulnerability management system.

[0111] Specifically, the method for assessing the status of internet assets also includes: identifying the vulnerability risks of internet assets based on the one-to-one correspondence between the tags of internet assets and the vulnerability data associated with those internet assets in the vulnerability management system, thereby enhancing the security of internet assets while also taking into account the efficiency of security identification.

[0112] For example, by combining vulnerability scanning and penetration testing, vulnerability risks to internet assets can be identified, and risk alerts can be triggered. The types of vulnerabilities identified include high-risk interface exposure, high-risk port opening, and weak passwords.

[0113] Example 3 This application's third embodiment proposes an internet asset status assessment method based on an enterprise's existing internet asset domain name base table. Specifically, it refers to an internet asset status assessment method based on multi-dimensional asset detection.

[0114] Specifically, the difference between Embodiment 3 of this application and the two embodiments described above is as follows: The process of initiating the current round of detection requests for internet assets and obtaining the first response includes: The process involves: obtaining the port of an internet asset from its exposure surface data; initiating a network communication request to that port and obtaining a response matching the request; obtaining the URL of the internet asset from its exposure surface data; initiating an HTTP request to that URL and obtaining a response matching the request; determining the port status and service fingerprint of the internet asset based on the response matching the request; obtaining response characteristics from the response matching the HTTP request; performing cross-validation among the port status, service fingerprint, and response characteristics; if the cross-validation passes, using the latest response matching the HTTP request as the first response; otherwise, reverting to obtaining the port of the internet asset from its exposure surface data and initiating a network communication request to that port.

[0115] In the above technical solution, based on multi-dimensional asset detection, after obtaining multi-dimensional asset detection data, namely matching the response of the network communication request and matching the response of the HTTP request, the accuracy of Internet asset detection is improved compared with a single detection method through cross-verification of the port status, the service fingerprint and the response features.

[0116] In one specific implementation, cross-validation is performed between the port status, the service fingerprint, and the response characteristics. If the cross-validation passes, the response matching the latest state of the HTTP request is taken as the first response; otherwise, the process redirects to the port for obtaining the Internet asset from the Internet asset exposure surface data and initiates a network communication request to that port, specifically including: If at least one of the preset verification rules is met, the process jumps to the port for obtaining the Internet asset from the exposure surface data of the Internet asset and initiates a network communication request to the port; otherwise, the process proceeds to the next step. The response that matches the latest status of the HTTP request will be used as the first response; The verification rules include: when the port status is closed, the Internet asset is determined to be in use based on the response characteristics; when the service fingerprint is normal, the Internet asset is determined to be in a disabled or abnormal state based on the response characteristics.

[0117] For example, the process of initiating a detection request for internet assets in the current round and obtaining the first response specifically includes steps f1 to f6.

[0118] Step f1: Obtain the port of the Internet asset from the exposure surface data of the Internet asset, initiate a network communication request to the port, and obtain a response matching the network communication request.

[0119] Step f2: Obtain the URL of the Internet asset from the exposure surface data of the Internet asset, send an HTTP request to the URL, and obtain a response that matches the HTTP request.

[0120] Step f3: Determine the port status and service fingerprint of the Internet asset based on the response matching the aforementioned network communication request.

[0121] Step f4: Obtain response characteristics from the responses that match the HTTP request.

[0122] Step f5: If at least one of the preset verification rules is met, proceed to step f1; otherwise, proceed to the next step.

[0123] The verification rules include: when the port status is closed, the Internet asset is determined to be in use based on the response characteristics; when the service fingerprint is normal, the Internet asset is determined to be in a disabled or abnormal state based on the response characteristics.

[0124] Step f6: Take the response to the latest matching HTTP request as the first response; In a specific application, a detection cluster based on a microservice architecture is invoked to initiate the current round of detection requests for internet assets and obtain the first response. This detection cluster integrates a protocol stack feature analysis engine, a rendering crawler module, and an AI content recognition module. The protocol stack feature analysis engine performs TCP / UDP / HTTP protocol identification and deep parsing, for example, executing steps f1 to f6.

[0125] The rendering crawler module executes dynamic JavaScript loading for recognition. The AI ​​content recognition module integrates the aforementioned deep learning model and determines the fingerprint with the highest similarity to the response features extracted by the deep learning model by querying the response feature fingerprint database. It then outputs a label corresponding to the state of the internet asset, thus completing the labeling of the internet asset. The module also includes an instruction interaction module, through which a second manual verification instruction is issued.

[0126] The following is a specific application of the above embodiment, which mainly includes the following steps SS1 to SS3.

[0127] Step SS1, Dataset Preparation. (e.g.) Figure 2 As shown, this mainly includes: accessing the exposure surface data of Internet assets through a big data analytics platform; processing the exposure surface data; and integrating the exposure surface data with the CMDB management system data to form a comprehensive asset data fingerprint database.

[0128] Step SS2 involves performing internet asset detection and tagging. See [link / reference] Figure 3 Table 3 mainly includes the following steps: obtaining full asset information; starting a multi-threaded detection task; invoking the detection cluster to initiate the current round of detection requests for Internet assets and obtaining the first response; invoking the AI ​​content recognition module and the pre-set response feature fingerprint library in the detection cluster to tag Internet assets based on the tag configuration shown in Table 1 and the first response; and storing Internet asset tags.

[0129] Step SS3: Perform an assessment and maintenance of the status of Internet assets.

[0130] Mainly includes: 1) Maintenance of the "liveliness" of URLs for "non-discontinued" domains, i.e. manual verification for types to be confirmed, including steps a1 to a3.

[0131] 2) If the response page feature of an Internet asset marked "Failure-Special" does not belong to the response page feature corresponding to the inaccessible situation in the current "Error Page Feature Tag Library", then add the response page feature to the Error Page Feature Tag Library to enrich the Error Page Feature Tag Library.

[0132] 3) Establish a whitelist of Internet assets marked as "alive" and continuously record the results of each probe to maintain the Internet asset whitelist.

[0133] 4) Focus on discovering the "liveliness" status of "discontinued" domain names, i.e., execute step b1 and trigger the security control mechanism, i.e., execute the failure alarm.

[0134] 5) Focus on identifying "invalid" or "failed" cases of "in-use" domain names, i.e., execute step c1.

[0135] 6) Identify vulnerabilities and risks in internet assets and trigger risk alerts.

[0136] Through the above steps SS1 to SS3, efficient and accurate assessment and maintenance of Internet asset status are achieved, ensuring the effectiveness, stability and security of Internet assets.

[0137] Figure 1 This is a flowchart illustrating an internet asset status assessment method in one embodiment. It should be understood that, although... Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0138] Based on the internet asset status assessment method provided in the above embodiments, this application provides an internet asset status assessment device, comprising: a first module, configured to initiate a detection request for the internet asset in the current round and obtain a first response, wherein the first response is a response matching the detection request; a second module, configured to apply labels to the internet asset to distinguish different asset states according to the first response, wherein the label corresponding to the in-use asset state is "alive," the label corresponding to the asset deactivated state is "invalid," the labels corresponding to various real abnormal asset states are various failure types, and the labels corresponding to various suspected abnormal asset states are various pending confirmation types; a third module, configured to verify the labels applied to the internet asset in the current round and determine whether the label is correct or correct any incorrect labels based on the verification results if at least one of the following preset conditions is met: the label is the pending confirmation type; comparing the labels of the internet asset in the current round and the previous round to determine that an abnormal event exists, wherein the abnormal event includes at least one of "alive becomes invalid," "alive becomes failed," and "invalid becomes live."

[0139] As an embodiment of this application, the Internet asset status assessment device can achieve the following: Figure 1 The embodiments shown and other related method embodiments in this application. The process by which each module in the Internet asset status assessment device provided in this application implements its respective function can be specifically referred to the foregoing. Figure 1 The descriptions of the embodiments shown and other related method embodiments are not repeated here.

[0140] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0141] This application provides a machine-readable storage medium storing a program that, when executed by a processor, implements the aforementioned Internet asset status assessment method.

[0142] This application provides a processor for running a program, wherein the program executes the above-described Internet asset status assessment method during runtime.

[0143] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 4 As shown in the figure, the computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05, and a memory (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A06. The network interface A02 is used for communication with external terminals via a network connection. When the computer program is executed by the processor A01, it implements an internet asset status assessment method. The display screen A04 can be a liquid crystal display (LCD) or an e-ink display. The input device A05 can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0144] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0145] In one embodiment, the Internet asset status assessment device provided in this application can be implemented as a computer program, which can be implemented in various ways, such as... Figure 4The device operates on the computer shown. The computer device's memory can store various program modules that make up the Internet asset status assessment apparatus. The computer program, composed of these program modules, causes the processor to execute the steps in the Internet asset status assessment methods of the various embodiments of this application described in this specification.

[0146] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing a program that initializes the steps of the above-described Internet asset status assessment method.

[0147] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.

[0151] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0152] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0153] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0154] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0155] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for assessing the status of internet assets, characterized in that, The method includes: Initiate a detection request for Internet assets in the current round, and obtain a first response, wherein the first response is a response that matches the detection request; According to the first response, the Internet assets are labeled to distinguish different asset states, wherein the label corresponding to the in-use asset state is "alive", the label corresponding to the asset deactivated state is "invalid", the labels corresponding to various real abnormal asset states are various failure types, and the labels corresponding to various suspected abnormal asset states are various pending confirmation types. The Internet assets described in the current round will be subject to at least one of the following preconditions. The applied label is verified and the label is determined to be correct or corrected if it is incorrect based on the verification result: the label is the type to be confirmed; the labels of the Internet assets in the current round and in the previous round are compared to determine that there is an abnormal event, the abnormal event including at least one of live becoming invalid, live becoming failed, and invalid becoming live.

2. The method for assessing the status of internet assets according to claim 1, characterized in that, When the label assigned to the internet asset in the current round is of the unconfirmed type, the process of verifying the label assigned to the internet asset in the current round and determining whether the label is correct or correcting an incorrect label based on the verification result includes: Initiate the first manual verification command; Obtain a response that matches the first manual verification command; The tags of the Internet assets are updated based on the response matching the first manual verification instruction.

3. The method for assessing the status of internet assets according to claim 1 or 2, characterized in that, In the event of the aforementioned abnormal event, the verification of the tag applied to the Internet asset in the current round and the determination of whether the tag is correct or to correct an incorrect tag based on the verification result include: Perform compliance verification for the aforementioned abnormal event. If the compliance verification results determine that the label of the Internet asset in the current round is non-compliant, update the label of the Internet asset in the current round.

4. The method for assessing the status of internet assets according to claim 1, characterized in that, The step of applying a label to the internet asset to distinguish different asset states based on the first response includes: Data inference is performed on the first response using a pre-trained deep learning model to identify response features; The response feature is matched with each fingerprint in the preset response feature fingerprint database, and the asset status corresponding to the fingerprint that best matches the response feature is determined as the status of the Internet asset. A label corresponding to the determined state of the Internet asset is applied to the Internet asset.

5. The method for assessing the status of internet assets according to claim 1, characterized in that, The step of applying a label to the internet asset to distinguish different asset states based on the first response includes: Data inference is performed on the first response using a pre-trained deep learning model to identify response features; The response features are matched with each fingerprint in a preset response feature fingerprint database; Determine whether the degree of matching between the fingerprint that best matches the response feature and the response feature is lower than a preset matching threshold; if so, initiate a second manual verification instruction and proceed to the next step; otherwise, determine the asset state corresponding to the fingerprint that best matches the response feature as the state of the Internet asset and apply a label corresponding to the determined state of the Internet asset to the Internet asset. Obtain a response that matches the second manual verification command; The state of the Internet asset is determined based on the response to the second manual verification instruction, and a label corresponding to the determined state of the Internet asset is applied to the Internet asset.

6. The method for assessing the status of internet assets according to claim 1, characterized in that, The process of initiating the current round of detection requests for internet assets and obtaining the first response includes: Obtain the port of the Internet asset from the exposure surface data of the Internet asset, initiate a network communication request to the port, and obtain a response matching the network communication request; Obtain the URL of the Internet asset from the exposure surface data of the Internet asset, initiate an HTTP request to the URL, and obtain a response matching the HTTP request; The port status and service fingerprint of the Internet asset are determined based on the response matching the network communication request. Obtain response characteristics from the responses that match the HTTP request; If at least one of the preset verification rules is met, the process jumps to the port for obtaining the Internet asset from the exposure surface data of the Internet asset and initiates a network communication request to the port; otherwise, the process proceeds to the next step. The response that matches the latest status of the HTTP request will be used as the first response; The verification rules include: when the port status is closed, the Internet asset is determined to be in use based on the response characteristics; when the service fingerprint is normal, the Internet asset is determined to be in a disabled or abnormal state based on the response characteristics.

7. The method for assessing the status of internet assets according to claim 1, characterized in that, The detection request is an HTTP request; the method further includes: After receiving the first response, execute JavaScript to dynamically load and update the page content in the first response.

8. The method for assessing the status of internet assets according to claim 4 or 5, characterized in that, The detection request is an HTTP request, and the response features include a response code and page features.

9. The method for assessing the status of internet assets according to claim 8, characterized in that, The response characteristics also include HTTP header fingerprints, DOM structure characteristics, and resource loading modes.

10. The method for assessing the status of internet assets according to claim 3, characterized in that, The compliance verification includes at least one of the following: verifying whether the service exposing the Internet asset has been terminated; verifying whether the registration status of the domain name exposing the Internet asset is normal; verifying whether the Internet asset has been newly added or deleted from the asset list obtained or pre-entered. Has the access control policy for the domain name exposing the Internet asset been changed? Did an unauthorized access to the aforementioned internet asset occur? Assess the impact of service outages or abnormal usage of the exposed internet asset.

11. The method for assessing the status of internet assets according to claim 3, characterized in that, Perform compliance verification of the aforementioned abnormal event, including: In the event of an abnormal event where a failed asset becomes a live asset, if the pre-defined first compliance condition is met, the label of the Internet asset in the current round is determined to be compliant; otherwise, the label of the Internet asset in the current round is determined to be non-compliant, and the label of the Internet asset in the current round is updated to fail. The first compliance condition includes at least the following: the service exposing the Internet asset has not been terminated, the domain name exposing the Internet asset is in normal filing status, and it is determined that the Internet asset has been newly added to the asset list obtained or pre-entered.

12. The method for assessing the status of internet assets according to claim 3, characterized in that, Perform compliance verification of the aforementioned abnormal event, including: In the event of an abnormal event where a live asset becomes invalid or fails, if the pre-defined second compliance condition is met, the label of the Internet asset in the current round is determined to be compliant; otherwise, the label of the Internet asset in the current round is determined to be non-compliant, and the label of the Internet asset in the current round is updated to live. The second compliance condition includes at least the following: the access control policy of the domain name exposing the Internet asset has not been changed, and no unauthorized access to the Internet asset has been closed, and the impact of the service shutdown or abnormal use of the Internet asset is assessed to be lower than the preset impact threshold.

13. An internet asset status assessment device, characterized in that, The device includes: The first module is used to initiate a detection request for Internet assets in the current round and obtain a first response, wherein the first response is a response that matches the detection request; The second module is used to apply labels to the Internet assets to distinguish different asset states according to the first response, wherein the label corresponding to the in-use asset state is "alive", the label corresponding to the asset deactivated state is "invalid", the labels corresponding to various real abnormal asset states are various failure types, and the labels corresponding to various suspected abnormal asset states are various pending confirmation types. The third module is used to verify the label applied to the Internet asset in the current round and to determine whether the label is correct or to correct an incorrect label based on the verification result, provided that at least one of the following preset conditions is met: the label is the type to be confirmed; and to compare the labels of the Internet asset in the current round and in the previous round to determine that there is an abnormal event, wherein the abnormal event includes at least one of the following: alive becomes invalid, alive becomes failed, and invalid becomes alive.

14. A computer device, characterized in that, include: The memory is configured to store instructions; as well as A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the Internet asset status assessment method according to any one of claims 1 to 12.

15. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the Internet asset status assessment method according to any one of claims 1 to 12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the Internet asset status assessment method according to any one of claims 1 to 12.

Images