Internet asset identification method and device
By employing a hierarchical classification and multi-dimensional feature fusion identification method for internet asset attributes, the problems of low efficiency and poor accuracy in existing technologies have been solved, enabling efficient and accurate identification and ownership determination of key assets.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ELECTRIC POWER RESEARCH INSTITUTE OF STATE GRID JIBEI ELECTRIC POWER CO LTD
- Filing Date
- 2025-11-27
- Publication Date
- 2026-04-21
AI Technical Summary
Existing internet asset identification methods suffer from low efficiency in processing massive amounts of assets, incomplete coverage of feature dimensions, and weak multi-feature fusion capabilities, leading to delays and misjudgments in the identification of critical assets, which affects the timeliness and accuracy of security responses.
By acquiring the asset attributes of internet assets, they are divided into multiple levels of asset attributes, including the first level and other levels. Assets are identified based on the degree of association and influence. A progressive logic of prioritizing key indicators and supplementing with auxiliary indicators is used to determine asset ownership, combined with structured and unstructured characteristics.
It improves the accuracy and efficiency of internet asset identification, ensures the timely identification and accurate attribution of key assets, and solves the balance problem between efficiency and accuracy in traditional identification technologies.
Smart Images
Figure CN121907710A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of data processing technology, and in particular relates to the field of data processing technology in the Internet, specifically a method and apparatus for identifying Internet assets. Background Technology
[0002] Existing internet asset identification methods suffer from the following technical problems: Low efficiency in processing massive assets: When faced with heterogeneous and large-scale web assets (such as multiple domains and multiple service nodes), existing technologies lack a hierarchical classification and processing mechanism, making it impossible to prioritize the identification of critical business assets. This often results in a delay in the identification of critical assets, affecting the timeliness of security response.
[0003] Incomplete coverage of feature dimensions: Existing technologies mostly focus on single or a few types of asset features (such as IP, port, etc.), lacking coverage of multiple dimensions such as semantic features and associated attributes of Web assets, which makes it easy to make misjudgments in asset ownership determination and makes it difficult to guarantee accuracy.
[0004] Weak multi-feature fusion capability: It is difficult to effectively integrate the structured attributes of Web assets (such as HTML source code and header information) with unstructured semantic features (such as business identifiers and functional descriptions), and it is impossible to achieve comprehensive asset determination through multi-dimensional feature collaboration, which further restricts the accuracy of asset identification and ownership determination. Summary of the Invention
[0005] The method for identifying Internet assets provided in this application aims to solve at least some of the aforementioned technical problems.
[0006] Another object of this application is to provide an internet asset identification device. A further object of this application is to provide an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the steps of the aforementioned internet asset identification method. A further object of this application is to provide a readable medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the aforementioned internet asset identification method.
[0007] Firstly, this application provides a method for identifying internet assets, the method comprising: To obtain the asset attributes of internet assets; Based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company, the asset attributes are divided into multiple levels; wherein, the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein, the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. The Internet assets are identified based on the asset attributes of the other levels and / or the asset attributes of the first level.
[0008] In some embodiments of this application, the Internet assets are identified based on the asset attributes of the other levels and / or the asset attributes of the first level; Extract the company name and other attribute elements for each asset attribute in the first level; The correlation between each asset attribute in the first level and the pre-determined core asset attributes in the first level is determined based on the company name and other attribute elements. The Internet assets are identified based on the asset attributes of the other levels and / or the correlation.
[0009] In some embodiments of this application, identifying the internet assets based on the asset attributes of the other levels and / or the correlation includes: If the correlation between all asset attributes at the first level and the core asset attribute is greater than a preset threshold, and the company name matches, then the internet asset is determined to belong to the company corresponding to the core asset attribute.
[0010] In some embodiments of this application, identifying the internet assets based on the asset attributes of the other levels and / or the correlation further includes: If the correlation between any asset attribute of the first level and the core asset attribute is less than the preset threshold and / or the company name of any asset attribute of the first level contradicts the company name of the core asset attribute, the support degree between the Internet asset and all companies is determined based on the correlation. The internet assets are identified based on the support level and the asset attributes of the other levels.
[0011] In some embodiments of this application, identifying the internet asset based on the support level and the other levels of asset attributes includes: Extract the company names from the asset attributes of the other levels; Match the company names of the asset attributes at other levels with the company names at the first level; The internet assets are identified based on the matching results and the support level.
[0012] In some embodiments of this application, the asset attributes include: ICP filing information, domain name, subdomain name, SSL certificate information, IP address registration information, webpage title, HTML original text, CDN history, webpage icon, banner information, header information, and IP address of the Internet asset.
[0013] Secondly, this application provides an identification device for internet assets, the device comprising: The asset attribute acquisition module is used to acquire the asset attributes of internet assets. The asset attribute classification module is used to divide the asset attributes into multiple levels based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. The Internet asset identification module is used to identify the Internet asset based on the asset attributes of the other levels and / or the asset attributes of the first level.
[0014] In some embodiments of this application, the Internet asset identification module includes: The first unit for extracting company names is used to extract the company name and other attribute elements for each asset attribute at the first level. The correlation determination unit is used to determine the correlation between each asset attribute in the first level and the core asset attribute in the first level based on the company name and other attribute elements. The first unit for identifying Internet assets is used to identify the Internet assets based on the asset attributes of the other levels and / or the correlation.
[0015] In some embodiments of this application, the first unit for Internet asset identification includes: The second unit for identifying internet assets is used to determine that the internet asset belongs to the company corresponding to the core asset attribute if the correlation between all asset attributes at the first level and the core asset attribute is greater than a preset threshold, and the company name matches.
[0016] In some embodiments of this application, the first unit for Internet asset identification further includes: The support determination unit is used to determine the support between the Internet asset and all companies based on the correlation if the correlation between any asset attribute of the first level and the core asset attribute is less than the preset threshold and / or the company name of any asset attribute of the first level contradicts the company name of the core asset attribute. The third unit for Internet asset identification is used to identify the Internet asset based on the support level and the asset attributes of other levels.
[0017] In some embodiments of this application, the third unit for Internet asset identification includes: The second unit for extracting company names is used to extract the company names of the asset attributes at other levels. The company name matching unit is used to match the company names of the asset attributes at other levels with the company names at the first level. The fourth unit for Internet asset identification is used to identify the Internet asset based on the matching results and the support level.
[0018] In some embodiments of this application, the asset attributes include: ICP filing information, domain name, subdomain name, SSL certificate information, IP address registration information, webpage title, HTML original text, CDN history, webpage icon, banner information, header information, and IP address of the Internet asset.
[0019] Thirdly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of an Internet asset identification method.
[0020] Fourthly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of an Internet asset identification method.
[0021] Fifthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a method for identifying Internet assets.
[0022] As described above, this application provides a method and apparatus for identifying internet assets. The method for identifying internet assets includes: first, obtaining the asset attributes of the internet asset; then, dividing the asset attributes into multiple levels based on the degree of influence of the asset attributes on determining the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other-level asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other-level asset attributes; and finally, identifying the internet asset based on the other-level asset attributes and / or the first-level asset attributes.
[0023] The method for identifying Internet assets provided in this application can effectively solve the problems of poor accuracy and efficiency in existing Internet asset identification methods. Attached Figure Description
[0024] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0025] Figure 1 This is a flowchart illustrating a method for identifying Internet assets in an embodiment of this application.
[0026] Figure 2 This is a flowchart illustrating step 300 of an internet asset identification method according to an embodiment of this application.
[0027] Figure 3 This is a flowchart illustrating step 303 of an internet asset identification method according to an embodiment of this application.
[0028] Figure 4 This is a flowchart illustrating step 3032 of an internet asset identification method according to an embodiment of this application.
[0029] Figure 5 This is a block diagram of an Internet asset identification device according to an embodiment of this application.
[0030] Figure 6 This is a block diagram of the Internet asset identification module 30 in the embodiments of this application.
[0031] Figure 7 This is a block diagram of the first unit 30c for Internet asset identification in an embodiment of this application.
[0032] Figure 8This is a block diagram of the Internet asset identification third unit 30c2 in the embodiments of this application.
[0033] Figure 9 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation
[0034] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0035] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0036] It should be noted that the terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or apparatuses. Without conflict, the embodiments and features in the embodiments of this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.
[0037] In the process of enterprise digital transformation, the scale of Web assets on the Internet continues to expand, and their structural complexity also increases accordingly. Especially with the widespread adoption of technologies such as cloud-native and containerization, the lifecycle of Web assets has been significantly compressed, and their dynamic change characteristics have become increasingly prominent. At the same time, the problem of "shadow assets"—that is, Web assets not included in the enterprise's IT management system or the jurisdiction of the security department—is becoming increasingly prominent. Because they have long been outside the unified security control of the enterprise, these "shadow assets" generally lack corresponding security monitoring mechanisms and protection measures, becoming not only a weak link in the enterprise's security system but also easily exploited by attackers, becoming a significant shortcut to breaching the enterprise's network defenses.
[0038] Web services are currently the primary service carrier and delivery form for various internet businesses, and their security directly affects business continuity and data security. On the other hand, if enterprises cannot grasp the exposure of their web assets in real time and comprehensively, it will significantly exacerbate cybersecurity risks. Therefore, effective monitoring and mapping of enterprise internet web assets is imperative. The core of this process lies in accurately detecting and performing multi-dimensional integrated analysis of various web resources and their attributes related to the enterprise in cyberspace, and constructing a clear asset mapping relationship.
[0039] However, current mainstream technologies for detecting and mapping web resources in cyberspace still have many limitations and are insufficient to meet the sophisticated security management needs of enterprises. Specifically, existing methods for identifying internet assets have the following technical problems: 1. Current technical solutions mostly adopt a one-time analysis model with all indicators. Due to the lack of an indicator priority determination mechanism, all indicators are treated equally. The difference between "key indicators with a high degree of influence on system ownership determination" and "general indicators with a low degree of influence" is not clearly defined, nor are the determination validity and applicable scenarios of different indicators defined. This application of indicators without hierarchy and with ambiguous weights makes it impossible to focus on core information during the identification process, making it susceptible to interference from redundant indicators, and thus affecting the accuracy of Web asset ownership determination.
[0040] 2. With the explosive growth in the number of Web assets, traditional identification technologies struggle to balance identification efficiency and accuracy. This patent proposes a progressive Web asset ownership determination logic of "prioritizing key indicators" and "quantitative supplementary determination of auxiliary indicators," which improves the efficiency of processing massive amounts of assets. At the same time, it combines the structured features and unstructured semantic features of Web assets for determination, thereby improving the accuracy of asset identification.
[0041] To address these issues, embodiments of this application provide a specific implementation of a method for identifying internet assets. See [link to implementation details]. Figure 1 The method includes: Step 100: Obtain the asset attributes of the internet asset; Step 200: Based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company, the asset attributes are divided into multiple levels; wherein, the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein, the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. Step 300: Identify the Internet asset based on the asset attributes of the other levels and / or the asset attributes of the first level.
[0042] As described above, this application provides a method for identifying internet assets, comprising: first, obtaining the asset attributes of the internet asset; then, dividing the asset attributes into multiple levels based on the degree of influence of the asset attributes on determining the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other-level asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other-level asset attributes; and finally, identifying the internet asset based on the other-level asset attributes and / or the first-level asset attributes.
[0043] The method for identifying Internet assets provided in this application can effectively solve the problems of poor accuracy and efficiency in existing Internet asset identification methods.
[0044] Regarding step 100, a network asset detection and analysis device can be deployed in the network. Upon receiving a specific data collection task, this device actively interacts with the target server and collects asset attribute information, including: ICP registration information, domain name, subdomain, SSL certificate information, IP address registration information, webpage title, HTML source code, CDN history, webpage icon, banner information, header information, IP address, etc. Specifically: ICP Filing Information: A legal identity certificate for website operation, including the name of the organizer, filing number, information of the person in charge, and access service provider. It is managed uniformly by relevant departments and used to verify the legality of the website.
[0045] Domain name: The textual address identifier of a website (such as example.com), which is converted into an IP address through the DNS system and is the main entry point for users to access the website.
[0046] Subdomains: Branch identifiers of the main domain (such as shop.example.com), often used to distinguish different functional modules (e-commerce, blog, API services, etc.).
[0047] SSL certificate information: A secure, encrypted electronic passport for your website, containing the issuing authority, validity period, public key, and a list of domain names, used to ensure secure data transmission.
[0048] IP address registration information: The ownership file of an IP address, recording the country, operator, management agency and contact information (which can be obtained through WHOIS query), used for network resource traceability.
[0049] Page title: The core description of the page displayed in the browser tab, which affects the display of search engine results (e.g., official website homepage - brand name).
[0050] HTML (original text): The underlying code structure of a webpage, including text content, style scripts, and hidden comments, which forms the basic framework for implementing website functions.
[0051] CDN history records: Service trajectory records of the content delivery network, revealing the acceleration node IPs that a website has used, used to track the real server location.
[0052] Website Icon: A unique, miniature identifier for a website displayed in a browser tab. It can be used for asset identification.
[0053] Banner information: The software fingerprint of the server response (such as "Apache / 2.4") exposes the type and version of the web service, affecting security risk assessment.
[0054] Header information: The metadata envelope for network communication, containing control instructions such as content type and caching strategy (e.g., Content-Type: text / html).
[0055] IP address: The digital location coordinates of a device (e.g., 192.0.2.1), used for internet device location and communication routing, and is the ultimate target for network access.
[0056] For step 200, we take dividing asset attributes into two levels as an example: primary indicators (first-level asset attributes) and secondary indicators (asset attributes at other levels). Based on the degree of influence of asset attributes on the determination of internet asset ownership, the collected attributes are divided into primary indicators (key indicators) and secondary indicators (general indicators): Primary indicators include: official company domain name, ICP filing information, SSL certificate information, IP address registration information, subdomains, etc. These indicators all possess official certification attributes. If information from multiple primary indicators corroborates each other and forms a closed loop, the ownership of the assets can be directly identified.
[0057] Secondary indicators include: webpage title, HTML source code, CDN history, icons, banner information, header information, IP address, etc. Unlike primary indicators, which have clear official certification attributes, these indicators do not have the power to independently determine asset ownership. They need to be analyzed in conjunction with primary indicators or other secondary indicators to provide supplementary support for determining asset ownership.
[0058] When implementing step 300, if the ownership of internet assets can be identified solely through the asset attributes of the first level, then other levels of asset attributes are unnecessary. If not, then the ownership of internet assets should be comprehensively identified by combining the asset attributes of other levels.
[0059] In some embodiments of this application, see Figure 2 Step 300 includes: Step 301: Extract the company name and other attribute elements for each asset attribute in the first level; First, each asset attribute collected at the first level is standardized to extract the company name and its corresponding attribute value. In addition, the company name in step 301 can be replaced (or further included) with the company's address, email, telephone number, etc., to construct an asset attribute information set.
[0060] Step 302: Determine the correlation between each asset attribute in the first level and the pre-determined core asset attributes in the first level based on the company name and other attribute elements; Let the number of collected data be... The asset attributes are , , For the total number of asset attributes at the first level, extract the following for each asset attribute: Core attributes (such as company name, address, email, etc.) , If the total number of attribute elements is , then the th The attribute information of an asset can be represented as an attribute vector:
[0061] in, For the first Each attribute element For the first The asset attribute in the first The attribute values under each attribute element. If an asset attribute has no corresponding attribute value, then... The attribute vectors of all asset attributes together constitute the information set of the asset attributes:
[0062] Based on this, the correlation between different asset attributes is calculated. The calculation method is as follows: Define the asset... The first level of asset attributes is One, of which asset attributes For assets The core asset attribute is used to calculate the correlation between other asset attributes and the core asset attribute. The calculation method is as follows:
[0063] in, Asset attributes The number of attribute elements, Asset attributes The number of attribute elements. Asset attributes and asset attributes The number of attribute values that match. For assets Asset attributes With asset attributes The degree of correlation between them, when This explains the asset attributes. With asset attributes There is information overlap, that is, there is a relationship between asset attribute A and asset attribute B.
[0064] Step 303: Identify the Internet assets based on the asset attributes of the other levels and / or the correlation.
[0065] In some embodiments of this application, step 303 includes: If the correlation between all asset attributes at the first level and the core asset attribute is greater than a preset threshold, and the company name matches, then the internet asset is determined to belong to the company corresponding to the core asset attribute.
[0066] Specifically, the process involves determining whether there are conflicts in key attribute values between different first-level asset attributes. Here, the company name is set as the key attribute information. If there are no conflicts in the company name information contained in each asset attribute, and each asset attribute can be effectively associated with the target domain name information, then... If so, the ownership of the asset can be directly confirmed, and it can be determined that the asset belongs to the corresponding corporate entity in the core asset attributes.
[0067] In some embodiments of this application, see Figure 3 Step 303 also includes: Step 3031: If the correlation between any asset attribute of the first level and the core asset attribute is less than the preset threshold and / or the company name of any asset attribute of the first level contradicts the company name of the core asset attribute, determine the support degree between the Internet asset and all companies based on the correlation degree. Based on the above description, this step is necessary when there are conflicts in the key attribute values between different first-level asset attributes. In such cases, the second stage of asset ownership determination needs to be entered, which requires combining the asset attributes collected from other levels to determine asset ownership.
[0068] Step 3032: Identify the Internet asset based on the support level and the asset attributes of the other levels.
[0069] In some embodiments of this application, see Figure 4 Step 3032 includes: Step 30321: Extract the company names of the asset attributes from the other levels; Step 30322: Match the company names of the asset attributes at other levels with the company names at the first level; Step 30323: Identify the Internet assets based on the matching results and the support level.
[0070] In steps 30321 to 30323, based on the analysis in the previous stage, the assets are first calculated. The ownership was determined to be of asset type. The support level for the corresponding company is calculated as follows:
[0071] If a conflict was identified in the previous stage regarding key attribute information (company name), the assets should be calculated using the same method. Assets with conflicting ownership determinations The corresponding company's support .
[0072] Secondly, combining the collected asset attributes from other levels, an assessment of network asset ownership is conducted. First, all asset attributes are standardized to extract key attributes indicating asset ownership, namely the company name. This key attribute value is then matched against the company names identified in the first phase. To quantify the matching results, confidence levels are assigned: a perfect match (0.9 confidence level) is defined as a "precise match"; a partial but not identical match (0.5 confidence level) is defined as a "fuzzy match"; and a complete mismatch (0 confidence level) is defined as a "mismatch". Based on this, differentiated weights are assigned according to the impact of each asset attribute on asset ownership determination. Finally, a weighted average is calculated by combining the weights of each asset attribute with their corresponding confidence levels to arrive at a cumulative confidence score. (Assets are then defined.) Other asset attributes are indivual, Asset attributes Confidence level, Asset attributes The weight, Supporting assets for other asset tiers Classified as an asset The corrected relevance of the corresponding corporate entity.
[0073]
[0074] Further, calculate assets Classified as an asset The final level of support for the corresponding corporate entity.
[0075]
[0076] Using the same method, calculate the assets. Classified as an asset The corresponding company's ultimate level of support. If Then the asset is determined to belong to the asset category. The corresponding company entity, or vice versa.
[0077] In some embodiments of this application, the asset attributes include: ICP filing information, domain name, subdomain name, SSL certificate information, IP address registration information, webpage title, HTML original text, CDN history, webpage icon, banner information, header information, and IP address of the Internet asset.
[0078] As described above, this application provides a method for identifying internet assets, comprising: first, obtaining the asset attributes of the internet asset; then, dividing the asset attributes into multiple levels based on the degree of influence of the asset attributes on determining the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other-level asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other-level asset attributes; and finally, identifying the internet asset based on the other-level asset attributes and / or the first-level asset attributes.
[0079] The method for identifying Internet assets provided in this application can effectively solve the problems of poor accuracy and efficiency in existing Internet asset identification methods.
[0080] To further illustrate the solution, this application also provides a specific implementation of an Internet asset identification system, which includes the following:
[0081] An internet asset identification system includes: an asset attribute information collection module, an asset attribute analysis module, a primary indicator asset ownership assessment module, and a secondary indicator asset ownership assessment module.
[0082] Asset Attribute Information Collection Module: Deploy network asset detection and analysis equipment in the network. After receiving a specific collection task, this module actively interacts with the target server and collects asset attribute information, including: ICP filing information, domain name, subdomain name, SSL certificate information, IP address registration information, webpage title, HTML text, CDN history, webpage icon, banner information, header information, IP address, etc.
[0083] Based on the degree of influence of asset attributes on the determination of internet asset ownership, the collected attributes are divided into primary indicators (key indicators) and secondary indicators (general indicators): Primary indicators include: official company domain name, ICP filing information, SSL certificate information, IP address registration information, subdomains, etc. These indicators all possess official certification attributes. If information from multiple primary indicators corroborates each other and forms a closed loop, the ownership of the assets can be directly identified.
[0084] Secondary indicators include: webpage title, HTML source code, CDN history, icons, banner information, header information, IP address, etc. Unlike primary indicators, which have clear official certification attributes, these indicators do not have the power to independently determine asset ownership. They need to be analyzed in conjunction with primary indicators or other secondary indicators to provide supplementary support for determining asset ownership.
[0085] The asset attribute information collection module stores the collected network asset information in the Internet Web asset information database, and outputs the collected asset attribute information to the asset attribute analysis module.
[0086] Asset Attribute Analysis Module: Based on the output of the asset attribute information collection module, this module determines asset ownership. The asset ownership analysis process uses the target company's "domain name information" as the core benchmark. Other indicators are compared and correlated with this benchmark to determine if there are any "consistent items" or "reasonable correlations." When all indicators are correlated with the core benchmark and there are no core contradictions, the ownership of the web assets can be clearly determined. If any indicators are not correlated with the benchmark or if core contradictions exist, secondary correlation indicators are further invoked for joint supplementary judgment.
[0087] The primary asset attribute ownership assessment module first standardizes the collected asset attribute information, extracting attribute elements and corresponding attribute values. Attribute elements can include company name, address, email, telephone number, etc., constructing a set of asset attribute information. Let the collected first-level asset attribute information be... The asset attributes are , , For the total number of primary asset attributes, extract the following for each asset attribute: Core attributes (such as company name, address, email, etc.) , Let be the total number of attribute elements. Then the th The attribute information of an asset can be represented as an attribute vector:
[0088] in, For the first Each attribute element For the first The asset attribute in the first The attribute values under each attribute element. If an asset attribute has no corresponding attribute value, then... The attribute vectors of all asset attributes together constitute the attribute information set of the asset attribute:
[0089] Based on this, the correlation between different asset attributes is calculated. Calculation method: Define the asset... Primary asset attributes are One, of which asset attributes For assets The core benchmark asset attributes are used to calculate the correlation between each asset attribute and the core benchmark asset attributes. The calculation method is as follows:
[0090] in, Asset attributes Number of attribute elements Asset Attributes Number of attribute elements. Asset attributes and asset attributes The number of attribute values that match. For assets Asset attributes With asset attributes The degree of correlation between them, when This explains the asset attributes. With asset attributes There is information overlap, meaning that asset attributes A and B are related.
[0091] Secondly, determine whether there are conflicts in key attribute values between different primary asset attributes. Set the company name as the key attribute information. If there are no conflicts in the company name information contained in each asset attribute, and each asset attribute can be effectively associated with the target domain name information, then... If the asset ownership is confirmed, the ownership can be directly determined, and the asset can be identified as belonging to the corresponding corporate entity within the core benchmark asset attributes of the domain. Otherwise, the second stage of asset ownership determination is required, which involves combining the collected secondary asset attributes to determine asset ownership.
[0092] Secondary Asset Attribute and Ownership Assessment Module: Based on the assessment in the previous stage, the asset ownership is first calculated. The ownership was determined to be of asset type. The support level for the corresponding company is calculated as follows:
[0093] If a conflict was identified in the previous stage regarding key attribute information (company name), the assets should be calculated using the same method. The attribution was determined to be of conflict asset nature. The corresponding company's support .
[0094] Secondly, based on the collected secondary asset attribute information, an assessment of network asset ownership was conducted. First, the asset attribute information was standardized to extract the key attribute pointing to asset ownership—namely, the company name. This key attribute value was then matched against the company names identified in the first phase. To quantify the matching results, confidence levels were assigned: a perfect match (0.9 confidence level) was assigned if the company name matched exactly; a partial but not identical match (0.5 confidence level) was assigned if the key attribute value was not related to the company information; and a non-match (0 confidence level) was assigned if the key attribute value had no relation to the company information. Based on this, differentiated weights were assigned according to the degree of influence of each asset attribute on asset ownership determination. Finally, a weighted average was calculated to obtain the cumulative confidence level by combining the weights of each asset attribute with their corresponding confidence levels. Assets were then defined. The secondary asset attributes are indivual, Asset attributes Confidence level, Asset attributes The weight, Assets supporting secondary asset attributes Classified as an asset The corrected relevance of the corresponding corporate entity.
[0095]
[0096] Further, calculate assets Classified as an asset The final level of support for the corresponding corporate entity.
[0097]
[0098] Using the same method, calculate the assets. Classified as an asset The corresponding company's ultimate level of support. If Then the asset is determined to belong to the asset category. The corresponding company entity, or vice versa.
[0099] Compared with the prior art, this application has the following beneficial effects: 1. This application is the first to divide the collected attributes into primary indicators (key indicators) and secondary indicators (general indicators) based on the "influence of asset attributes on the system's ownership determination", clarifying the effectiveness and application scenarios of the two types of indicators, and solving the problems of indicators without hierarchy and ambiguous weights in traditional identification.
[0100] 2. This application proposes a progressive logic for determining Web asset ownership, which prioritizes key indicators and quantifies auxiliary indicators to improve the efficiency of processing massive amounts of assets and ensures a balance between the accuracy and efficiency of asset ownership determination.
[0101] 3. This application improves the Web asset identification feature attributes system, and innovatively integrates structured attribute information (such as header information, IP address, etc.) with unstructured semantic features (such as icon semantics), thereby improving the accuracy and reliability of Web asset identification.
[0102] Based on the same inventive concept, embodiments of this application also provide an internet asset identification device, which can be used to implement the methods described in the above embodiments, as shown in the following embodiments. Since the principle of the internet asset identification device in solving the problem is similar to that of the internet asset identification method, the implementation of the internet asset identification device can refer to the implementation of the internet asset identification method, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.
[0103] The embodiments of this application provide a specific implementation of an internet asset identification device capable of implementing an internet asset identification method. See [link to relevant documentation]. Figure 5 A device for identifying internet assets specifically includes the following components: Asset Attribute Acquisition Module 10 is used to acquire the asset attributes of internet assets; The asset attribute classification module 20 is used to divide the asset attributes into multiple levels based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. The Internet asset identification module 30 is used to identify the Internet asset based on the asset attributes of the other levels and / or the asset attributes of the first level.
[0104] In some embodiments of this application, see Figure 6 The Internet asset identification module 30 includes: Company Name Extraction Unit 30a is used to extract the company name and other attribute elements of each asset attribute in the first level. The correlation determination unit 30b is used to determine the correlation between each asset attribute in the first level and the core asset attribute in the first level based on the company name and other attribute elements. The first unit 30c for identifying Internet assets is used to identify the Internet assets based on the asset attributes of the other levels and / or the correlation.
[0105] In some embodiments of this application, the first unit 30c for Internet asset identification includes: The second unit for identifying internet assets is used to determine that the internet asset belongs to the company corresponding to the core asset attribute if the correlation between all asset attributes at the first level and the core asset attribute is greater than a preset threshold, and the company name matches.
[0106] In some embodiments of this application, see Figure 7 The first unit 30c of Internet asset identification also includes: Support determination unit 30c1 is used to determine the support between the Internet asset and all companies based on the correlation if the correlation between any asset attribute of the first level and the core asset attribute is less than the preset threshold and / or the company name of any asset attribute of the first level contradicts the company name of the core asset attribute. The third unit 30c2 for Internet asset identification is used to identify the Internet asset based on the support level and the asset attributes of other levels.
[0107] In some embodiments of this application, see Figure 8 The third unit 30c2 of Internet asset identification includes: The second unit 30c21 for extracting company names is used to extract the company names of the asset attributes at other levels. The company name matching unit 30c22 is used to match the company names of the asset attributes at other levels with the company names in the first level; The fourth unit 30c23 for Internet asset identification is used to identify the Internet asset based on the matching result and the support level.
[0108] In some embodiments of this application, the asset attributes include: ICP filing information, domain name, subdomain name, SSL certificate information, IP address registration information, webpage title, HTML original text, CDN history, webpage icon, banner information, header information, and IP address of the Internet asset.
[0109] As described above, this application provides an internet asset identification device, comprising: an asset attribute acquisition module for acquiring the asset attributes of the internet asset; an asset attribute classification module for dividing the asset attributes into multiple levels based on the degree of influence of the asset attributes on determining the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes; and an internet asset identification module for identifying the internet asset based on the other levels of asset attributes and / or the first-level asset attributes. Compared with the prior art, this application has the following beneficial effects: 1. This application is the first to divide the collected attributes into primary indicators (key indicators) and secondary indicators (general indicators) based on the "influence of asset attributes on the system's ownership determination", clarifying the effectiveness and application scenarios of the two types of indicators, and solving the problems of indicators without hierarchy and ambiguous weights in traditional identification.
[0110] 2. This application proposes a progressive logic for determining Web asset ownership, which prioritizes key indicators and quantifies auxiliary indicators to improve the efficiency of processing massive amounts of assets and ensures a balance between the accuracy and efficiency of asset ownership determination.
[0111] 3. This application improves the Web asset identification feature attributes system, and innovatively integrates structured attribute information (such as header information, IP address, etc.) with unstructured semantic features (such as icon semantics), thereby improving the accuracy and reliability of Web asset identification.
[0112] This application also provides a specific implementation of an electronic device capable of implementing all the steps in the Internet asset identification method described in the above embodiments. See [link to implementation details]. Figure 9 The electronic devices specifically include the following: Processor 1201, memory 1202, communications interface 1203, and bus 1204; The processor 1201, memory 1202, and communication interface 1203 communicate with each other via bus 1204; the communication interface 1203 is used to realize information transmission between server-side devices and client-side devices and other related devices. The processor 1201 is used to call the computer program in the memory 1202. When the processor executes the computer program, it implements all the steps in the Internet asset identification method in the above embodiments. For example, when the processor executes the computer program, it implements the following steps: Step 100: Obtain the asset attributes of the internet asset; Step 200: Based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company, the asset attributes are divided into multiple levels; wherein, the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein, the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. Step 300: Identify the Internet asset based on the asset attributes of the other levels and / or the asset attributes of the first level.
[0113] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the Internet asset identification method in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the Internet asset identification method in the above embodiments. For example, when the processor executes the computer program, it implements the following steps: Step 100: Obtain the asset attributes of the internet asset; Step 200: Based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company, the asset attributes are divided into multiple levels; wherein, the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein, the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. Step 300: Identify the Internet asset based on the asset attributes of the other levels and / or the asset attributes of the first level.
[0114] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, hardware + program embodiments are relatively simple in description because they are fundamentally similar to method embodiments; relevant parts can be referred to the descriptions in the method embodiments.
[0115] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.
[0116] While this application provides method operation steps as shown in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-inventive labor. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only execution order. In actual device or client product execution, the method can be executed in the order shown in the embodiments or drawings or in parallel (e.g., in a parallel processor or multi-threaded processing environment).
[0117] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing the embodiments of this specification, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.
[0118] Those skilled in the art will also know that, besides implementing the controller using purely computer-readable program code, the same functions can be achieved by logically programming the method steps, making the controller function as logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers (PLCs), and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the devices within it used to implement various functions can also be considered structures within that hardware component. Alternatively, the devices used to implement various functions can be considered as both software modules implementing the method and structures within a hardware component.
[0119] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0120] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0121] The embodiments described in this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. The embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.
[0122] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the embodiments in this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.
[0123] The above description is merely an embodiment of the embodiments in this specification and is not intended to limit the embodiments of this specification. For those skilled in the art, various modifications and variations can be made to the embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of this specification should be included within the scope of the claims of the embodiments of this specification.
Claims
1. A method for identifying internet assets, characterized in that, include: To obtain the asset attributes of internet assets; Based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company, the asset attributes are divided into multiple levels; wherein, the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein, the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. The Internet assets are identified based on the asset attributes of the other levels and / or the asset attributes of the first level.
2. The method for identifying Internet assets according to claim 1, characterized in that, Identifying the internet assets based on the asset attributes of the other levels and / or the asset attributes of the first level includes: Extract the company name and other attribute elements for each asset attribute in the first level; The correlation between each asset attribute in the first level and the pre-determined core asset attributes in the first level is determined based on the company name and other attribute elements. The Internet assets are identified based on the asset attributes of the other levels and / or the correlation.
3. The method for identifying Internet assets according to claim 2, characterized in that, Identifying the internet assets based on the asset attributes of the other levels and / or the correlation, including: If the correlation between all asset attributes at the first level and the core asset attribute is greater than a preset threshold, and the company name matches, then the internet asset is determined to belong to the company corresponding to the core asset attribute.
4. The method for identifying Internet assets according to claim 3, characterized in that, Identifying the internet assets based on the asset attributes of the other levels and / or the correlation also includes: If the correlation between any asset attribute of the first level and the core asset attribute is less than the preset threshold and / or the company name of any asset attribute of the first level contradicts the company name of the core asset attribute, the support degree between the Internet asset and all companies is determined based on the correlation. The internet assets are identified based on the support level and the asset attributes of the other levels.
5. The method for identifying Internet assets according to claim 4, characterized in that, Identifying the internet assets based on the support level and the other asset attributes at each level includes: Extract the company names from the asset attributes of the other levels; Match the company names of the asset attributes at other levels with the company names at the first level; The internet assets are identified based on the matching results and the support level.
6. The method for identifying Internet assets according to any one of claims 1 to 5, characterized in that, The asset attributes include: ICP filing information, domain name, subdomain name, SSL certificate information, IP address registration information, webpage title, HTML original text, CDN history, webpage icon, banner information, header information, and IP address of the internet asset.
7. A device for identifying internet assets, characterized in that, include: The asset attribute acquisition module is used to acquire the asset attributes of internet assets. The asset attribute classification module is used to divide the asset attributes into multiple levels based on the degree of influence of the asset attributes on the determination of the association between the internet asset and its parent company; wherein the multiple levels of asset attributes include: first-level asset attributes and other levels of asset attributes; wherein the degree of association influence of the first-level asset attributes is greater than the degree of association influence of the other levels of asset attributes. The Internet asset identification module is used to identify the Internet asset based on the asset attributes of the other levels and / or the asset attributes of the first level.
8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method for identifying Internet assets as described in any one of claims 1 to 6.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method for identifying Internet assets as described in any one of claims 1 to 6.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method for identifying Internet assets as described in any one of claims 1 to 6.