Dual stack network asset discovery method based on multi-protocol collaborative probing and intelligent fingerprint analysis

Abstract

This invention relates to a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis; it includes the following steps: multi-source parallel acquisition: collecting network layer information of various terminal devices in the intranet through command line interface or application programming interface; data cleaning and standardization: after acquisition, cleaning and standardizing the raw data; target device identification and detection strategy generation: based on the cleaned address list and combined with device information, identifying the target device type and automatically generating corresponding detection parameters; multi-protocol asset detection packet sending: sending detection packets to target IPv4 and IPv6 addresses according to configuration parameters; response data parsing and fingerprint recognition: performing structured parsing and multi-dimensional recognition on the received response data; dual-stack network data fusion and statistical analysis: after fingerprint recognition, fusing and analyzing the IPv4 and IPv6 detection results and constructing a unified asset database.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and in particular to a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis. Background Technology

[0002] With the accelerated large-scale deployment of IPv6, enterprise intranets are generally exhibiting a dual-stack architecture of IPv4 and IPv6. However, existing asset discovery technologies are mostly designed for single-protocol stack environments, relying heavily on ARP broadcasting and IPv4 port scanning, which presents significant limitations in hybrid dual-stack networks. For example, while open-source tools like Nmap and Zmap offer basic IPv6 support, their scanning strategies fail to jointly model the relationship between IPv4 and IPv6 addresses, resulting in gaps in asset identification and insufficient asset profile completeness. Some commercial tools, such as Nessus and Qualys, while providing IPv6 scanning capabilities, still rely on static IP range configurations, making it difficult to cover dynamic cloud-edge scenarios.

[0003] The heterogeneity of network devices further exacerbates the complexity of dual-stack mapping. IoT terminals generally employ lightweight protocol stacks, and some industrial control equipment uses closed TCP / IP implementations, causing the accuracy of standard fingerprint database matching to drop to around 60%, far below the level of traditional terminal identification. Simultaneously, single-point detection methods can only capture network status at a specific point in time, lacking the ability to continuously track the binding relationships between IPv4 / IPv6 addresses and the device service chain path. Especially in virtualized environments, the false negative rate caused by dynamic asset migration exceeds 30%.

[0004] Current mainstream industry solutions also have significant shortcomings: passive traffic analysis technology is limited by the coverage of mirrored ports and cannot detect silent or intermittently online terminals; active detection solutions, lacking protocol coordination mechanisms, frequently trigger device protection policies and generate a large number of false alarms when dealing with scenarios such as ICMPv6 rate limiting and TCP / IPv6 extension headers. Furthermore, for new network architectures such as SRv6 service chains, existing technologies struggle to penetrate the overlay structure and accurately identify logical assets.

[0005] With the widespread adoption of containerized deployments, edge computing, and software-defined networking, intranet assets are exhibiting strong dynamics and unstructured characteristics, further amplifying the challenges of asset identification and management in dual-stack environments. Therefore, existing asset discovery methods are no longer sufficient to meet the demands for high-precision, low-false-miss, and sustainable identification of asset status in multi-protocol stack, multi-device, and multi-network environments.

[0006] To this end, this invention proposes a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis. Summary of the Invention

[0007] This invention addresses the technical problems existing in the prior art by providing a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis.

[0008] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, comprising the following steps:

[0009] S1: Multi-source parallel acquisition: Collects network layer information of various terminal devices in the intranet through command line interface or application programming interface;

[0010] S2: Data cleaning and standardization: Cleaning and standardizing the collected raw data;

[0011] S3: Target device identification and detection strategy generation: Based on the cleaned address list and combined with device information, identify the target device type and automatically generate corresponding detection parameters;

[0012] S4: Multiprotocol asset probe message sending: Based on the configuration parameters, probe messages are sent to the target IPv4 and IPv6 addresses;

[0013] S5: Response Data Parsing and Fingerprint Recognition: Perform structured parsing and multidimensional recognition on the received response data;

[0014] S6: Dual-Stack Network Data Fusion and Statistical Analysis: After completing fingerprint recognition, the IPv4 and IPv6 detection results are fused and analyzed to build a unified asset database.

[0015] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, step S1 further includes:

[0016] S11: Network device information collection: Read the address resolution protocol table and neighbor discovery cache of network devices through simple network management protocol to obtain IPv4 address, IPv6 address, MAC address and interface information;

[0017] S12: Host System Information Acquisition: Remotely execute command-line tools via Windows Management Specification or Secure Shell Protocol;

[0018] S13: Cloud Environment Information Collection: Calling the application programming interface provided by the cloud vendor;

[0019] S14: Passive monitoring information collection: Monitor network traffic mirroring ports, analyze Dynamic Host Configuration Protocol and Domain Name System (DNS) packets, and extract the client's IPv4 address, IPv6 address, hostname, and MAC address.

[0020] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, step S3 further includes:

[0021] S31: Target device identification and detection strategy generation: Based on the cleaned address list and combined with device information, identify the target device type and automatically generate corresponding detection parameters;

[0022] S32: Detection Protocol Selection: Select the appropriate detection protocol based on the device type;

[0023] S33: Port list generation: Generates the corresponding port list based on the device type;

[0024] S34: Message parameter configuration: Configure the corresponding message parameters according to the probe protocol;

[0025] S35: Retry Mechanism Configuration: Configure the number of retries and timeout for probe messages to improve the reliability of probes.

[0026] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, step S4 includes:

[0027] S41: IPv4 Priority Probe: Send probe packets to the target IPv4 address first;

[0028] S411: TCP SYN probe: Sends TCP SYN packets to ports 80 and 443 of the target IPv4 address to detect whether the web service is available;

[0029] S412: ICMP Echo Probe: If the TCP SYN probe does not respond, an ICMP Echo request message is sent to the target IPv4 address to check if the target device is alive;

[0030] S42: IPv6 Supplemental Probe: Perform supplemental probing on the target IPv6 address to discover services on the IPv6 address;

[0031] S421: ICMPv6 Neighbor Solicitation Probe: Sends an ICMPv6 Neighbor Solicitation message to the target IPv6 address to obtain the MAC address of the target device;

[0032] S422: HTTP / 2 over IPv6 probe: If the target device has port 80 or port 443 open, it will attempt to probe via the HTTP / 2 over IPv6 protocol to obtain the fingerprint information of the web service.

[0033] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, the multi-S5 steps include:

[0034] S51: Network Attribute Information Parsing: Parse the source IP address, source port, destination IP address, destination port, and MAC address in the response message;

[0035] S52: Communication and Application Protocol Identification: Identify the communication and application protocols in the response message;

[0036] S53: Operating System Feature Recognition: Identify the target device's operating system type, version, and manufacturer information based on TCP fingerprints, HTTP header features, and other network behavior characteristics;

[0037] S531: TCP fingerprint matching: Based on TCP option fingerprinting, it identifies the operating system type by analyzing the window size, option list, and maximum segment length in TCP packets;

[0038] S532: HTTP header feature recognition: Parse HTTP response headers, extract the Server field and X-Powered-By field, and identify the web server type and application stack version;

[0039] S533: Clock skew analysis: Calculate clock skew based on TCP timestamp options. If the skew is greater than 500ms, it is suspected to be a virtual machine.

[0040] S54: CPE Encoding Information Extraction: Extract the general platform enumeration encoding information from the response data;

[0041] S55: Product Information and Equipment Type Identification: Identify the product information and equipment type of the target equipment based on the product name, equipment model, version, and manufacturer information in the response data.

[0042] Furthermore, in the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, step S6 includes:

[0043] S61: Same Source Merging: Merge IPv4 and IPv6 detection results based on MAC address or device unique identifier (e.g., hostname);

[0044] S62: Dual-stack status marking: Mark the dual-stack status of each device, i.e. whether it has both IPv4 and IPv6 addresses at the same time;

[0045] S63: Multidimensional statistical analysis: Perform multidimensional statistical analysis on the data in the asset database;

[0046] S64: Time-series based anomaly detection: Perform time-series analysis on key indicators of network assets to detect abnormal behavior and configuration changes;

[0047] S65: Graph-based address relationship fusion: Constructs a graph structure from IPv4 / IPv6 addresses, MAC addresses, hostnames, and switch ports, and uses graph theory algorithms to identify the relationships between devices.

[0048] Furthermore, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis includes the following multi-dimensional statistical analysis of the data in the asset database:

[0049] S631: IPv6 address deployment rate calculation: Calculate the ratio of the number of active IPv6 addresses to the total number of terminals to assess the deployment status of IPv6;

[0050] S632: Calculation of IPv6 support rate for internal network devices: Calculate the ratio of the number of internal network devices that support IPv6 to the total number of internal network devices, and evaluate the IPv6 support of internal network devices;

[0051] S633: IPv6 access rate calculation for various types of terminals: Calculate the IPv6 access rate for various terminals such as servers, workstations, and IoT devices, and evaluate the IPv6 access status of different types of terminals.

[0052] S634: Comparison of the number of dual-stack devices and single-stack devices: Compare the number of dual-stack devices and single-stack devices;

[0053] S635: Operating System Distribution and Vendor Share Statistics: Statistics on the distribution of various operating systems in the network;

[0054] S636: Terminal Asset Coverage and Distribution Map Generation: Generate a terminal asset coverage report and distribution map based on data in the asset database.

[0055] Furthermore, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, wherein the method of identifying the relationships between devices using graph theory algorithms includes:

[0056] NodeRank = g(Graph, Node);

[0057] NodeRank represents the importance or relevance of a node in the graph, Graph represents the graph structure constructed from network asset information, Node represents a node in the graph, representing a network device or interface, and g() is a graph theory algorithm.

[0058] The beneficial effects of this invention are:

[0059] This invention combines multi-protocol response features in a dual-stack IPv4 and IPv6 environment as core identification data to construct a refined identification mechanism suitable for heterogeneous network devices. This method breaks through the limitations of traditional asset detection that relies on a single protocol and static feature matching. It can accurately identify terminal devices that hide their true identities or use lightweight protocol stacks, avoiding identification omissions caused by address drift, protocol mixing, and other factors. This greatly improves the accuracy and stability of identifying various terminal assets in complex intranet environments. Attached Figure Description

[0060] Figure 1 This is a flowchart illustrating a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis.

[0061] Figure 2 This is a schematic diagram illustrating the implementation of a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis in one embodiment. Detailed Implementation

[0062] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0063] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0064] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0065] This invention proposes a dual-stack network asset discovery method based on multi-protocol collaborative probing and intelligent fingerprint analysis, possessing capabilities in protocol collaboration, dynamic identification, and multi-dimensional analysis. The method collects IPv4 / IPv6 addresses and MAC information via command line or API, and after cleaning and standardization, generates a target parameter set suitable for probing. The system constructs various types of TCP, UDP, and ICMP probe packets based on dual protocol stacks, actively initiating probes to target addresses, and performs fingerprint analysis on the response data to extract key features such as operating system, service type, and vendor information. Based on this, combined with IPv4 / IPv6 binding relationships, the system can track the identity migration of terminals in different network environments and construct dynamic device profiles. This method further integrates big data analytics to achieve multi-dimensional modeling of terminal distribution, protocol support, and asset composition, improving the breadth and accuracy of identification in complex dual-stack networks, significantly reducing the false negative rate and false positive risk, and providing reliable support for asset management in new network architectures such as cloud-edge convergence and virtualization deployment.

[0066] Specifically, such as Figures 1-2 As shown, the dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis includes the following implementation steps:

[0067] S1: Multi-source parallel acquisition: Collect network layer information from various terminal devices in the intranet via command-line interface or application programming interface; including the following sub-steps:

[0068] S11: Network device information collection: Read the address resolution protocol (ARP) table and neighbor discovery cache of network devices through simple network management protocol (SNMP) to obtain IPv4 address, IPv6 address, MAC address and interface information;

[0069] S12: Host System Information Acquisition: Remotely execute command-line tools, such as ipconfig (Windows) or ifconfig (Linux), via Windows Management Instrumentation (WMI) or Secure Shell Protocol (SSH) to obtain the host's IPv4 address, IPv6 address, MAC address, hostname, and operating system information;

[0070] S13: Cloud Environment Information Collection: Call the application programming interface (API) provided by the cloud vendor, such as AWS EC2API or Azure Compute API, to obtain the IPv4 address, IPv6 address, MAC address, instance ID, and instance type of the cloud virtual instance;

[0071] S14: Passive eavesdropping information collection: eavesdrop on network traffic mirroring ports, analyzes Dynamic Host Configuration Protocol (DHCPv6) and Domain Name System (DNS) messages, and extracts the client's IPv4 address, IPv6 address, hostname, and MAC address.

[0072] S2: Data Cleaning and Standardization: Cleaning and standardizing the collected raw data, including the following sub-steps:

[0073] S21: Data Deduplication: Remove duplicate IPv4 address, IPv6 address, and MAC address records;

[0074] S22: Invalid address filtering: Filter out invalid IPv4 addresses (e.g., 127.0.0.1) and IPv6 addresses (e.g., link-local address fe80:: / 10).

[0075] S23: Format Standardization: Convert IPv4 addresses to dotted decimal format, IPv6 addresses to full format, and MAC addresses to uppercase hexadecimal colon-separated format; S3: Target Device Identification and Detection Strategy Generation: Based on the cleaned address list and device information, identify the type of target device and automatically generate corresponding detection parameters, including the following sub-steps:

[0076] S31: Device Type Identification: Identify the type of target device based on the MAC address prefix (OUI), hostname, and operating system information, such as network switch, Windows host, Linux server, IP camera, etc.

[0077] S32: Probe Protocol Selection: Select the appropriate probe protocol based on the device type, such as TCP, UDP, ICMP, SNMP, HTTP, etc.

[0078] S33: Port list generation: Generate the corresponding port list according to the device type. For example, for a web server, select port 80 and port 443, and for an SSH server, select port 22.

[0079] S34: Message parameter configuration: Configure the corresponding message parameters according to the probe protocol, such as the flag bits of the TCP SYN message, the length of the UDP message, and the data of the ICMP Echo message;

[0080] S35: Retry mechanism configuration: Configure the number of retries and timeout for probe packets to improve the reliability of probes;

[0081] S4: Multiprotocol Asset Probe Message Sending: Based on configuration parameters, probe messages are sent to target IPv4 and IPv6 addresses; including the following sub-steps:

[0082] S41: IPv4 Priority Probe: Prioritize sending probe packets to the target IPv4 address to reduce the probe delay for IPv6 addresses;

[0083] S411: TCP SYN probe: Sends TCP SYN packets to ports 80 and 443 of the target IPv4 address to detect whether the web service is available;

[0084] S412: ICMP Echo Probe: If the TCP SYN probe does not respond, an ICMP Echo request message is sent to the target IPv4 address to check if the target device is alive;

[0085] S42: IPv6 Supplemental Probe: Perform supplemental probing on the target IPv6 address to discover services on the IPv6 address;

[0086] S421: ICMPv6 Neighbor Solicitation Probe: Sends an ICMPv6 Neighbor Solicitation message to the target IPv6 address to obtain the MAC address of the target device;

[0087] S422: HTTP / 2 over IPv6 probe: If the target device has port 80 or 443 open, attempt to probe via the HTTP / 2 over IPv6 protocol to obtain the fingerprint information of the web service.

[0088] S5: Response Data Parsing and Fingerprint Recognition: Perform structured parsing and multi-dimensional recognition on the received response data, including the following sub-steps:

[0089] S51: Network Attribute Information Parsing: Parse the source IP address, source port, destination IP address, destination port, and MAC address in the response message;

[0090] S52: Communication and Application Protocol Identification: Identify the communication and application protocols in the response message, such as TCP, UDP, HTTP, SSH, DNS, etc.

[0091] S53: Operating System Feature Recognition: Based on TCP fingerprints, HTTP header features, and other network behavior characteristics, identify the target device's operating system type, version, and manufacturer information; specifically including:

[0092] S531: TCP Fingerprint Matching: Based on TCP option fingerprinting, this method identifies the operating system type by analyzing fields such as window size, option list, and maximum segment size (MSS) in TCP packets. For example, the TCP window scaling factor in the Linux kernel is typically between 7 and 14, while the initial TTL value for Windows systems is 128.

[0093] The algorithm formula is: OS = F(WS, Options, MSS, TTL), where OS represents the operating system type, WS represents the TCP window size, Options represents the TCP option list, MSS represents the maximum segment size, and TTL represents the time to live. This formula indicates that the operating system type is a function of the TCP fingerprint characteristics. The fingerprint database contains TCP fingerprint characteristics corresponding to various operating systems.

[0094] S532: HTTP Header Feature Recognition: Parse the HTTP response header, extract the Server and X-Powered-By fields, and identify the web server type and application stack version. For example, if the Server field contains "nginx," it indicates that the web service type is nginx, and if the X-Powered-By field contains "PHP / 7," it indicates that the application stack version is PHP 7.

[0095] The algorithm formula is: WebType = G(Server), AppVersion = H(X-Powered-By), where WebType represents the web service type, AppVersion represents the application stack version, Server represents the Server field in the HTTP response header, and X-Powered-By represents the X-Powered-By field in the HTTP response header. This formula indicates that the web service type and application stack version are functions of the HTTP response header fields.

[0096] Different web servers and application stacks contain different characteristic information in their HTTP response headers, which can be used to identify the web server type and application stack version.

[0097] S533: Clock skew analysis: Calculates clock skew based on TCP timestamp options. If the skew is greater than 500ms, it is suspected to be a virtual machine.

[0098] The algorithm formula is: ClockOffset = T2 - T1 - RTT / 2, where ClockOffset represents the clock offset, T1 represents the timestamp of sending a TCP packet, T2 represents the timestamp of receiving a TCP packet, and RTT represents the round-trip time. This formula indicates that the clock offset is a function of the sending time, receiving time, and round-trip time.

[0099] There may be discrepancies in clock synchronization between virtual machines and physical machines. By calculating the clock deviation of the TCP timestamp option, it can be determined whether the target device is a virtual machine.

[0100] S54: CPE Encoding Information Extraction: Extract the Common Platform Enumeration (CPE) encoding information from the response data, such as cpe: / a:apache:http_server:2.4.46, to identify software and hardware version information;

[0101] S5.5: Product Information and Device Type Identification: Based on the product name, device model, version, and manufacturer information in the response data, identify the product information and device type of the target device, such as printer, camera, router, etc.

[0102] S6: Dual-Stack Network Data Fusion and Statistical Analysis: After fingerprint recognition is completed, the IPv4 and IPv6 detection results are fused and analyzed to build a unified asset database; including the following sub-steps:

[0103] S61: Same Source Merging: Based on the MAC address or unique device identifier (such as hostname), merge the detection results of IPv4 and IPv6 to avoid duplicate records;

[0104] S62: Dual-stack status marking: Mark the dual-stack status of each device, i.e. whether it has both IPv4 and IPv6 addresses at the same time;

[0105] S63: Multidimensional Statistical Analysis: Perform multidimensional statistical analysis on the data in the asset database, including:

[0106] S631: IPv6 address deployment rate calculation: Calculate the ratio of the number of active IPv6 addresses to the total number of terminals to assess the deployment status of IPv6.

[0107] The algorithm formula is: IPv6DeploymentRate = IPv6ActiveCount / TotalTerminalCount, where IPv6DeploymentRate represents the IPv6 address deployment rate, IPv6ActiveCount represents the number of active IPv6 addresses, and TotalTerminalCount represents the total number of terminals. This formula indicates that the IPv6 address deployment rate is a function of the number of active IPv6 addresses and the total number of terminals.

[0108] S632: Calculation of IPv6 support rate for internal network devices: Calculate the ratio of the number of internal network devices that support IPv6 to the total number of internal network devices, and evaluate the IPv6 support of internal network devices.

[0109] Algorithm formula: IPv6SupportRate = IPv6CapableCount / TotalInternalCount, where IPv6SupportRate represents the IPv6 support rate of internal network devices, IPv6CapableCount represents the number of internal network devices that support IPv6, and TotalInternalCount represents the total number of internal network devices; this formula means that the IPv6 support rate of internal network devices is a function of the number of internal network devices that support IPv6 and the total number of internal network devices.

[0110] S633: IPv6 Access Rate Calculation for Various Terminals: Calculate the IPv6 access rate for various terminals such as servers, workstations, and IoT devices, and evaluate the IPv6 access status of different types of terminals.

[0111] The algorithm formula is: TerminalIPv6Rate(Type) = IPv6EnabledCount(Type) / TotalCount(Type), where TerminalIPv6Rate(Type) represents the IPv6 access rate of terminals of type Type, IPv6EnabledCount(Type) represents the number of IPv6-enabled devices among terminals of type Type, and TotalCount(Type) represents the total number of terminals of type Type. This formula indicates that the IPv6 access rate of a specific type of terminal is a function of the number of IPv6-enabled devices among terminals of that type and the total number of terminals of that type.

[0112] S634: Comparison of the number of dual-stack and single-stack devices: Compare the number of dual-stack and single-stack devices to understand the mixed situation of IPv4 and IPv6 in the network;

[0113] S635: Operating System Distribution and Vendor Share Statistics: Statistics on the distribution of various operating systems in the network and the share of equipment from different vendors, to understand the diversity of equipment in the network;

[0114] S636: Terminal asset coverage and distribution map generation: Based on the data in the asset database, generate a terminal asset coverage report and distribution map to understand the distribution of assets in the network;

[0115] S64: Time-series-based anomaly detection:

[0116] Perform time-series analysis on key indicators of network assets (such as online status, traffic patterns, and service port openness) to detect abnormal behavior and configuration changes.

[0117] Algorithm formula: AnomalyScore = f(TimeSeriesData);

[0118] Here, AnomalyScore represents the anomaly score, used to quantify the degree of deviation between the current state and the historical state; TimeSeriesData represents the time series data of key network asset indicators over a period of time; f() can be a function based on statistical models (such as ARIMA, Prophet) or machine learning models (such as LSTM, Autoencoder) to analyze patterns in time series data and detect anomalies; by learning from the historical data of network assets, normal behavior patterns are established; when new data points deviate significantly from historical patterns, anomalies are considered to be possible.

[0119] S65: Graph-based address relationship fusion:

[0120] By constructing a graph structure from information such as IPv4 / IPv6 addresses, MAC addresses, hostnames, and switch ports, and using graph theory algorithms (such as PageRank and community discovery) to identify the relationships between devices, the problem of device identity tracking in scenarios with multiple interfaces and dynamic IPs can be solved.

[0121] Algorithm formula: NodeRank = g(Graph, Node);

[0122] In this context, NodeRank represents the importance or relevance of a node (device) in the graph; Graph represents the graph structure constructed from network asset information; Node represents a node in the graph, representing a network device or interface; g() is a graph theory algorithm, such as PageRank or community detection algorithm, used to calculate the importance of a node in the graph; modeling the relationships between network assets as a graph structure allows for a more comprehensive consideration of various relational information, thereby improving the accuracy of device identification.

[0123] In one embodiment: A company has over 500 terminal devices (including servers, office computers, network equipment, and IoT devices), and its network uses a dual-stack IPv4 / IPv6 architecture. Due to the diverse types of devices and the fact that some older devices are not included in IT asset management, the company wants to comprehensively discover and manage its dual-stack network assets through automation, while ensuring that the discovery process does not affect business operations.

[0124] Implementation process:

[0125] Network data acquisition: Network data acquisition is the foundation of asset discovery. The goal is to obtain the IP addresses, MAC addresses, and other relevant information of all devices in the network. To achieve comprehensive network coverage, data needs to be collected from multiple data sources.

[0126] Network devices (switches, routers): Obtain the ARP (Address Resolution Protocol) table: The ARP table stores the mapping relationship between IP addresses and MAC addresses and is a key data source for discovering IPv4 devices.

[0127] Obtaining the NDP (Neighbor Discovery Protocol) cache: NDP is a protocol in IPv6 used for address resolution and neighbor discovery. By reading the NDP cache, the mapping relationship between IPv6 addresses and MAC addresses can be obtained.

[0128] Use an SNMP client tool (such as snmpwalk) or write a Python script to connect to the network device via the SNMP protocol; specify the SNMP OID (Object Identifier) ​​to read the ARP table and NDP cache. A commonly used ARP table OID is 1.3.6.1.2.1.3.1.1. The NDP cache OID can be queried based on the network device's model and manufacturer. Parse the data returned by SNMP to extract the IP address and MAC address; store the collected data in a database or file.

[0129] Hosting systems (servers, office computers):

[0130] WMI: Used to obtain information about Windows devices, including IP address, MAC address, hostname, operating system version, etc.

[0131] Linux host: Use SSH client tools (such as paramiko) or write Python scripts to connect to Linux devices via SSH.

[0132] Windows: Execute the `ipconfig / all` command to obtain network configuration information; Linux: Execute the `ifconfig` or `ipaddr` command to obtain network configuration information; Optional: Execute the `hostname` command to obtain the hostname; Parse the data returned by the command to extract information such as IP address, MAC address, and hostname; Store the collected data in a database or file.

[0133] Data cleaning and standardization: The raw data collected often has problems such as duplication, invalidity or inconsistent format, and needs to be cleaned and standardized in order to provide a high-quality data foundation for subsequent exploration.

[0134] Deduplication: Remove duplicate IP address and MAC address records.

[0135] Invalid address removal:

[0136] IPv4: Remove private address ranges (such as 10.0.0.0 / 8, 172.16.0.0 / 12, 192.168.0.0 / 16), local loopback addresses (127.0.0.1), and multicast addresses.

[0137] IPv6: Remove local link-local addresses (fe80:: / 10), reserved address ranges, and multicast addresses.

[0138] Standardized format:

[0139] IP address:

[0140] IPv4: Unified in dotted decimal notation (e.g., 192.168.1.1).

[0141] IPv6: Unified to a simplified format (e.g., 2001:db8::1).

[0142] MAC address: uniformly in uppercase hexadecimal colon-separated format (e.g., 00:1A:2B:3C:4D:5E).

[0143] Target device identification and detection strategy generation: Based on the cleaned address list and device information, the target device type is identified and the corresponding detection parameters are automatically generated; this can improve detection efficiency and accuracy and avoid performing the same detection on all devices.

[0144] Device type identification:

[0145] MAC address prefix (OUI): The device manufacturer can be identified by the first 6 hexadecimal characters (OUI) of the MAC address. For example, 00:1A:2B is Cisco's OUI.

[0146] IP address ranges: The type of device can be inferred from the IP address range. For example, the 192.168.1.0 / 24 network segment may be used for office computers, while the 10.0.0.0 / 24 network segment may be used for servers.

[0147] Hostname: The hostname can be used to identify the device type. For example, a hostname starting with "SRV-" may be a server, while a hostname starting with "PC-" may be an office computer.

[0148] Service ports: The type of device can be inferred from the open service ports. For example, devices with open ports 80 and 443 are likely web servers, while those with open port 22 are likely SSH servers.

[0149] Detection strategy generation:

[0150] Select the appropriate detection protocol and port based on the device type.

[0151] Configure detection parameters: timeout, number of retries, number of concurrent connections, etc.

[0152] Configure message parameters: TCP flags, HTTP headers, etc.

[0153] Establish a retry mechanism: If the probe fails, you can try to retry using a different protocol or port.

[0154] Example: For a device identified as a web server, an HTTP request can be sent to obtain the server's type and version.

[0155] For devices identified as printers, the printer's status and configuration information can be obtained via the SNMP protocol.

[0156] For devices identified as network devices, commands can be executed via the SSH protocol to obtain the device's configuration information.

[0157] Multi-protocol asset probe message sending: The system sends probe messages to target IPv4 and IPv6 addresses according to configuration parameters; the types of probe messages include TCPSYN, TCPACK, UDP empty message, ICMPEcho, etc.; by receiving response messages (such as SYN-ACK, RST, etc.), the port status or device activity is determined.

[0158] IPv4 priority probe: Send TCPSYN packets to ports 80 / 443 to determine if the target device provides web services; trigger ICMP Echo requests for unresponsive targets to determine if the target device is alive.

[0159] IPv6 supplemental probe: Send ICMPv6 NeighborSolicitation message to discover IPv6 neighbor nodes; Attempt HTTP / 2 over IPv6 on devices with open ports to determine if the target device supports IPv6 web services.

[0160] Response data parsing and fingerprint recognition: The received response data is structured and multidimensionally identified to extract key features, including network attribute information, communication and application protocols, operating system features, CPE encoding information, product information and device type, etc.

[0161] Data parsing: Extract network attribute information such as target IP address, target port, and target MAC address; identify communication and application protocols such as HTTP, SSH, and FTP; parse HTTP headers to extract information such as the Server field and Content-Type field; parse TCP headers to extract information such as window size and TTL value.

[0162] Fingerprint recognition;

[0163] Operating system fingerprint recognition:

[0164] TCP fingerprint matching:

[0165] Window scaling factor ∈ [7,14] => Linux kernel.

[0166] Initial TTL=128 => Windows system.

[0167] ICMP response patterns: Different operating systems respond differently to ICMP messages.

[0168] Service fingerprint recognition:

[0169] HTTP header characteristics:

[0170] The Server field contains nginx => Web service type.

[0171] X-Powered-By includes PHP / 7.* => application stack version.

[0172] SSH version information: The type and version of the SSH server can be identified based on the SSH protocol version information.

[0173] Device type fingerprint recognition:

[0174] CPE (Common Platform Enumeration) coding: CPE coding is a standardized method for describing software and hardware.

[0175] Product Information and Equipment Type: The equipment type can be identified based on the equipment model, version, and manufacturer information.

[0176] Clock skew analysis:

[0177] Calculate clock skew using the TCP timestamp option; skew > 500ms => suspected virtual machine.

[0178] Dual-stack network data fusion and statistical analysis: The IPv4 and IPv6 detection results are fused and analyzed to build a unified asset database; IPv4 / IPv6 source merging is performed based on MAC address or device unique identifier, and the dual-stack status of each device is marked.

[0179] Data fusion:

[0180] Associating IPv4 and IPv6 addresses with the same device based on MAC address or device unique identifier (such as hostname).

[0181] Mark the dual-stack status of the device: Devices that support both IPv4 and IPv6 are marked as dual-stack devices.

[0182] Statistical analysis:

[0183] IPv6 address deployment rate: Number of active IPv6 addresses / Total number of terminals.

[0184] IPv6 support rate of internal network devices.

[0185] IPv6 access rate of various terminals (servers, workstations, IoT, etc.).

[0186] Comparison of the number of dual-stack devices and single-stack devices.

[0187] Operating system distribution and vendor share.

[0188] Terminal asset coverage, distribution map, etc.

[0189] Suppose the company has a web server with an IPv4 address of 192.168.1.100, an IPv6 address of 2001:db8::100, and a MAC address of 00:1A:2B:3C:4D:5E.

[0190] Network data acquisition: Obtain the server's IPv4 and IPv6 addresses from the switch via SNMP protocol, and obtain its MAC address and hostname from the server via SSH protocol.

[0191] Data cleaning and standardization: The collected data is cleaned and standardized to remove invalid addresses and unify the data format.

[0192] Target device identification and detection strategy generation: Based on the IP address range and service port (80 and 443), the device is identified as a web server, and corresponding detection strategies are generated, including sending HTTP requests and TCP port scanning.

[0193] Multiprotocol asset probe message sending: Sends HTTP request and TCP port scan messages to the server's IPv4 and IPv6 addresses.

[0194] Response data parsing and fingerprinting: Parse the HTTP response header, extract the Server field, and identify the web server type as Nginx.

[0195] The operating system type was identified as Linux through TCP fingerprint matching.

[0196] Dual-stack network data fusion and statistical analysis: IPv4 and IPv6 addresses are associated with the same device, marking it as a dual-stack device. The IPv6 access rate of this server is calculated and added to the asset database.

[0197] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0198] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis, characterized in that, Includes the following steps: S1: Multi-source parallel acquisition: Collects network layer information of various terminal devices in the intranet through command line interface or application programming interface; S2: Data cleaning and standardization: Cleaning and standardizing the collected raw data; S3: Target device identification and detection strategy generation: Based on the cleaned address list and combined with device information, identify the target device type and automatically generate corresponding detection parameters; S4: Multiprotocol asset probe message sending: Based on the configuration parameters, probe messages are sent to the target IPv4 and IPv6 addresses; S5: Response Data Parsing and Fingerprint Recognition: Perform structured parsing and multidimensional recognition on the received response data; S6: Dual-stack network data fusion and statistical analysis: After completing fingerprint recognition, the IPv4 and IPv6 detection results are merged and analyzed for common sources, and a unified asset database is constructed. Step S1 also includes: S11: Network device information collection: Read the address resolution protocol table and neighbor discovery cache of network devices through simple network management protocol to obtain IPv4 address, IPv6 address, MAC address and interface information; S12: Host System Information Acquisition: Remotely execute command-line tools via Windows Management Specification or Secure Shell Protocol; S13: Cloud Environment Information Collection: Calling the application programming interface provided by the cloud vendor; S14: Passive monitoring information collection: Monitor network traffic mirroring ports, analyze Dynamic Host Configuration Protocol and Domain Name System packets, and extract the client's IPv4 address, IPv6 address, hostname, and MAC address; Step S5 also includes: S51: Network Attribute Information Parsing: Parse the source IP address, source port, destination IP address, destination port, and MAC address in the response message; S52: Communication and Application Protocol Identification: Identify the communication and application protocols in the response message; S53: Operating System Feature Recognition: Identify the target device's operating system type, version, and manufacturer information based on TCP fingerprints, HTTP header features, and other network behavior characteristics; S531: TCP fingerprint matching: Based on TCP option fingerprinting, it identifies the operating system type by analyzing the window size, option list, and maximum segment length in TCP packets; S532: HTTP header feature recognition: Parse HTTP response headers, extract the Server field and X-Powered-By field, and identify the web server type and application stack version; S533: Clock skew analysis: Calculate clock skew based on TCP timestamp options. If the skew is greater than 500ms, it is suspected to be a virtual machine. S54: CPE Encoding Information Extraction: Extract the general platform enumeration encoding information from the response data; S55: Product Information and Equipment Type Identification: Identify the product information and equipment type of the target equipment based on the product name, equipment model, version, and manufacturer information in the response data.

2. The dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis according to claim 1, characterized in that, Step S3 also includes: S31: Target device identification and detection strategy generation: Based on the cleaned address list and combined with device information, identify the target device type and automatically generate corresponding detection parameters; S32: Detection Protocol Selection: Select the appropriate detection protocol based on the device type; S33: Port list generation: Generates the corresponding port list based on the device type; S34: Message parameter configuration: Configure the corresponding message parameters according to the probe protocol; S35: Retry Mechanism Configuration: Configure the number of retries and timeout for probe messages to improve the reliability of probes.

3. The dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis according to claim 1, characterized in that, Step S4 includes: S41: IPv4 Priority Probe: Send probe packets to the target IPv4 address first; S411: TCP SYN probe: Sends TCP SYN packets to ports 80 and 443 of the target IPv4 address to detect whether the web service is available; S412: ICMP Echo Probe: If the TCP SYN probe does not respond, an ICMP Echo request message is sent to the target IPv4 address to check if the target device is alive; S42: IPv6 Supplemental Probe: Perform supplemental probing on the target IPv6 address to discover services on the IPv6 address; S421: ICMPv6 Neighbor Solicitation Probe: Sends an ICMPv6 NeighborSolicitation message to the target IPv6 address to obtain the MAC address of the target device; S422: HTTP / 2 over IPv6 probe: If the target device has port 80 or port 443 open, it will attempt to probe via the HTTP / 2 over IPv6 protocol to obtain the fingerprint information of the web service.

4. The dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis according to claim 1, characterized in that, Step S6 includes: S61: Same Source Merging: Merge IPv4 and IPv6 detection results based on MAC address or device unique identifier; S62: Dual-stack status marking: Mark the dual-stack status of each device, i.e. whether it has both IPv4 and IPv6 addresses at the same time; S63: Multidimensional statistical analysis: Perform multidimensional statistical analysis on the data in the asset database; S64: Time-series based anomaly detection: Perform time-series analysis on key indicators of network assets to detect abnormal behavior and configuration changes; S65: Graph-based address relationship fusion: Constructs a graph structure from IPv4 / IPv6 addresses, MAC addresses, hostnames, and switch ports, and uses graph theory algorithms to identify the relationships between devices.

5. The dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis according to claim 4, characterized in that, The multi-dimensional statistical analysis of the data in the asset database includes: S631: IPv6 address deployment rate calculation: Calculate the ratio of the number of active IPv6 addresses to the total number of terminals to assess the deployment status of IPv6; S632: Calculation of IPv6 support rate for internal network devices: Calculate the ratio of the number of internal network devices that support IPv6 to the total number of internal network devices, and evaluate the IPv6 support of internal network devices; S633: IPv6 access rate calculation for various types of terminals: Calculate the IPv6 access rate for various terminals such as servers, workstations, and IoT devices, and evaluate the IPv6 access status of different types of terminals. S634: Comparison of the number of dual-stack devices and single-stack devices: Compare the number of dual-stack devices and single-stack devices; S635: Operating System Distribution and Vendor Share Statistics: Statistics on the distribution of various operating systems in the network; S636: Terminal Asset Coverage and Distribution Map Generation: Generate a terminal asset coverage report and distribution map based on data in the asset database.

6. The dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis according to claim 5, characterized in that, The method of using graph theory algorithms to identify the relationships between devices includes: NodeRank = g(Graph, Node); NodeRank represents the importance or relevance of a node in the graph, Graph represents the graph structure constructed from network asset information, Node represents a node in the graph, representing a network device or interface, and g() is a graph theory algorithm.

Images