Asset discovery method and system based on multi-source data fusion and automatic correlation analysis

Abstract

The invention discloses an asset discovery method and system based on multi-source data fusion and automatic association analysis, and belongs to the technical field of network security. The method comprises the following steps: carrying out full-dimensional asset data acquisition through active scanning, passive access and flow monitoring; constructing a unified asset data model, and standardizing multi-source heterogeneous data by using an adaptive analysis engine; performing automatic data quality verification and cleaning on the standardized asset data record through a pre-configured association rule engine, and constructing an asset knowledge graph reflecting an association relationship among assets, asset attributes, vulnerabilities and network topology based on the verified asset data; and real-time synchronization and life cycle management of asset information are realized through an automatic assembly line and a dual-drive updating mechanism. According to the method, the problems of incomplete asset discovery, update lag, poor data quality and weak risk association in the prior art are solved, and full coverage, precise treatment, real-time update and intelligent association of asset data are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to asset management and discovery technology, and more particularly to an asset discovery method and system based on multi-source data fusion and automatic correlation analysis. Background Technology

[0002] Currently, existing asset discovery methods are mainly divided into proactive and reactive discovery, both of which suffer from problems such as lagging dynamic perception capabilities, weak correlation analysis, and difficulties in parsing heterogeneous data. In traditional asset discovery methods, proactive discovery is usually conducted on a fixed schedule. This periodic scanning cannot capture real-time changes in assets in a timely manner. If asset information changes between two scans, it cannot be detected immediately, leading to untimely updates. While reactive discovery can receive some data in real time, the lack of an effective real-time linkage mechanism between various security tools prevents timely data sharing and correlation analysis, resulting in a significant lag in the perception of the asset's dynamic status. This easily leads to discrepancies between the recorded and actual assets, posing a threat to network security management. Furthermore, information assets typically possess multiple attributes, such as IP addresses, ports, operating systems, components, middleware, and versions. These attributes are often multi-sourced, heterogeneous, and have complex logical relationships. In existing technologies, confirming these relationships often relies on manual verification, which is difficult, inefficient, and prone to errors. When faced with a large number of assets, it is difficult for humans to comprehensively and accurately identify the relationships between asset attributes.

[0003] Therefore, there is an urgent need for a method to adapt to the complex and ever-changing network environment and the diverse sources of asset data, to achieve asset discovery and automatic correlation analysis in complex scenarios, and to improve the accuracy and usability of asset data. Summary of the Invention

[0004] In view of the above problems, the present invention is proposed to provide an asset discovery method and system based on multi-source data fusion and automatic correlation analysis to overcome or at least partially solve the above problems.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, embodiments of the present invention provide an asset discovery method based on multi-source data fusion and automatic correlation analysis, comprising the following steps: Step S1: Collect raw asset data from different data sources in the network environment through three collaborative methods: active network probing, passive tool interface access, and network traffic monitoring. Step S2: Based on the preset unified asset data model, the original asset data is adapted, parsed, and standardized to generate standardized asset data records and stored in categories. Step S3: The standardized asset data records are automatically checked and cleaned using a pre-configured association rule engine. Based on the checked asset data, an asset knowledge graph reflecting the relationships between assets, asset attributes, vulnerabilities, and network topology is constructed. Step S4: Through an automated pipeline and a dual-drive update mechanism, the processed asset data is automatically managed to achieve real-time synchronization and lifecycle management of asset information.

[0006] In one embodiment, in step S1: The active network detection includes a combination of TCP SYN half-connection scanning, ICMP liveness detection, and Nmap fingerprinting, with the scanning cycle and scanning bandwidth adaptively adjusted based on the network size. The passive tool interface access includes interfacing with at least one external security tool through a standardized application programming interface (API) or the Syslog protocol to obtain asset-related data generated by the external security tool in real time. The network traffic monitoring includes analyzing network flow data at the network core node to extract session characteristics and address mapping relationships, which are used to discover assets that do not respond to the active network probe.

[0007] In one embodiment, in step S2: The unified asset data model defines a structured model for different types of information assets, including common core fields and type-specific fields; The adaptation parsing and standardization conversion are implemented through a data adaptation engine that includes multiple protocol parsing plugins and data mapping rules. The data mapping rules are used to map non-standard fields from different data sources to standard fields of the unified asset data model.

[0008] In one embodiment, in step S3: The association rule engine is configured with a variety of verification rules for data quality control, including at least one of the following: field integrity verification rules, format validity verification rules, and logical consistency verification rules.

[0009] The construction of the asset knowledge graph specifically includes: using the asset entity as the core node, and using the asset attributes, the vulnerability identifiers related to the asset, and the relationship of the asset in the network topology as associated nodes or edges to construct a multi-dimensional associated network.

[0010] In one embodiment, step S3 further includes a data deduplication step: A composite key is constructed based on multiple attribute fields of the asset, and the hash value of the composite key is calculated; Duplicate asset data records are identified and merged by comparing the hash values.

[0011] In one embodiment, in step S4: The dual-drive update mechanism includes periodic incremental scanning and real-time data synchronization, and sets a buffer period for verification of offline assets. The lifecycle management system enables dynamic tracking of assets by adding, changing, or decommissioning status markers.

[0012] Secondly, embodiments of the present invention also provide an asset discovery system based on multi-source data fusion and automatic correlation analysis, comprising: The collaborative data acquisition module is used to acquire raw asset data from different data sources in the network environment through three methods: active network probing, passive tool interface access, and network traffic monitoring. The data fusion processing module is used to adapt, parse, and standardize the original asset data based on a preset unified asset data model, generate standardized asset data records, and classify and store them. The intelligent association analysis module is used to automatically verify and clean the standardized asset data records through a pre-configured association rule engine, and to construct an asset knowledge graph that reflects the relationship between assets, asset attributes, vulnerabilities and network topology based on the verified asset data. The automated management and update module is used to automatically manage processed asset data through an automated pipeline and a dual-drive update mechanism, thereby achieving real-time synchronization and lifecycle management of asset information.

[0013] In one embodiment, the collaborative data acquisition module includes: The active scanning unit is configured with a combination of TCP SYN half-connection scanning, ICMP liveness detection and Nmap fingerprinting, with the scanning cycle and scanning bandwidth adaptively adjusted based on network size; The passive access unit is configured to interface with at least one external security tool via a standardized application programming interface (API) or the Syslog protocol to obtain asset-related data generated by the external security tool in real time. The traffic monitoring unit is configured to analyze network flow data at the network core node to extract session characteristics and address mapping relationships, and to discover assets that do not respond to the active network probe.

[0014] Thirdly, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method as described in any of the first aspects.

[0015] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method as described in any of the first aspects.

[0016] As can be seen from the above technical solution, compared with the prior art, the present invention has the following technical effects: (1) Full Coverage and Precise Governance: Through a triple collaborative discovery mechanism of "active scanning + passive discovery + traffic monitoring", network assets are detected in an all-round and multi-level manner. Compared with traditional single-tool scanning, it effectively solves the problem of asset omission caused by the missed scans of traditional single tools. The unified asset data model and adaptation engine can standardize and uniformly store heterogeneous data from different security tools, realize centralized management of multi-source data, and greatly improve the efficiency of data utilization and management level.

[0017] (2) Dynamic Real-time Updates: Real-time linkage of active scanning, passive access, and traffic monitoring data constructs a comprehensive dynamic asset monitoring system, which can quickly capture changes in asset status such as additions, modifications, and shutdowns, ensuring that the asset ledger is synchronized with the actual network environment in real time. This real-time update capability enables security managers to promptly grasp the dynamic information of network assets, promptly discover and handle potential security risks, and provide strong support for network security protection.

[0018] (3) Intelligent Association and Risk Mapping: The automated association rule engine performs in-depth analysis and logical verification of asset data through preset rules such as field integrity verification, format legality verification, and logical consistency verification, realizing intelligent association between asset attributes. At the same time, by establishing a precise vulnerability and asset association model, it can quickly and accurately match vulnerabilities with affected assets. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0020] Figure 1 This is a flowchart of the asset discovery method based on multi-source data fusion and automatic correlation analysis provided in this embodiment of the invention; Figure 2 This is an asset management flowchart provided in an embodiment of the present invention; Figure 3 This is a flowchart of the asset discovery process provided in this embodiment of the invention; Figure 4 This is a block diagram of an asset discovery system based on multi-source data fusion and automatic correlation analysis provided in an embodiment of the present invention; Figure 5 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention discloses an asset discovery method based on multi-source data fusion and automatic correlation analysis, referring to... Figure 1 As shown, it includes the following steps: Step S1: Collect raw asset data from different data sources in the network environment through three collaborative methods: active network probing, passive tool interface access, and network traffic monitoring. Step S2: Based on the preset unified asset data model, the original asset data is adapted, parsed, and standardized to generate standardized asset data records and stored in categories. Step S3: The standardized asset data records are automatically checked and cleaned using a pre-configured association rule engine. Based on the checked asset data, an asset knowledge graph reflecting the relationships between assets, asset attributes, vulnerabilities, and network topology is constructed. Step S4: Through an automated pipeline and a dual-drive update mechanism, the processed asset data is automatically managed to achieve real-time synchronization and lifecycle management of asset information.

[0023] This invention can enhance dynamic perception capabilities and update asset information in real time; strengthen correlation analysis and accurately map risks; and improve data quality to achieve automated governance.

[0024] The above steps are explained in detail below with examples: The first step is to build a comprehensive asset data collection system to acquire all heterogeneous asset data. Through a triple collaborative collection mechanism—active scanning, passive access, and traffic monitoring—it overcomes the limitations of single-tool collection, acquiring full and diverse original asset data in the network environment, providing a complete data source for subsequent data processing.

[0025] The proactive scanning employs a combined approach of "TCP SYN half-open scanning + ICMP ping liveness detection + Nmap fingerprinting". It periodically traverses target IP address ranges, for example, performing daily incremental scans on core business network segments and weekly full scans on non-core network segments. The stealth of TCP SYN scanning is used to determine port openness, ICMP ping confirms host liveness, and Nmap's operating system and service fingerprint database is combined to extract basic asset information, such as IP address, port, service type, and system model.

[0026] Periodic scheduling ensures full coverage of routine assets and avoids blind spots in single scanning technologies. For example, for servers with firewalls blocking ICMP requests, TCP SYN scanning can confirm their liveness through port response status. Proactive scanning adaptively adjusts scanning bandwidth based on the number of network segments and ports scanned, and identifies the number of concurrent users according to the broadband dynamic allocation protocol, effectively reducing the scanning's impact on the organization's internal business network resources.

[0027] Passive access is built on standardized protocols such as RESTful API and Syslog to create multi-source tool adaptation interfaces, connecting with mainstream security tools such as Qi An Xin Tian Qing, Bei Xin Yuan Host Audit, and Qing Teng Cloud EDR. It collects heterogeneous information such as scan reports, terminal logs, and vulnerability data output by these tools in real time. For example, when connecting to Qing Teng Cloud EDR, it synchronizes terminal process information every 5 minutes via RESTful API; when connecting to firewalls, it receives port access logs in real time via Syslog. It can complete cross-tool data aggregation without manual intervention, supplementing asset details not covered by active scanning, such as component version, hardware model, and responsible person information, thus solving the periodic lag problem of active scanning.

[0028] Traffic monitoring deploys traffic probes at core network nodes to capture traffic data from NetFlow, IPFIX, and other sources. Through traffic parsing technology, it extracts session characteristics, MAC-IP mapping relationships, and application layer protocol identifiers, focusing on identifying "hidden assets" that do not respond to active scanning, such as unregistered assets and temporary test servers. This complements active and passive data collection, enabling full asset discovery.

[0029] Step 2: Unified asset data modeling and adaptation parsing; First, a standardized asset data model is constructed to sort out the common and special attributes of all types of assets, such as application systems, servers, terminals, network equipment, security equipment, office equipment, etc.; a unified model is defined that includes core fields such as IP, MAC, model, specifications, components, middleware information, etc.

[0030] For example, for server assets, 28 core fields are defined, including "IP address, MAC address, hostname, operating system type and version, CPU architecture, hard drive serial number, deployment location, and responsible person." For network device assets, additional dedicated fields such as "device model, port, protocol, and firmware version" are added. A hybrid storage architecture of "relational database + non-relational database + file system" is adopted to classify and store structured data such as asset ledgers and responsible person information, semi-structured data such as JSON format scan reports, and unstructured data such as device operation logs and vulnerability scan reports (PDF).

[0031] For example, asset ledgers are stored in a MySQL database, JSON reports in MongoDB, and runtime logs in an HDFS file system, ensuring efficient data storage and parsing. Secondly, a multi-source data adaptation engine, using an extensible protocol parsing plugin library, supports mainstream protocols such as SNMP, SSH, and API. Combined with a data mapping rule engine, it automatically maps heterogeneous data from multiple sources to fields in a unified model, completing standardized format conversion without requiring manual writing of customized parsing scripts, thus improving system adaptability and scalability. For instance, when integrating new vulnerability scanning tools, such as Foeye, by configuring XML-formatted mapping rules, the "Vuln_ID" field output by the tool is mapped to the "Vulnerability Number" field in the unified model, without modifying the core code, further enhancing system adaptability and scalability.

[0032] Step 3: Automated correlation analysis and data governance; First, a multi-level rule engine and intelligent algorithms are constructed to automate the cleaning, deduplication, and correlation optimization of asset data, addressing issues of low data quality and weak correlation. The multi-level correlation rule engine uses three core pre-set verification rules to form a quality control system. (1) Field integrity verification: Detect missing fields such as MAC, component, and responsible person, and trigger automatic completion or manual verification; For example, if a unit's IP asset is found to be missing the "responsible person" or "MAC" field, the system will automatically match the asset with the fixed asset number according to the IP, and combine multiple asset data sources such as active scanning, passive discovery, and traffic monitoring to automatically complete the corresponding field information. At the same time, it will automatically trigger the "platform internal message" to notify the administrator of the network segment to which the asset belongs to complete the information and realize manual verification. If the information is not completed within the time limit, it will be marked as "pending update" status. (2) Format validity verification: Verify the compliance of the format of fields such as IP and port through regular expression matching; (3) Logical consistency verification: Establish a rule base for association such as "system-component" and "service-port" to identify contradictory data, such as incompatible system and component versions, and automatically correct them. The rule base supports manual expansion to adapt to different scenario requirements.

[0033] Secondly, an integrated technology of "composite hash deduplication + knowledge graph association + template matching completion" is adopted: 1) Upgraded deduplication mechanism: In addition to IP, MAC, and core service port, a "component version + deployment location" field is added to construct a composite hash key. The hash value is calculated using the SHA-256 algorithm, significantly improving the accuracy of duplicate data identification. For example, if two servers both have the IP "192.168.1.100" but their component versions are "Tomcat 8.5" and "Tomcat 9.0" respectively, the composite hash key can accurately identify them as two different assets. The hash values ​​are as follows: “c7b244519457ca6a14d734f793e952208455fbbd2336ec470742e76b92c7ad02” and “0c9476a3cdba58dcaa8ba6544a981e68a2ab3187e823460f290220c13311bac0”; 2) Construct an asset knowledge graph: With assets as the core nodes, associate them with vulnerability databases (CVEs), component dependency libraries, network topology relationships, and other data to form a four-level association network of "asset-component-vulnerability-topology", supporting intelligent queries such as "one-click query of vulnerability-related assets"; 3) Intelligent completion upgrade: The missing field adopts a dual-drive approach of "template matching + cross-source verification". For example, when the MAC address is missing, the asset attribute template of the same network segment and device type is matched first to obtain the MAC address segment pattern, and then the ARP mapping relationship in the traffic monitoring data is used to verify the completion, which significantly improves the completion success rate.

[0034] By employing a variety of technologies such as MD5 deduplication algorithm, threshold judgment method, and logical verification engine, asset data is thoroughly cleaned and managed, realizing automated management of asset data in complex scenarios and improving the accuracy and usability of asset data.

[0035] Step 4: Full-process automated management and dynamic updates to ensure real-time synchronization of asset information; An automated processing pipeline and a dual-drive update mechanism are constructed to automate the entire asset process from acquisition to management, ensuring data synchronization with the actual environment. The automated processing pipeline, based on a message queue, establishes a fully automated workflow encompassing "access-parsing-modeling-cleaning-association-management." Upon data access, parsing and modeling are automatically triggered. After cleaning and optimization by a rule engine, associations are established between assets and information such as vulnerabilities and responsible parties, ultimately entering the core asset database. A dual-drive dynamic update mechanism is adopted, using a "periodic incremental scanning + real-time data synchronization" strategy. Periodic incremental scanning targets only assets that may change, reducing scanning overhead; a passive tool status push mechanism captures real-time dynamics such as asset online / offline status and configuration changes. Asset lifecycle status markers are established for additions, changes, and offline assets. A buffer period is set for offline assets to avoid false positives, ensuring the real-time nature of asset data.

[0036] This invention employs a multi-pronged collaborative discovery approach combining proactive scanning, reactive discovery, and traffic monitoring. By integrating periodic incremental scanning with real-time data synchronization, it achieves continuous monitoring and rapid response to the real-time status of assets. This ensures that asset data promptly reflects dynamic changes such as asset additions, modifications, and decommissioning, providing real-time and accurate asset information for network security management. Furthermore, it introduces a mature automated analysis mechanism based on association rules. Through pre-defined rules for field integrity verification, format validity verification, and logical consistency verification, it delves into the inherent relationships between various asset attributes, achieving automatic data cleaning and optimization. Simultaneously, it establishes a precise vulnerability-asset correlation model, enabling rapid and accurate identification of assets affected by vulnerabilities, providing strong support for security analysis and decision-making.

[0037] like Figure 2 As shown, asset management is divided into three key stages, forming a complete closed-loop process: Asset assessment: including data collection and integration; Asset management includes data processing and storage; Asset analysis applications: including data utilization and decision support.

[0038] Figure 2 This invention embodies the end-to-end design concept from data collection to value mining, ensuring that asset data is "accurate, complete, and up-to-date".

[0039] Phase 1: Asset assessment, corresponding to the first step of the technical solution; This stage corresponds to "the first step of building a comprehensive asset data collection system." It overcomes the limitations of a single data source through a triple collaborative mechanism of "active scanning + passive access + traffic monitoring." This stage forms the foundation for all subsequent processing, resolving the key pain points of traditional methods, such as incomplete asset discovery and a single data source.

[0040] Phase Two: Asset Management, corresponding to steps two and three of the technical solution; The process involves standardizing, cleaning, and correlating raw, heterogeneous data to improve data quality. This stage integrates the unified modeling step (step 2) and the correlation analysis step (step 3) outlined in the documentation. It transforms the disorganized raw data into high-quality, highly usable asset information, achieving a qualitative leap from "raw data" to "clean data."

[0041] Phase Three: Asset Analysis Application, corresponding to the fourth step of the technical solution and its beneficial effects; By leveraging processed asset data, intelligent applications for security operations and maintenance are achieved. Through an "automated pipeline + dual-drive update" mechanism, real-time synchronization and lifecycle management of asset information are realized, with status markers indicating addition / modification / decommissioning to ensure consistency between the ledger and the actual environment. Analysis applications support advanced functions such as "one-click query of vulnerability-related assets" and asset risk situation analysis, directly supporting security decision-making. Ultimately, the value output of asset data is realized, transforming security management from passive response to proactive early warning, thereby improving the overall security level.

[0042] Figure 3 This is the concretization and visualization of the first step of the present invention. It perfectly integrates the three technical means of "active scanning, passive access, and traffic monitoring" described in the solution into the two main lines of "active discovery" and "passive discovery", and demonstrates how they work together to send data to the central "asset ledger".

[0043] The foundation of "dynamic assurance": The "comparison-listing-update" closed loop shown in the diagram is the underlying operating mechanism that realizes the "dynamic perception capability" and "real-time synchronization" described in the solution. This ensures that the asset ledger can continuously evolve with changes in the IT environment, always remaining "accurate, complete, and up-to-date".

[0044] The starting point of "intelligent governance": Whether it is the "pending claim" or "pending update" list, it is the data source and trigger point for the third step of the subsequent automated cleaning and correlation analysis scheme.

[0045] Figure 3 Centered on authoritative ledgers, and through multi-source, heterogeneous data input, combined with intelligent comparison and classification strategies, the system ultimately achieves continuous convergence and high-quality management of asset data.

[0046] Based on the same inventive concept, embodiments of the present invention also provide an asset discovery system based on multi-source data fusion and automatic correlation analysis, referring to... Figure 4 As shown, it includes: The collaborative data acquisition module is used to acquire raw asset data from different data sources in the network environment through three methods: active network probing, passive tool interface access, and network traffic monitoring. The data fusion processing module is used to adapt, parse, and standardize the original asset data based on a preset unified asset data model, generate standardized asset data records, and classify and store them. The intelligent association analysis module is used to automatically verify and clean the standardized asset data records through a pre-configured association rule engine, and to construct an asset knowledge graph that reflects the relationship between assets, asset attributes, vulnerabilities and network topology based on the verified asset data. The automated management and update module is used to automatically manage processed asset data through an automated pipeline and a dual-drive update mechanism, thereby achieving real-time synchronization and lifecycle management of asset information.

[0047] The collaborative data acquisition module includes: The active scanning unit is configured with a combination of TCP SYN half-connection scanning, ICMP liveness detection and Nmap fingerprinting, with the scanning cycle and scanning bandwidth adaptively adjusted based on network size; The passive access unit is configured to interface with at least one external security tool via a standardized application programming interface (API) or the Syslog protocol to obtain asset-related data generated by the external security tool in real time. The traffic monitoring unit is configured to analyze network flow data at the network core node to extract session characteristics and address mapping relationships, and to discover assets that do not respond to the active network probe.

[0048] This system employs a heterogeneous data fusion technology combining a standardized model and an adaptive parsing engine. Through a hybrid storage architecture of relational databases, non-relational databases, and file systems, coupled with a data mapping rule engine, it improves the efficiency of processing multi-source heterogeneous data. It also utilizes data governance technology driven by multi-field hashing and knowledge graphs, significantly improving the accuracy of duplicate data identification. Combined with a template-matching intelligent completion mechanism, it achieves a dual upgrade in data quality and association depth. Furthermore, it employs an automated pipeline and dual-drive update management mechanism to ensure data real-time performance. These three elements work together to achieve accurate, comprehensive, and up-to-date asset data.

[0049] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the asset discovery method based on multi-source data fusion and automatic correlation analysis as described in the above embodiments.

[0050] Reference Figure 5 As shown, the device may include: a processor 51, a communication interface 52, a memory 53, and a communication bus 54, wherein the processor 51, the communication interface 52, and the memory 53 communicate with each other via the communication bus 54. The processor 51 can call logical instructions in the memory 53 to execute an asset discovery method based on multi-source data fusion and automatic correlation analysis, the method including: Step S1: Collect raw asset data from different data sources in the network environment through three collaborative methods: active network probing, passive tool interface access, and network traffic monitoring. Step S2: Based on the preset unified asset data model, the original asset data is adapted, parsed, and standardized to generate standardized asset data records and stored in categories. Step S3: The standardized asset data records are automatically checked and cleaned using a pre-configured association rule engine. Based on the checked asset data, an asset knowledge graph reflecting the relationships between assets, asset attributes, vulnerabilities, and network topology is constructed. Step S4: Through an automated pipeline and a dual-drive update mechanism, the processed asset data is automatically managed to achieve real-time synchronization and lifecycle management of asset information.

[0051] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the asset discovery method based on multi-source data fusion and automatic correlation analysis as described in the above embodiments.

[0052] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0053] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An asset discovery method based on multi-source data fusion and automatic correlation analysis, characterized in that, Includes the following steps: Step S1: Collect raw asset data from different data sources in the network environment through three collaborative methods: active network probing, passive tool interface access, and network traffic monitoring. Step S2: Based on the preset unified asset data model, the original asset data is adapted, parsed, and standardized to generate standardized asset data records and stored in categories. Step S3: The standardized asset data records are automatically checked and cleaned using a pre-configured association rule engine. Based on the checked asset data, an asset knowledge graph reflecting the relationships between assets, asset attributes, vulnerabilities, and network topology is constructed. Step S4: Through an automated pipeline and a dual-drive update mechanism, the processed asset data is automatically managed to achieve real-time synchronization and lifecycle management of asset information.

2. The method according to claim 1, characterized in that, In step S1: The active network detection includes a combination of TCP SYN half-connection scanning, ICMP liveness detection, and Nmap fingerprinting, with the scanning cycle and scanning bandwidth adaptively adjusted based on the network size. The passive tool interface access includes interfacing with at least one external security tool through a standardized application programming interface (API) or the Syslog protocol to obtain asset-related data generated by the external security tool in real time. The network traffic monitoring includes analyzing network flow data at the network core node to extract session characteristics and address mapping relationships, which are used to discover assets that do not respond to the active network probe.

3. The method according to claim 1, characterized in that, In step S2: The unified asset data model defines a structured model for different types of information assets, including common core fields and type-specific fields; The adaptation parsing and standardization conversion are implemented through a data adaptation engine that includes multiple protocol parsing plugins and data mapping rules. The data mapping rules are used to map non-standard fields from different data sources to standard fields of the unified asset data model.

4. The method according to claim 1, characterized in that, In step S3: The association rule engine is configured with a variety of verification rules for data quality control, including at least one of the following: field integrity verification rules, format validity verification rules, and logical consistency verification rules. The construction of the asset knowledge graph specifically includes: using the asset entity as the core node, and using the asset attributes, the vulnerability identifiers related to the asset, and the relationship of the asset in the network topology as associated nodes or edges to construct a multi-dimensional associated network.

5. The method according to claim 4, characterized in that, Step S3 further includes a data deduplication step: A composite key is constructed based on multiple attribute fields of the asset, and the hash value of the composite key is calculated; Duplicate asset data records are identified and merged by comparing the hash values.

6. The method according to claim 1, characterized in that, In step S4: The dual-drive update mechanism includes periodic incremental scanning and real-time data synchronization, and sets a buffer period for verification of offline assets. The lifecycle management system enables dynamic tracking of assets by adding, changing, or decommissioning status markers.

7. An asset discovery system based on multi-source data fusion and automatic correlation analysis, characterized in that, include: The collaborative data acquisition module is used to acquire raw asset data from different data sources in the network environment through three methods: active network probing, passive tool interface access, and network traffic monitoring. The data fusion processing module is used to adapt, parse, and standardize the original asset data based on a preset unified asset data model, generate standardized asset data records, and classify and store them. The intelligent association analysis module is used to automatically verify and clean the standardized asset data records through a pre-configured association rule engine, and to construct an asset knowledge graph that reflects the relationship between assets, asset attributes, vulnerabilities and network topology based on the verified asset data. The automated management and update module is used to automatically manage processed asset data through an automated pipeline and a dual-drive update mechanism, thereby achieving real-time synchronization and lifecycle management of asset information.

8. The system according to claim 7, characterized in that, The collaborative data acquisition module includes: The active scanning unit is configured with a combination of TCP SYN half-connection scanning, ICMP liveness detection and Nmap fingerprinting, with the scanning cycle and scanning bandwidth adaptively adjusted based on network size; The passive access unit is configured to interface with at least one external security tool via a standardized application programming interface (API) or the Syslog protocol to obtain asset-related data generated by the external security tool in real time. The traffic monitoring unit is configured to analyze network flow data at the network core node to extract session characteristics and address mapping relationships, and to discover assets that do not respond to the active network probe.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1 to 6.

Images