Asset fingerprint identification method and device of intranet host
By using stateless scanning and matching with an asset fingerprint database, the problem of low efficiency in traditional intranet host asset management is solved, enabling efficient and accurate intranet asset identification and security risk monitoring.
Patent Information
- Application Number
- CN202511574013.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-31
- Publication Date
- 2026-02-27
AI Technical Summary
Traditional methods of managing intranet host assets are insufficient to meet rapidly changing needs and cannot efficiently identify and manage host assets in complex and ever-changing intranet environments.
Stateless scanning technology is used to acquire live hosts on the internal network, asset information is obtained through preset scanning rules, and an asset fingerprint feature database is established. This database is then matched and identified in conjunction with the asset information table to monitor asset anomalies and perform vulnerability scanning.
It improves the accuracy and efficiency of intranet asset management, enabling rapid identification of intranet asset fingerprints and timely detection of potential security risks.
Smart Images
Figure CN121582974A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of internal network asset management, and particularly relates to a method for identifying asset fingerprints of internal network hosts and a device applying the method. BACKGROUND
[0002] With the rapid development of information technology, enterprises and institutions are facing more and more network security threats and risks. Understanding the accurate asset information of internal network hosts is crucial for effective management and protection of the network.
[0003] The number of hosts in the internal network environment can be large and diverse, and traditional asset management methods cannot meet the rapidly changing needs. Therefore, developing an automated host asset identification method can improve management efficiency and accuracy. Host fingerprint identification technology extracts feature information of target hosts, including but not limited to device type, operating system, open port and service characteristics, etc. Through fingerprint identification technology, asset management is more efficient. SUMMARY
[0004] In view of the above background, the application aims to provide a method and device for identifying asset fingerprints of internal network hosts to cope with complex and variable internal network environments.
[0005] In the first aspect, a method for identifying asset fingerprints of internal network hosts is provided, comprising: acquiring live hosts of the internal network through stateless scanning, and scanning target assets selected from the live hosts according to a preset scanning rule to obtain asset information; the scanning rule includes a correspondence between port protocols and asset information types, and when the port protocols of the live hosts are acquired through stateless scanning, the corresponding type of asset information of the hosts is automatically scanned according to the correspondence; extracting asset fingerprints from the scanned asset information, including adding the scanning result to a preset asset information table, and adding a fingerprint mark to the asset information if the asset information matches the preset asset fingerprint feature library successfully.
[0006] The above-mentioned stateless scanning includes sending a SYN request connection data packet to the target host, sending an RST end connection data packet to the target host when a SYN / ACK confirmation connection data packet from the target host is received, recording the IP and open port of the responding target host, and marking the host as live.
[0007] The above-mentioned asset fingerprint identification further includes establishing an asset fingerprint feature library before the asset fingerprint identification: acquiring a first feature group of a known asset type, and combining at least two first feature groups into a fingerprint feature library of the type of asset; The first feature group includes a keyword of one of asset state information, asset system information, asset network information, and asset application information; the asset state information includes online or offline, physical location, and affiliated organization, the asset system information includes system version and host name, the asset network information includes IP, service, port, and protocol of the asset, and the asset application information includes application name and version on the asset.
[0008] Preferably, the method further comprises monitoring changes in asset information: creating a monitoring rule including a monitoring target, a monitoring period, and a monitoring type, and if the information of the corresponding type of the monitoring target in the monitoring period is inconsistent with the asset information table, determining that a change has occurred in the asset, accumulating the number of change occurrences until triggering an alarm threshold.
[0009] Preferably, the method further comprises performing a vulnerability scan on asset system information and asset application information, including determining whether the system of the target asset has a weak password, and calling a preset vulnerability library according to the system and application version of the target asset to perform a scan.
[0010] Further, calling a preset vulnerability library according to the application version of the target asset to perform a scan includes: obtaining an application name, a version, and an installation directory through a registry path of the target asset, calling a corresponding vulnerability library according to the obtained application name and version, and scanning whether there is a vulnerability in the installation directory.
[0011] In a second aspect, an intranet host asset fingerprint identification device is provided to implement the asset fingerprint identification method described above, and the device comprises: An asset information scanning module obtains live hosts in an intranet through stateless scanning, and scans a target asset selected from the live hosts according to a preset scanning rule to obtain asset information; the scanning rule includes a correspondence between a port protocol and an asset information type, and when the port protocol of a live host is obtained through stateless scanning, the corresponding type of asset information of the host is automatically scanned according to the correspondence. An asset fingerprint identification module extracts asset fingerprints from the scanned asset information, including adding a scanning result to a preset asset information table, and adding a fingerprint mark to the asset information if the asset information is successfully matched with a preset asset fingerprint feature library.
[0012] Preferably, the stateless scanning of the asset information scanning module includes sending a SYN request connection data packet to a target host, sending an RST end connection data packet to the target host after receiving a SYN / ACK confirmation connection data packet from the target host, recording the IP and open port of the responding target host, and marking the host as live.
[0013] Preferably, the asset fingerprint feature library of the asset fingerprint identification module includes keywords of one of asset state information, asset system information, asset network information, and asset application information.
[0014] Further, the device further comprises: an asset change monitoring module, if the corresponding type of information of the monitoring target in the monitoring period is inconsistent with the asset information table, it is judged that the asset has a change; an asset vulnerability scanning module, judging whether the system of the target asset exists a weak password, and scanning according to the system and application version of the target asset and calling the preset vulnerability library.
[0015] The application adopting the above technical scheme has at least the following beneficial effects: firstly, the survival host in the internal network is determined by the stateless scanning port mode, which can avoid the collection of offline or invalid host information, and improve the accuracy of information scanning; secondly, the detailed asset information is further automatically obtained according to the preset corresponding relationship between the port protocol and the asset information type, which improves the management efficiency of the information scanning task; finally, the asset fingerprint information is identified by matching the obtained asset information with the fingerprint feature library, which can quickly and comprehensively identify the internal network asset fingerprint. At the same time, the asset change monitoring and the asset vulnerability scanning are realized based on the asset information, which is beneficial to timely discovering the potential security risks of the internal network host. BRIEF DESCRIPTION OF DRAWINGS
[0016] Figure 1 For the internal network host asset fingerprint identification method embodiment of the application, a work flow schematic diagram is shown. Figure 2 For the internal network host asset fingerprint identification device embodiment of the application, a module composition schematic diagram is shown. DETAILED DESCRIPTION
[0017] The application will be further described in detail below in combination with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related content of the application, and not to limit the application. In addition, it should be noted that, for the convenience of description, only the parts related to the application are shown in the drawings.
[0018] The purpose of host asset fingerprint identification is to help organizations effectively manage their network assets. By identifying and recording the fingerprint information of each host, including the type of operating system, installed software, configuration, etc., the network environment can be more accurately understood and its changes can be tracked, which helps to assess the security risks of assets, timely discover potential security vulnerabilities, unauthorized devices or software, etc., and help organizations to reinforce security protection measures as early as possible.
[0019] Common host fingerprints include: the host's operating system (e.g., Windows, Linux, macOS); the specific applications running on the host, such as web servers (Apache, Nginx, etc.), databases (e.g., MySQL, PostgreSQL), mail servers (e.g., Exim, Postfix); network services running on the host, such as SSH, HTTP, FTP, Telnet, etc.; the version numbers of the applications and services; and specific characteristics such as open ports, running processes, and installed software packages.
[0020] The embodiments of the present invention aim to provide an efficient and accurate host asset fingerprinting method and apparatus. like Figure 1 As shown, an embodiment of an asset fingerprinting method for intranet hosts includes: The system obtains live hosts on the intranet through stateless scanning, and scans target assets selected from the live hosts according to preset scanning rules to obtain asset information. The scanning rules include the correspondence between port protocols and asset information types. After obtaining the port protocols of live hosts through stateless scanning, the system automatically scans for the corresponding type of asset information of the host according to the correspondence.
[0021] Establish an asset fingerprint feature database: Obtain a first feature group of known asset types, and combine at least two of the first feature groups to form a fingerprint feature database for that type of asset; the first feature group includes keywords of one of the following: asset status information, asset system information, asset network information, and asset application information; the asset status information includes whether the asset is online or offline, its physical location, and its affiliated organization; the asset system information includes the system version and hostname; the asset network information includes the asset's IP address, service, port, and protocol; and the asset application information includes the application name and version on the asset.
[0022] Extracting asset fingerprints from scanned asset information includes adding the scan results to a preset asset information table. If the asset information matches a preset asset fingerprint feature library, a fingerprint tag is added to the asset information.
[0023] As a preferred implementation, stateless scanning includes sending a SYN request connection packet to the target host, and after receiving a SYN / ACK confirmation connection packet from the target host, sending an RST termination connection packet to the target host, recording the responding target host IP and open port, and marking the host as alive.
[0024] As a preferred implementation, the method further includes monitoring asset information anomalies: creating monitoring rules that include monitoring targets, monitoring periods, and monitoring types; if the information of the corresponding type of the monitoring target within the monitoring period is inconsistent with the asset information table, it is determined that the asset has an anomaly, and the number of anomaly occurrences is accumulated until an alarm threshold is triggered.
[0025] As a preferred implementation, the method further includes performing vulnerability scanning on asset system information and asset application information, including determining whether the target asset's system has weak passwords, and calling a preset vulnerability database to perform scanning based on the target asset's system and application versions.
[0026] Furthermore, based on the application version of the target asset, a preset vulnerability database is invoked for scanning, including: obtaining the application name, version, and installation directory by searching the registry path of the target asset, and invoking the corresponding vulnerability database based on the obtained application name and version to scan the installation directory for vulnerabilities.
[0027] The aforementioned embodiment of the intranet host asset fingerprinting method first identifies live hosts within the intranet through stateless port scanning, avoiding the collection of information on offline or invalid hosts and improving the accuracy of information scanning. Secondly, it automatically acquires detailed asset information based on a preset correspondence between port protocols and asset information types, improving the management efficiency of the information scanning task. Finally, it matches the acquired asset information with a fingerprint feature database to identify the asset's fingerprint information, enabling rapid and comprehensive identification of intranet asset fingerprints. Simultaneously, it enables asset anomaly monitoring and asset vulnerability scanning based on asset information, facilitating the timely discovery of potential security risks to intranet hosts.
[0028] like Figure 2 As shown, an embodiment of an intranet host asset fingerprinting device implements the asset fingerprinting method described above. The device includes: The asset information scanning module acquires live hosts on the intranet through stateless scanning and scans selected target assets from these live hosts according to preset scanning rules to obtain asset information. These scanning rules include a mapping between port protocols and asset information types. Once the port protocols of a live host are acquired through stateless scanning, the module automatically scans for the corresponding type of asset information on that host based on this mapping. The asset fingerprint recognition module extracts asset fingerprints from the scanned asset information, including adding the scan results to a preset asset information table. If the asset information matches the preset asset fingerprint feature library, a fingerprint mark is added to the asset information.
[0029] The asset anomaly monitoring module determines that an asset has undergone an anomaly if the information of the corresponding type of the monitored target within the monitoring period is inconsistent with the asset information table. The asset vulnerability scanning module determines whether the target asset's system has weak passwords and scans the system and application versions of the target asset using a preset vulnerability database.
[0030] As a preferred implementation, the stateless scanning of the asset information scanning module includes sending a SYN request connection data packet to the target host, and after receiving a SYN / ACK confirmation connection data packet from the target host, sending an RST connection termination data packet to the target host, recording the responding target host IP and open port, and marking the host as alive.
[0031] As a preferred implementation, the asset fingerprint recognition module's asset fingerprint feature library includes keywords from one of the following: asset status information, asset system information, asset network information, and asset application information.
[0032] The aforementioned embodiment of the intranet host asset fingerprinting device first identifies live hosts within the intranet through stateless port scanning, avoiding the collection of information from offline or invalid hosts and improving the accuracy of information scanning. Secondly, it automatically acquires detailed asset information based on a preset correspondence between port protocols and asset information types, improving the management efficiency of the information scanning task. Finally, it matches the acquired asset information with a fingerprint feature database to identify the asset's fingerprint information, enabling rapid and comprehensive identification of intranet asset fingerprints. Simultaneously, it enables asset anomaly monitoring and asset vulnerability scanning based on asset information, facilitating the timely detection of potential security risks to intranet hosts.
[0033] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.
[0034] The description of the disclosed embodiments above enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.
Claims
1. A method for asset fingerprint identification of an intranet host, characterized in that, include: The system obtains live hosts on the intranet through stateless scanning, and scans target assets selected from the live hosts according to preset scanning rules to obtain asset information. The scanning rules include the correspondence between port protocols and asset information types. After obtaining the port protocols of live hosts through stateless scanning, the system automatically scans for the corresponding type of asset information of the host according to the correspondence. Extracting asset fingerprints from scanned asset information includes adding the scan results to a preset asset information table. If the asset information matches a preset asset fingerprint feature library, a fingerprint tag is added to the asset information.
2. The asset fingerprint recognition method according to claim 1, characterized in that, The stateless scan includes sending a SYN request connection packet to the target host, and after receiving a SYN / ACK confirmation connection packet from the target host, sending an RST connection termination packet to the target host, recording the responding target host IP and open port, and marking the host as alive.
3. The asset fingerprint recognition method according to claim 1, characterized in that, This includes establishing an asset fingerprint database: Obtain a first feature group of known asset types, and combine at least two of the first feature groups to form a fingerprint feature library for that type of asset; The first feature group includes keywords of one of the following: asset status information, asset system information, asset network information, and asset application information; the asset status information includes whether the asset is online or offline, its physical location, and the organization to which it belongs; the asset system information includes the system version and hostname; the asset network information includes the asset's IP address, service, port, and protocol; and the asset application information includes the application name and version on the asset.
4. The asset fingerprint recognition method according to claim 3, characterized in that, It also includes monitoring asset information anomalies: creating monitoring rules that include monitoring targets, monitoring periods, and monitoring types. If the information of the corresponding type of the monitoring target within the monitoring period is inconsistent with the asset information table, it is determined that the asset has an anomaly, and the number of anomalies is accumulated until an alarm threshold is triggered.
5. The asset fingerprint recognition method according to claim 3, characterized in that, Vulnerability scanning is performed on the asset system information and asset application information, including determining whether the target asset's system has weak passwords, and calling a preset vulnerability database to scan based on the target asset's system and application versions.
6. The asset fingerprint recognition method according to claim 5, characterized in that, The step of scanning the target asset's application version by calling a preset vulnerability database includes: obtaining the application name, version, and installation directory by searching the target asset's registry path; calling the corresponding vulnerability database based on the obtained application name and version; and scanning the installation directory for vulnerabilities.
7. An intranet host asset fingerprinting device, implementing the asset fingerprinting method as described in any one of claims 1-6, characterized in that, The device includes: The asset information scanning module acquires live hosts on the intranet through stateless scanning and scans selected target assets from these live hosts according to preset scanning rules to obtain asset information. These scanning rules include a mapping between port protocols and asset information types. Once the port protocols of a live host are acquired through stateless scanning, the module automatically scans for the corresponding type of asset information on that host based on this mapping. The asset fingerprint recognition module extracts asset fingerprints from the scanned asset information, including adding the scan results to a preset asset information table. If the asset information matches the preset asset fingerprint feature library, a fingerprint mark is added to the asset information.
8. The intranet host asset fingerprint identification device according to claim 7, characterized in that, The stateless scanning of the asset information scanning module includes sending a SYN request connection data packet to the target host, and after receiving a SYN / ACK confirmation connection data packet from the target host, sending an RST connection termination data packet to the target host, recording the responding target host IP and open port, and marking the host as alive.
9. The intranet host asset fingerprint identification device according to claim 7, characterized in that, The asset fingerprint recognition module's asset fingerprint feature library includes keywords from one of the following: asset status information, asset system information, asset network information, and asset application information.
10. The intranet host asset fingerprint identification device according to claim 9, characterized in that, The device also includes: The asset anomaly monitoring module determines that an asset has undergone an anomaly if the information of the corresponding type of the monitored target within the monitoring period is inconsistent with the asset information table. The asset vulnerability scanning module determines whether the target asset's system has weak passwords and scans the system and application versions of the target asset using a preset vulnerability database.