Network data asset surveying and mapping and asset portraying system and method

Abstract

The invention provides a network data asset surveying and mapping and asset portraying system and method, and the system comprises an asset scanning detection module which is used for carrying out the full-port and full-protocol scanning of an IP address in a target network range, so as to find active assets; the asset information analysis module is used for collecting and analyzing multi-dimensional information of the active assets; the asset portrait construction module is used for constructing a structured portrait of the asset based on the multi-dimensional information; and the data synchronization log module is used for synchronizing the structured portrait data to a distributed log convergence device, and can automatically generate a unified structured asset portrait which is comprehensive in coverage, rich in information and contains an association relationship between assets. Therefore, an accurate and reliable data footstone is provided for network security situation awareness, attack surface evaluation and emergency response.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network asset mapping, and in particular to a network data asset mapping and asset portrait system and method. BACKGROUND

[0002] With the deepening of enterprise digital transformation and the wide application of cloud computing, Internet of Things and other technologies, the network boundary of modern organizations is increasingly blurred, and the form, quantity and distribution complexity of internal data assets grow exponentially. Network assets have expanded from traditional physical servers and workstations to a diversified system that includes cloud hosts, container instances, virtual devices and even embedded Internet of Things terminals.

[0003] Under the above background, the traditional static asset ledger or configuration management database (CMDB) relying on manual maintenance exposes serious shortcomings. Specifically, it has a long information update cycle, high maintenance cost, and is extremely dependent on the self-consciousness and standardization of management personnel, resulting in a large number of temporary test systems, shadow IT devices and short-lived cloud resources that cannot be effectively registered and included in the management field of vision. The above blind spots and lags in asset management have made the security protection system built on an incomplete and inaccurate base, and a large number of unknown and unprotected assets have become the most preferred entry point and hidden point for attackers, posing a serious security risk. SUMMARY

[0004] The present application provides a network data asset mapping and asset portrait system and method to solve the technical problem of incomplete asset discovery in the prior art.

[0005] In one aspect, the present application provides a network data asset mapping and asset portrait system, comprising: An asset scanning and detection module for full-port and full-protocol scanning of IP addresses within a target network range to discover active assets; An asset information analysis module for collecting and analyzing multi-dimensional information of the active assets; An asset portrait construction module for constructing a structured portrait of the assets based on the multi-dimensional information; A data synchronization log module for synchronizing the structured portrait data to a distributed log aggregation device.

[0006] In another aspect, the present application provides a network data asset mapping and asset portrait method, comprising: Full-port and full-protocol scanning of IP addresses within a target network range to discover active assets; Collecting and analyzing multi-dimensional information of the active assets; Constructing a structured portrait of the assets based on the multi-dimensional information; The structured profile data is synchronized to the distributed log aggregation device.

[0007] This invention provides a network data asset mapping and profiling system and method. Through integrated asset scanning and detection, multi-dimensional information collection and analysis, and profiling, it achieves automated discovery and dynamic tracking of network assets, solves the asset management blind spot problem caused by lagging ledger updates, and realizes a leap from single static discovery to dynamic panoramic cognition. It can automatically generate a unified structured asset profile that is comprehensive, information-rich, and includes the relationships between assets, thus providing an accurate and reliable data foundation for network security situation awareness, attack surface assessment, and emergency response. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0009] Figure 1 This is a schematic diagram of the network data asset mapping and asset profiling system provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the network data asset mapping and asset profiling method provided in this embodiment of the invention; Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0011] Figure 1 This is a schematic diagram of the network data asset mapping and asset profiling system provided in an embodiment of the present invention.

[0012] See Figure 1 A network data asset mapping and asset profiling system 110 includes an asset scanning and detection module 111, an asset information analysis module 112, an asset profiling construction module 113, and a data synchronization log module 114.

[0013] The asset scanning and detection module 111 is used to perform full port and full protocol scanning on IP addresses within the target network range to discover active assets.

[0014] Specifically, full port and full protocol scanning refers to probing all IP addresses within the target network using ports 0-65535, covering TCP, UDP, and custom transport layer protocols. This can be achieved using an asynchronous I / O scanning framework combined with protocol fingerprint database matching to ensure the identification of services using non-standard ports.

[0015] The asset information analysis module 112 is used to collect and analyze multi-dimensional information of active assets.

[0016] Specifically, multi-dimensional information collection includes static configuration attributes and dynamic behavioral characteristics, which can be achieved by correlating port scan results with traffic behavior analysis, such as cross-validating SSH service fingerprints with login failure logs.

[0017] The asset profile building module 113 is used to build a structured profile of an asset based on multi-dimensional information.

[0018] Specifically, the construction of structured profiles refers to integrating discrete attributes into a unified data model. Specifically, graph databases can be used to store asset topological relationships and attribute associations to form an scalable asset knowledge graph.

[0019] The data synchronization log module 114 is used to synchronize structured profile data to the distributed log aggregation device.

[0020] Specifically, a distributed log aggregation device refers to a log storage system that supports horizontal scaling. It can be implemented using an Elasticsearch cluster architecture to ensure the real-time writing and retrieval of massive amounts of asset data.

[0021] In this embodiment, specifically, the asset scanning and detection module 111 discovers live network devices through a combination of active detection and passive monitoring, covering both physical hosts and virtualized instances. The information collection module continuously monitors the asset's operational status and performs correlation analysis between service protocol characteristics and traffic behavior patterns. The profile building module generates a structured data model containing topological connections and attribute associations by parsing the dependencies between assets. The data synchronization module pushes dynamically updated profile data to the log aggregation platform in real time, forming a unified asset view. When a new container instance is added to the cloud environment, the system automatically identifies its virtual IP and establishes a mapping relationship with the underlying host machine, completing information collection and profile updates before the container is destroyed.

[0022] In this embodiment, through integrated asset scanning and detection, multi-dimensional information collection and analysis, and profile construction, the automated discovery and dynamic tracking of network assets are realized. This solves the problem of asset management blind spots caused by the lag in ledger updates and achieves a leap from single static discovery to dynamic panoramic cognition. It can automatically generate a unified structured asset profile that is comprehensive, information-rich, and includes the relationships between assets, thereby providing an accurate and reliable data foundation for network security situation awareness, attack surface assessment, and emergency response.

[0023] In one embodiment of this specification, a full port and full protocol scan is performed on IP addresses within a target network to discover active assets, including: Step 1: Construct an initial set of live hosts by combining passive traffic awareness with active DNS metadata mining; Passive traffic awareness refers to acquiring network communication data in real time through mirrored traffic capture technology. Specifically, deep packet inspection tools can be used to extract communication IP addresses from mirrored traffic at network boundaries and core nodes to discover live hosts that have generated actual communication activity. Active DNS metadata mining refers to recursively querying various association records of a target network domain name. Specifically, a DNS resolver can be used to traverse A records, AAAA records, and historical records to discover potential live hosts associated with the Domain Name System but not generating real-time traffic.

[0024] Step 2: Based on the initial set of surviving hosts, concurrently execute active probes based on deep parsing of protocol semantics for each host; the payload content of the active probes is dynamically adapted according to the autonomous system or geographical region information to which the target host IP belongs. Among them, proactive probes using deep protocol semantic parsing refer to constructing probe requests with complete interaction logic based on protocol specifications. Specifically, they can use feature payload sequences that simulate the behavior of legitimate clients to identify services that do not conform to standard protocol ports. Dynamically adapting payload content refers to adjusting the probe packet structure according to the network environment to which the target IP belongs. Specifically, it can use a protocol fingerprint rule base bound to autonomous systems or geographical regions to match the interaction characteristics of private protocols or customized services.

[0025] Step 3: Identify spoofed services using non-standard ports based on dynamically adapted active probes; Among them, the masquerading service of non-standard ports refers to hiding the real service type by using unconventional port numbers. Specifically, it can be identified by analyzing the protocol fingerprint features in the response message, which is used to discover security threats that circumvent traditional port scanning.

[0026] Step 4: Merge the initial set of surviving hosts with the identified spoofed services to form a complete set of active assets.

[0027] In this embodiment, specifically, traffic sensors are deployed at network boundaries and core nodes. Deep packet inspection (DIP) technology is used to extract all IP addresses involved in communication within the mirrored traffic, forming a first candidate set of live IPs. Simultaneously, DNS metadata mining is performed on the target network domain name, recursively querying A records, AAAA records, and historical records to extract the resolved IP addresses, forming a second candidate set of live IPs. The two candidate sets are then jointly deduplicated and weighted by confidence to generate an initial set of live hosts. For each IP address in this set, its associated autonomous system or geographical region is queried. The corresponding interaction sequence and feature payload are matched against a pre-set protocol fingerprint rule base to construct a dynamically adapted active probe and initiate protocol semantic parsing. By analyzing the protocol fingerprint features in the response messages, masquerading services using non-standard ports or network services specific to certain regions are identified. Finally, the initial set of live hosts is merged with newly discovered masquerading services and devices to form a complete set of active assets covering active communication, passive response, and covert services.

[0028] In this embodiment, by integrating passive traffic awareness with active DNS metadata mining, the network probing load is reduced while the scope of live host discovery is improved. Furthermore, by combining dynamically adapted protocol probes, disguised services that evade traditional scanning techniques are effectively identified, solving the problem of incomplete asset discovery. This application can accurately identify malicious services hidden through unconventional ports and temporary assets not explicitly registered in the DNS system, significantly improving the coverage of network asset mapping. By dynamically adapting probe payloads to match target network environment characteristics, the false positive rate caused by protocol interaction mismatches is reduced, enhancing the ability to identify private protocols and customized services. By merging multi-source data to construct a complete asset set, reliable basic data support is provided for subsequent asset profiling, effectively eliminating blind spots in asset management.

[0029] In one embodiment of this specification, the collection and analysis of multi-dimensional information on active assets includes: Step 1: By continuously monitoring the network traffic generated by active assets, extract their interaction patterns and communication characteristics to construct dynamic behavioral attributes; Among them, dynamic behavioral attributes refer to the interaction patterns and communication characteristics extracted by real-time monitoring of asset network traffic. Specifically, this can be achieved by using traffic mirroring technology combined with machine learning models to perform pattern recognition on traffic. Its role is to capture the actual behavioral characteristics of assets in a real network environment.

[0030] Step 2: Associate and cross-validate the constructed dynamic behavioral attributes with the static attributes obtained through port scanning and service probing; Static attributes refer to port, protocol, and service information obtained through active scanning and probing. Specifically, tools like Nmap can be used for full port scanning and service fingerprint matching. Their purpose is to obtain asset configuration and basic service information. Cross-validation involves correlating dynamic behavior with static attributes. This can be achieved using rule engines or similarity matching algorithms to compare the two types of data. Its purpose is to identify discrepancies between actual asset behavior and expected configuration.

[0031] Step 3: When cross-validation reveals a deviation within a preset range between the dynamic behavioral attributes and the service characteristics represented by the static attributes of an asset, a re-evaluation of the asset's business attributes is triggered. Step 4: Based on static attributes, dynamic behavior attributes after cross-validation, and business attributes obtained after triggering re-judgment, generate a unified asset state vector as multi-dimensional information for constructing asset profiles.

[0032] Among them, the asset status vector refers to a unified data structure formed by integrating multi-dimensional information. Specifically, it can be implemented by standardizing and encapsulating attributes using JSON or Protobuf formats. Its role is to provide structured input data for subsequent profile construction.

[0033] In this embodiment, specifically, during implementation, the network communication of the target asset is first continuously monitored by traffic acquisition devices deployed in the network. Protocol parsing tools are used to extract its communication frequency, connection objects, and data packet characteristics, forming a dynamic behavioral attribute dataset. Simultaneously, static attributes such as open ports, service versions, and protocol types of the asset are obtained through periodic port scanning and service probing. Subsequently, the dynamic and static attributes are input into the verification system. For example, if the static attributes of an asset indicate that it is running an HTTP service, but SSH protocol interactions frequently appear in the dynamic traffic, the system will determine that there is an attribute deviation. At this point, a business attribute re-judgment process is triggered, for example, by using deep packet inspection to confirm whether there is service spoofing or configuration errors. Finally, the verified static attributes, corrected dynamic behavioral attributes, and re-judged business attributes are integrated to generate an asset status vector containing fields such as timestamp, attribute type, and confidence level.

[0034] In this embodiment, by establishing a cross-validation mechanism for dynamic and static attributes, problems that are difficult to detect using traditional methods, such as service spoofing and configuration anomalies, can be effectively discovered. Simultaneously, the accuracy of attribute data is ensured by triggering a re-judgment process. This application enables deep integration of dynamic behavioral data and static configuration data, automatically identifying and correcting attribute deviations during asset profile construction, thereby improving the completeness and consistency of asset information. This solution solves the problem of misjudgment of asset status caused by information silos in traditional asset management, providing a more reliable asset situational awareness foundation for the security protection system.

[0035] In one embodiment of this specification, constructing a structured profile of an asset based on multi-dimensional information includes: Step 1: Analyze the relationships between assets contained in the multi-dimensional information, and construct a logical dependency chain between the asset and other key assets in the network based on the relationships; Among them, the logical dependency chain refers to the associated link established by analyzing the communication relationship, service call path or data flow between assets. Specifically, it can be implemented by edge relationship modeling in graph database, which is used to represent the business dependency or data interaction relationship between assets.

[0036] Step 2: Integrate and uniformly represent the logical dependency chain with the asset's own static attributes and dynamic behavior patterns; Step 3: Based on the results of integration and unified representation, generate an asset topology snapshot; The asset topology snapshot uses the asset's own attributes as vertex attributes and logical dependency chains as directed edge attributes, all solidified in a unified data structure as a structured portrait of the asset. An asset topology snapshot refers to abstracting assets and their relationships into a graph-structured data representation, which can be stored using adjacency lists or adjacency matrices to map scattered asset attributes and dynamic behaviors into a computable data model. Vertex attributes encapsulate static features such as IP address, open ports, and service type, as well as dynamic features such as traffic patterns and access frequency, into node metadata. This metadata can be serialized and stored using JSON or Protocol Buffers formats to fully describe the current state of the asset. Directed edge attributes refer to the directionality and strength of dependencies, which can be labeled with weighted edge tags to quantify the degree of influence between assets.

[0037] Specifically, when constructing a structured profile, the process first extracts interaction records and communication logs between assets from multi-dimensional information to identify service call chains, data dependency paths, or permission inheritance relationships, forming logical dependency chains. Next, the static attributes and dynamic behavior patterns of the assets are normalized; for example, port scan results are converted into service type enumeration values, and traffic features are converted into time-series vectors. Then, the logical dependency chains are mapped to the normalized attribute data to generate a graph structure containing vertices and directed edges. In this process, the asset's own attributes are encapsulated as vertex attributes, and the direction and weight of the logical dependency chains are encoded as directed edge attributes. The final asset topology snapshot is persistently stored using a unified data structure, such as a graph database to store the relationship data between nodes and edges, enabling subsequent queries to quickly locate related assets using graph traversal algorithms.

[0038] In this embodiment, by introducing graph structure modeling, asset attributes and relationships are integrated into a computable topological snapshot. This not only supports unified storage of multidimensional data but also enables real-time tracking of dependency chain changes through graph traversal algorithms, effectively solving the problems of isolated asset states and difficult correlation analysis. This application enables dynamic updating and correlation analysis of asset profiles. Specifically, when the attributes or behavior patterns of an asset change, the system can quickly locate the affected related asset nodes based on the directed edge attributes in the topological snapshot, thereby improving the efficiency of anomaly detection and impact assessment. Furthermore, by unifying the representation of logical dependency chains and asset attributes, query delays and consistency errors caused by scattered data storage in traditional methods can be avoided, significantly improving the completeness and accuracy of asset profiles.

[0039] In one embodiment of this specification, the constructed dynamic behavioral attributes are correlated and cross-validated with static attributes obtained through port scanning and service probing, including: Step 1: Maintain a baseline of expected behavior for each asset based on its static attributes; Among them, the expected behavior baseline refers to a standardized behavior prediction model established based on static attributes such as the open ports, protocol types and service versions of assets. Specifically, it can be achieved by using machine learning algorithms to train patterns on historical network traffic, which is used to quantify the communication frequency, data packet size and interaction range of assets under normal conditions.

[0040] Step 2: Compare the dynamic behavioral attributes extracted in real time through network traffic with the expected behavioral baseline; Among them, dynamic behavioral attributes refer to the actual communication characteristics of the asset captured in real time through traffic mirroring technology. Specifically, deep packet inspection technology can be used to extract session duration, protocol payload characteristics, and the number of abnormal connection attempts in the traffic, which can be used to reflect the current real operating status of the asset.

[0041] Step 3: When a dynamic behavior attribute is detected to continuously deviate from the expected behavior baseline and the deviation exceeds a preset threshold, an asset anomaly event is generated.

[0042] The preset threshold refers to the tolerable deviation range set according to the asset type and business importance. Specifically, it can be determined by using a sliding window algorithm to statistically analyze the standard deviation of historical data and superimposing a safety margin. It serves as the critical condition for triggering anomaly alarms.

[0043] In this embodiment, specifically, during asset operation, the system continuously collects its network traffic and extracts dynamic behavioral attributes, while simultaneously comparing it in real time with the expected behavioral baseline corresponding to the asset. When the protocol payload characteristics in the dynamic behavioral attributes deviate from the baseline prediction value, such as a server initiating more than a threshold number of abnormal database query requests per unit time, the system determines that the asset has a potential risk. At this time, the abnormal event generation module automatically records the deviation time, deviation index, and associated context information, forming a standardized alarm record and pushing it to the security management platform. The entire process requires no manual intervention, enabling automated identification and response to abnormal asset behavior.

[0044] In this embodiment, by establishing a dynamic behavioral baseline and implementing real-time comparison, subtle abnormal pattern changes during asset operation can be captured. For example, it can detect cryptocurrency mining using legitimate ports or identify advanced persistent threats (APS) transmitting malicious commands through normal service protocols. This application achieves early warning of abnormal asset behavior, solving the problem of unknown risk exposure caused by delayed information updates in traditional asset management. Through automated baseline comparison and threshold triggering mechanisms, abnormal assets deviating from normal business logic can be quickly identified without manual intervention. For example, it can detect unauthorized data transmission or identify IoT devices with implanted backdoors, thereby effectively reducing the probability of security incidents caused by loss of asset control.

[0045] In one embodiment of this specification, an initial set of live hosts is constructed by combining passive traffic awareness with active DNS metadata mining, including: Step 1: Deploy traffic sensors at network boundaries and core nodes, and use deep packet inspection technology to extract all IP addresses involved in communication from mirrored traffic to form the first candidate set of live IPs; Traffic sensors are hardware or software components deployed at key network nodes to capture network traffic. They can be implemented using switches with traffic mirroring capabilities or dedicated probe devices, and their function is to acquire network communication data in real time. Deep packet inspection (DPI) is a technique for decoding network data packets and extracting their content. Specifically, it can be achieved by parsing the header information and payload content of each layer of the TCP / IP protocol stack, used to identify the IP addresses of the communicating parties.

[0046] Step 2: In parallel, perform DNS metadata mining on the target network domain name, recursively query various association records of the target network domain name, extract all resolved IP addresses, and form a second set of candidate live IPs; DNS metadata mining refers to the process of systematically querying and analyzing Domain Name System records. Specifically, it can be achieved by recursively querying A records, AAAA records, MX records, and historical records to discover IP addresses associated with the target domain name.

[0047] Step 3: Perform joint deduplication and confidence-weighted fusion on the first and second live IP candidate sets to generate a highly reliable initial live host set.

[0048] Among them, confidence-weighted fusion refers to a method for reliability assessment and integration of IP address sets from different sources. Specifically, it can assign weight values ​​based on indicators such as traffic sensor capture frequency and DNS record authority, and then merge them to generate a highly reliable set of live hosts.

[0049] In this embodiment, specifically, traffic sensors are deployed at the network boundary and core switching nodes to capture all passing network packets through traffic mirroring. Deep packet inspection (DIP) technology performs protocol parsing on the captured traffic, extracting the source and destination IP addresses to form a first candidate set of live IPs. Simultaneously, a DNS metadata mining module recursively queries the target network domain name to obtain all historical and current DNS records, extracting a second candidate set of live IPs. After deduplication, the two candidate sets are weighted based on indicators such as the frequency of IP address occurrences in the traffic and the authority level of DNS records, and finally merged to generate an initial set of live hosts. For example, if an IP address appears in both traffic mirroring and authoritative DNS records, it is given a higher weight and retained; if it exists only from a single source, it is determined whether to include it in the set based on a preset threshold.

[0050] This embodiment utilizes a complementary dual data source approach—passive traffic awareness and proactive DNS mining—combined with a confidence-weighted mechanism, to effectively cover dynamic IP allocation environments and shadow IT devices, reducing false positives and false negatives. This application addresses the incomplete coverage problem caused by a single data source in asset discovery methods, improving the completeness and accuracy of the initial live host set. By integrating real-time network traffic data with authoritative DNS records, it can identify assets that are difficult to capture using traditional ledgers, such as short-lived cloud hosts and unregistered test devices, providing a reliable foundational dataset for subsequent asset mapping.

[0051] In one embodiment of this specification, the payload content of the active probe is dynamically adapted based on the autonomous system or geographical region information to which the target host IP belongs, including: Step 1: Maintain a protocol fingerprint rule base that is bound to the Autonomous System ID or geographic region; The protocol fingerprint rule base refers to a database that stores the private protocols and customized service interaction characteristics of network devices in different autonomous systems or geographical areas. Specifically, it can be implemented using a distributed key-value database, dynamically updated by continuously collecting communication traffic samples from network devices in various regions and extracting protocol syntax structures and payload characteristics. This rule base provides data support for the dynamic adaptation of probe payloads.

[0052] Step 2: Before initiating an active probe, query the autonomous system or geographical region to which the target IP address belongs; The autonomous system or geographic region query refers to determining the network management entity or physical location range of a target host based on IP address attribution resolution services. This can be achieved through a third-party IP geographic information database or a locally deployed autonomous system mapping table. This query provides filtering conditions for subsequent protocol feature matching.

[0053] Step 3: From the protocol fingerprint rule base, match the interaction sequence and feature payload corresponding to the private protocol or customized service most likely to be used by network devices in the autonomous system or region; Step 4: Load the interaction sequence and feature payload into the active probe to simulate the behavior of legitimate clients and achieve accurate identification and fingerprint collection of non-standard protocol services.

[0054] The interaction sequence and characteristic payload refer to the handshake process and message content format that a specific network device must follow during protocol interaction. Specifically, it may include protocol version identifiers, authentication fields, and encryption negotiation parameters. This data is used to construct probe messages that meet the target device's expectations to trigger a valid response.

[0055] In this embodiment, specifically, when the system needs to actively probe a target IP, it first obtains the Autonomous System Number (AS Number) or Geographic Area Code (GIS Code) of the target IP through the IP address resolution service. Then, based on this code, it retrieves historical protocol interaction records of network devices in that area from the protocol fingerprint rule base, extracting the most frequently occurring protocol types and their corresponding message feature templates. For example, if the target IP belongs to the AS of a certain telecom operator, it prioritizes matching the private management protocol interaction mode of the operator's customized routing devices. The system sequentially encapsulates the extracted protocol handshake steps and payload fields into probe packets and sends them to the non-standard port of the target host. Because the probe payload closely matches the protocol format actually used by the target device, it can effectively bypass the filtering rules of conventional protocol identification mechanisms, thereby accurately identifying masquerading services using non-standard ports or private protocols.

[0056] In this embodiment, by establishing a regionalized protocol feature library and dynamically adapting probe content, the detection strategy can be automatically adjusted for different network environments, significantly improving the ability to discover covert services. This application solves the problem of missed detection of disguised services caused by the solidification of protocol features in the prior art, effectively reducing the probability of false judgments caused by protocol mismatch, ensuring accurate identification and fingerprint collection of network assets using non-standard ports or private communication protocols, thereby improving the completeness and accuracy of asset mapping results.

[0057] In one embodiment of this specification, generating an asset topology snapshot includes: Step 1: Abstract the asset itself as a node in a graph structure, and encapsulate its static attributes and dynamic behavior patterns as a set of attributes for the node; Among them, the node attribute set refers to the structured encapsulation of the basic information and operational characteristics of the asset. Specifically, it can be implemented in JSON or Protobuf format, including static attributes such as IP address and open port, as well as dynamic behavioral parameters such as traffic pattern, which are used to fully describe the operational status of the asset at a specific moment.

[0058] Step 2: Abstract the logical dependency chain between assets into directed edges in a graph structure, and assign dependency type and strength weight to the directed edges; Among them, the dependency type and strength weight of directed edges refer to the nature and degree of influence of the interaction relationship between assets by quantifying the relationship. Specifically, it can be implemented using Bayesian network or Markov chain model. The dependency type can be defined as categories such as data call, service dependency or resource sharing control. The strength weight is calculated by combining historical interaction frequency and response latency.

[0059] Step 3: Based on nodes and directed edges, generate a dynamic business topology subgraph as a topology snapshot of the asset; When the state of an asset represented by any node changes, the potentially affected related asset nodes are calculated and marked based on directed edges and weights. The dynamic business topology subgraph refers to a visualized network structure built upon real-time asset relationships. This can be implemented using a graph database, supporting dynamic updates and retrieval via Cypher or Gremlin query languages. The calculation of affected related asset nodes involves predicting the propagation path of state changes using graph theory algorithms. This can be achieved using breadth-first search combined with a weight decay model, determining the scope of impact by traversing dependent edges and adding weight values.

[0060] In this embodiment, specifically, after asset scanning and information collection are completed, each asset is mapped as an independent node in a graph structure. Its attribute set integrates static configuration and real-time behavioral data through data encapsulation technology. Communication relationships between assets are parsed as directed edges, dependency types are automatically classified based on protocol interaction characteristics, and strength weights are dynamically adjusted based on traffic statistics and response time. When a node experiences a configuration change or abnormal behavior, the system automatically triggers an impact analysis algorithm, traversing related nodes layer by layer along the dependency edge direction, and determining the boundary of the impact range through weight superposition. For example, when a web server node detects a port closure event, the algorithm searches for all related database nodes and load balancer nodes along the service dependency edge and marks high-probability affected objects based on their weight values.

[0061] In this embodiment, by introducing a graph structure model, not only are asset attributes and behavioral characteristics fully preserved, but the real-time status changes of the business chain can also be dynamically reflected. Compared with the isolated event handling mechanism based on threshold alarms, the correlation impact analysis provided by this solution can accurately locate the fault propagation path and effectively improve emergency response efficiency. This application solves the technical problem that asset management systems cannot dynamically track business dependencies. By constructing a graph-based topology snapshot, the complex interaction relationships between assets are visualized and quantitatively analyzed. When a specific asset undergoes a status change, the system can quickly locate potentially affected related devices, providing accurate correlation analysis basis for fault diagnosis and security incident handling. This method is particularly suitable for frequently changing virtual assets in cloud-native environments and can effectively reduce the risk of misjudgment due to unclear dependencies.

[0062] In one embodiment of this specification, the network data asset mapping and asset profiling system 110 further includes: Virtualized asset tracking module 115 is used for: Step 1: Establish a connection with the cloud environment management component to subscribe to and receive real-time lifecycle state change events of virtual machines and containers; Among them, lifecycle state change events refer to system-level notification events triggered by operations such as the creation, migration, and destruction of virtual machines or container instances. Specifically, they can be implemented using API interfaces or message queue subscription mechanisms provided by the cloud platform to perceive the dynamic changes of virtual assets in real time.

[0063] Step 2: Build a dedicated fingerprint feature library for virtualized and containerized assets. The fingerprint features include image identifiers, orchestration controller tags, and storage volume mount information. Among them, the dedicated fingerprint feature library is a set of device identification rules designed specifically for virtualization environments. For example, it can use container runtime interfaces or cloud management platform metadata interfaces to collect feature data such as image hash values ​​and Kubernetes tags to accurately identify the unique identity of containerized assets.

[0064] Step 3: When a virtual asset is detected, a dynamic mapping relationship between the virtual IP and the underlying physical host is established by parsing the overlay network traffic and querying the network policy controller. The dynamic mapping relationship refers to the association between virtual network addresses and actual bearer nodes. This can be achieved by analyzing VXLAN tunnel encapsulation data or querying the SDN controller routing table, and is used to trace the physical resource location by penetrating the virtual network layer. The profile freshness period refers to the effective lifespan of asset profile data. For example, a 5-minute update cycle can be set for containers, and a 30-minute update cycle for virtual machines. Continuous tracking of resource status can be achieved by dynamically adjusting the heartbeat detection interval.

[0065] Step 4: Based on the received asset lifecycle events and the established mapping relationship, set a profile preservation period shorter than that of physical assets for virtualized and containerized assets, and dynamically adjust the detection frequency according to the asset type to ensure that information collection and profile construction are completed before the assets disappear.

[0066] In this embodiment, specifically, when a new virtual machine instance is created in the cloud platform, the virtualization asset tracking module 115 captures the creation event through a pre-built API adapter and immediately triggers the fingerprint collection process. This module calls the container orchestration engine's metadata interface to extract the instance's image version tag and storage volume configuration information, generating a device fingerprint with virtualization environment characteristics. Simultaneously, by monitoring GRE tunnel data packets in the overlay network, it resolves the underlying host physical address corresponding to the virtual IP, forming a mapping table between virtual resources and physical infrastructure. For detected short-lived container assets, the module automatically increases the detection frequency to once per minute for port scanning and forcibly completes service fingerprint collection and profile data solidification before the container terminates.

[0067] In this embodiment, by interfacing with the event bus of cloud-native components, a second-level response to the entire lifecycle of virtual assets is achieved. For example, when a container destruction event is triggered, the probing task for that asset can be immediately terminated and the profile data archived, avoiding invalid scanning traffic. Simultaneously, by constructing a bidirectional mapping between the virtual network layer and physical infrastructure, the problem of untraceable virtual asset location in traditional solutions is solved. This application effectively addresses the asset management blind spots caused by the short lifespan and opaque network location of virtual assets in cloud environments. Specifically, the real-time response mechanism based on lifecycle event subscription ensures the collection and storage of critical information before container instance termination; dynamically adjusted probing frequency and preservation period settings enable the system to adapt to the survival characteristics of different virtualized assets; and the establishment of a mapping relationship between the virtual network layer and the physical layer provides accurate topology association data for asset location in hybrid cloud environments. The resulting full lifecycle tracking capability for virtual assets allows short-lived resources such as temporary test environments and automatically expanding instances to be fully incorporated into the security management system.

[0068] Based on the same general inventive concept, this invention also protects a method for mapping and profiling network data assets, such as... Figure 2 As shown, Figure 2 This is a flowchart illustrating the network data asset mapping and profiling method provided in this embodiment of the invention. The following describes the network data asset mapping and profiling method provided by this invention. The network data asset mapping and profiling method described below can be referred to in correspondence with the network data asset mapping and profiling system described above. The network data asset mapping and profiling method can be applied to the network data asset mapping and profiling system of any of the above embodiments.

[0069] Methods for mapping and profiling network data assets include: Step 201: Perform a full port and full protocol scan on IP addresses within the target network to discover active assets.

[0070] Step 202: Collect and analyze multi-dimensional information on active assets.

[0071] Step 203: Construct a structured profile of the asset based on multi-dimensional information.

[0072] Step 204: Synchronize the structured profile data to the distributed log aggregation device.

[0073] Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention.

[0074] like Figure 3As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340. The processor 310, communications interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions stored in the memory 330 to execute network data asset mapping and asset profiling methods.

[0075] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0076] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the network data asset mapping and asset profiling methods provided by the above methods.

[0077] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the network data asset mapping and asset profiling methods provided by the above methods.

[0078] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0079] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network data asset mapping and asset profiling system, characterized in that, include: The asset scanning and detection module is used to perform full port and full protocol scanning on IP addresses within the target network range to discover active assets; The asset information analysis module is used to collect and analyze multi-dimensional information about the active assets; The asset profile building module is used to build a structured profile of the asset based on the multi-dimensional information. The data synchronization log module is used to synchronize the structured profile data to the distributed log aggregation device.

2. The network data asset mapping and asset profiling system according to claim 1, characterized in that, Perform a full port and full protocol scan on IP addresses within the target network to discover active assets, including: By combining passive traffic awareness with active DNS metadata mining, an initial set of live hosts is constructed. Based on the initial set of surviving hosts, an active probe based on deep parsing of protocol semantics is executed concurrently for each host; wherein, the payload content of the active probe is dynamically adapted according to the autonomous system or geographical region information to which the target host IP belongs; Based on dynamically adapted active probes, identify spoofed services using non-standard ports; The initial set of surviving hosts is merged with the identified spoofed services to form a complete set of active assets.

3. The network data asset mapping and asset profiling system according to claim 1, characterized in that, Collect and analyze multi-dimensional information about the active assets, including: By continuously monitoring the network traffic generated by the active assets, their interaction patterns and communication characteristics are extracted to construct dynamic behavioral attributes. The constructed dynamic behavioral attributes are correlated and cross-validated with the static attributes obtained through port scanning and service probing; When the cross-validation finds that the dynamic behavior attributes of an asset deviate from the service characteristics represented by its static attributes within a preset range, a re-evaluation of the asset's business attributes is triggered. Based on the static attributes, the dynamic behavior attributes after cross-validation, and the business attributes obtained after triggering re-judgment, a unified asset state vector is generated as the multi-dimensional information for constructing the asset profile.

4. The network data asset mapping and asset profiling system according to claim 1, characterized in that, Based on the aforementioned multi-dimensional information, a structured profile of the asset is constructed, including: The relationships between assets contained in the multi-dimensional information are analyzed, and a logical dependency chain between the asset and other key assets in the network is constructed based on the relationships. The logical dependency chain is integrated and uniformly represented with the asset's static attributes and dynamic behavior patterns. Based on the results of the integration and unified representation, an asset topology snapshot is generated; Among them, the asset topology snapshot uses the asset's own attributes as vertex attributes and the logical dependency chain as directed edge attributes, which are then solidified in a unified data structure as a structured portrait of the asset.

5. The network data asset mapping and asset profiling system according to claim 3, characterized in that, The constructed dynamic behavioral attributes are correlated and cross-validated with the static attributes obtained through port scanning and service probing, including: Maintain a baseline of expected behavior for each asset, generated based on its static attributes; The dynamic behavioral attributes extracted in real time through network traffic are compared with the expected behavioral baseline; When a dynamic behavior attribute is detected to continuously deviate from the expected behavior baseline and the deviation exceeds a preset threshold, an asset anomaly event is generated.

6. The network data asset mapping and asset profiling system according to claim 2, characterized in that, The initial set of live hosts is constructed by combining passive traffic awareness with active DNS metadata mining, including: Traffic sensors are deployed at network boundaries and core nodes, and deep packet inspection technology is used to extract all IP addresses involved in communication from mirrored traffic to form the first candidate set of live IPs. Perform DNS metadata mining on the target network domain name, recursively query various association records of the target network domain name, extract all resolved IP addresses, and form a second live IP candidate set; Joint deduplication and confidence-weighted fusion are performed on the first and second live IP candidate sets to generate a highly reliable initial live host set.

7. The network data asset mapping and asset profiling system according to claim 2, characterized in that, The payload content of the active probe is dynamically adapted based on the autonomous system or geographical region information to which the target host IP belongs, including: Maintain a protocol fingerprint rule base that is bound to the Autonomous System ID or geographic region; Before initiating the active probe, query the autonomous system or geographical region to which the target IP address belongs; From the protocol fingerprint rule base, match the interaction sequence and feature payload corresponding to the private protocol or customized service most likely to be used by network devices in the autonomous system or region; The interaction sequence and feature payload are loaded into the active probe to simulate the behavior of a legitimate client, thereby achieving accurate identification and fingerprint collection of non-standard protocol services.

8. The network data asset mapping and asset profiling system according to claim 4, characterized in that, The generation of the asset topology snapshot includes: The asset itself is abstracted as a node in a graph structure, and its static attributes and dynamic behavior patterns are encapsulated as the attribute set of the node; The logical dependency chain between assets is abstracted as a directed edge in a graph structure, and the directed edge is assigned a dependency type and strength weight. Based on the nodes and directed edges, a dynamic business topology subgraph is generated as a topology snapshot of the asset. When the state of an asset represented by any node changes, the associated asset nodes that may be affected are calculated and marked based on the directed edges and weights.

9. The network data asset mapping and asset profiling system according to claim 2, characterized in that, Also includes: The virtualized asset tracking module is used for: Establish a connection with cloud environment management components to subscribe to and receive real-time lifecycle state change events of virtual machines and containers; A dedicated fingerprint feature library is constructed for virtualized and containerized assets. The fingerprint features include image identifiers, orchestration controller tags, and storage volume mount information. When virtual assets are detected, a dynamic mapping relationship between virtual IPs and underlying physical hosts is established by parsing overlay network traffic and querying the network policy controller. Based on the received asset lifecycle events and the established mapping relationship, a shorter profile preservation period is set for virtualized and containerized assets than for physical assets, and the detection frequency is dynamically adjusted according to the asset type to ensure that information collection and profile construction are completed before the assets disappear.

10. A method for mapping and profiling network data assets, characterized in that, include: Perform a full port and full protocol scan on IP addresses within the target network to discover active assets; Collect and analyze multi-dimensional information about the active assets; A structured profile of the asset is constructed based on the aforementioned multi-dimensional information; The structured profile data is synchronized to the distributed log aggregation device.

Images