Port detection method and device

Abstract

The invention discloses a port detection method and device, relates to the technical field of network security, and mainly aims to comprehensively and accurately detect an implicit external port of a back-end service. According to the main technical scheme, the method comprises the following steps: analyzing a configuration file of the Web service, and determining an external port of the Web service; from the external ports, recursively tracking a forwarding relationship between the external ports and the service ports of the back-end service, and respectively generating a corresponding access chain for each external port; based on the access chain, determining a target service port which is bound to the loopback address and is suspected to be a hidden external port; identifying a target service port having a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port; and determining the identified target service port having the forwarding relationship with the Web service as a hidden external port of the back-end service.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a port detection method and apparatus. Background Technology

[0002] Backend services often use a type of port that is typically bound to a loopback address on the host machine (e.g., 127.0.0.1). Due to the network isolation of the loopback address, these ports are only accessible to local processes on the host machine and cannot be accessed from the external network. However, with the increasing complexity of network service architectures, a type of "hidden external port" has emerged. While ostensibly accessible only to local processes on the host machine, these hidden external ports can actually be indirectly exposed to the external network through web services. These hidden external ports are highly vulnerable to becoming entry points for attackers to penetrate backend services, leading to security incidents such as data breaches and service hijacking. Therefore, a port detection solution is urgently needed to comprehensively and accurately detect these hidden external ports of backend services in order to address the security risks they pose. Summary of the Invention

[0003] This application proposes a port detection method and apparatus, the main purpose of which is to comprehensively and accurately detect the hidden external ports of backend services.

[0004] To achieve the above objectives, this application mainly provides the following technical solutions: Firstly, this application provides a port detection method. The port detection method provided in this embodiment may include at least: parsing the configuration file of a Web service to determine the external port of the Web service; starting from the external port, recursively tracing the forwarding relationship between the external port and the service port of the backend service, generating a corresponding access chain for each external port; based on the access chain, determining the target service port bound to the loopback address and suspected to be a hidden external port; based on the network connection information corresponding to the external port and the target service port respectively, identifying the target service port that has a forwarding relationship with the Web service; and determining the identified target service port that has a forwarding relationship with the Web service as the hidden external port of the backend service.

[0005] Secondly, this application provides a port detection device, which in this embodiment may include at least: The parsing module is used to parse the configuration file of the Web service and determine the external port of the Web service; The generation module is used to recursively trace the forwarding relationship between the external port and the service port of the backend service, starting from the external port, and generate a corresponding access chain for each external port. The first determining module is used to determine, based on the access chain, the target service port that is bound to the loopback address and is suspected to be a hidden external port; The identification module is used to identify the target service port that has a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port, respectively. The second determining module is used to determine the target service port that has a forwarding relationship with the Web service as the hidden external port of the backend service.

[0006] Thirdly, this application provides a computer-readable storage medium including a stored program, wherein the program, when running, controls the device where the storage medium is located to execute the port detection method of the first aspect.

[0007] Fourthly, this application provides an electronic device, the electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to perform the port detection method of the first aspect.

[0008] Fifthly, this application provides a computer program product comprising: a computer program / computer-executable instructions, wherein the computer program / computer-executable instructions are a port detection method of the first aspect.

[0009] The port detection method and apparatus provided in this application first parse the configuration file of a Web service to determine the external ports of the Web service. Then, starting from the external ports, the forwarding relationship between the external ports and the service ports of the backend services is recursively traced, generating a corresponding access chain for each external port. Next, based on the access chains, target service ports bound to loopback addresses and suspected to be hidden external ports are identified. Finally, based on the network connection information corresponding to the external ports and target service ports, target service ports with forwarding relationships with the Web service are identified, and these identified target service ports with forwarding relationships with the Web service are determined as hidden external ports of the backend services. Therefore, the solution provided in this embodiment first ensures the comprehensiveness of port detection by sorting out the access chains, then captures target service ports bound to loopback addresses and suspected to be hidden external ports based on the access chains, effectively focusing and avoiding blind detection. Finally, by using the network connection information corresponding to the external ports and target service ports, the target service ports are verified, thereby comprehensively and accurately detecting the hidden external ports of the backend services, thus reducing the possibility of false positives.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart of a port detection method provided in one embodiment of this application is shown; Figure 2 This illustration shows a schematic diagram of a port detection device according to an embodiment of this application; Figure 3 A schematic diagram of a port detection device provided in another embodiment of this application is shown. Detailed Implementation

[0013] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0014] Currently, traditional port detection tools can typically only detect the ports that are directly exposed to the outside world by the backend service (i.e., "explicit external ports"), but cannot detect hidden external ports. As a result, hidden external ports remain in the detection blind spot for a long time, making them easy entry points for attackers to penetrate backend services and causing security incidents such as data leaks and service hijacking.

[0015] Research has revealed that while hidden external ports cannot be directly accessed by the external network, they can be indirectly exposed through intermediate nodes such as web services. This indirect exposure process creates an access relationship between the external ports of the web service and the hidden external ports of the backend service. Therefore, by tracing the access chain between the two and capturing the forwarding relationship between the ports, the hidden external ports of the backend service can be identified comprehensively and accurately.

[0016] Based on the above findings, this embodiment provides a port detection technical solution, specifically including: parsing the configuration file of a Web service to determine the external ports of the Web service; starting from the external ports, recursively tracing the forwarding relationship between the external ports and the service ports of the backend services, generating a corresponding access chain for each external port; based on the access chains, identifying target service ports bound to loopback addresses and suspected to be hidden external ports; based on the network connection information corresponding to the external ports and target service ports respectively, identifying target service ports with forwarding relationships with the Web service; and determining the identified target service ports with forwarding relationships with the Web service as hidden external ports of the backend services. Thus, the solution provided in this embodiment first ensures the comprehensiveness of port detection by sorting out the access chains, then captures target service ports bound to loopback addresses and suspected to be hidden external ports based on the access chains, effectively focusing and avoiding blind detection; finally, by using the network connection information corresponding to the external ports and target service ports respectively, the target service ports are verified, thereby comprehensively and accurately detecting the hidden external ports of the backend services, and reducing the possibility of false positives.

[0017] The web services, backend services, and ports involved in the port detection technology solution provided in this embodiment can be flexibly selected based on business needs, and this embodiment does not limit them.

[0018] Based on the above port detection technology, this embodiment provides a port detection method and apparatus. The port detection method and apparatus provided in this embodiment will be described in detail below.

[0019] This application provides a port detection method, such as... Figure 1 As shown, the port detection method provided in this embodiment may include at least the following steps 101 to 105.

[0020] 101. Parse the configuration file of the Web service to determine the external port of the Web service.

[0021] In some embodiments, the service port (the network port used by the backend service for communication) bound to the loopback address (127.0.0.1) of the backend service may indirectly expose itself to the external network through the web service, thus becoming a hidden external port of the backend service. Therefore, when confirming the start of the port detection process, the web service associated with the backend service is first identified.

[0022] In some embodiments, after identifying the Web service, a step of extracting the Web service's configuration file is performed to determine the Web service's external port by parsing the Web service's configuration file. The process of extracting the Web service's configuration file may include at least the following steps 101A to 101C.

[0023] 101A. Based on the Web service process, determine the target Web service type.

[0024] There are many types of web services (such as Nginx, Apache, etc.), and the storage location of the configuration files of different types of web services on the host is different. Therefore, in order to accurately extract the configuration files of web services from the host, it is first necessary to clarify the target web service type so as to locate the configuration path of the web service configuration files on the host based on the target web service type.

[0025] Specifically, firstly, based on the operating system of the host machine where the web service resides, a list of host processes is obtained (e.g., the host process list psaux for Linux, the host process list tasklist for Windows). Then, the web service process is identified from this list. Finally, based on the target mapping library between operating systems, processes, and web service types, the target web service type is determined.

[0026] 101B. Based on the mapping library of operating system, Web service type and configuration path, determine the target configuration path corresponding to the target Web service type.

[0027] First, determine the host's operating system. Then, based on the operating system and the target web service type, query the mapping library to obtain the target configuration path corresponding to the target web service type. For example, if the web service type is Nginx and the operating system is Linux, the target configuration path for the target web service type is: / etc / nginx / nginx.conf. For example, if the web service type is Nginx and the operating system is Windows, the target configuration path for the target web service type is: C:\nginx\conf\nginx.conf. For example, if the web service type is Apache and the operating system is Linux, the target configuration path for the target web service type is: / etc / httpd / conf / httpd.conf.

[0028] 101C. Based on the target configuration path, extract the corresponding configuration file from the file system of the host where the Web service is located.

[0029] The target configuration path is located in the file system of the host where the web service is located using a preset extraction tool, and the configuration file under the target configuration path is extracted. This extracted configuration file is the configuration file of the web service. The preset extraction tool can be flexibly selected based on business needs, and this embodiment does not limit it.

[0030] In some embodiments, after extracting the configuration file of the Web service, the step of parsing the configuration file of the Web service and determining the external port of the Web service is performed. The implementation process of this step may include at least the following steps 101D to 101G.

[0031] 101D. Based on the syntax rules corresponding to Web services, the configuration file is segmented using the configuration unit that carries the listening command as the carrier.

[0032] Web service configuration files are often disorganized. If port information is extracted directly from the configuration file, it will lead to a situation where you are blindly searching through messy text. Therefore, it is necessary to organize the content of the configuration file.

[0033] Specifically, in configuration files (such as those for Nginx and Apache services), the `server` block and the `VirtualHost` block are independent configuration units that carry listening instructions (e.g., Nginx's `server{ ...}`, Apache's ...}).<VirtualHost *:80> ...). This is achieved through the syntax rules corresponding to the web service (e.g., matching the pairwise relationship between `server {` and `}`). <virtualhost>The starting and ending positions of the tags define the complete scope of all configuration units (e.g., server blocks, VirtualHost blocks), covering all sub-configurations within the block. Then, the configuration file is divided into multiple segments, with each independent configuration unit as the smallest unit. Each segment contains only one complete configuration unit, i.e., the entire contents of a server block or a VirtualHost block, clearly defining the ownership of each configuration item through segmentation.

[0034] Furthermore, before segmenting the configuration file based on the syntax rules corresponding to the Web service and using the configuration unit carrying the listening command as the carrier, the comments in the configuration file (such as #, " / / " and other comment lines) can be filtered to retain only the valid configuration content in the configuration file.

[0035] 101E. Classify the configuration items corresponding to the configuration units within each segment to generate structured configuration data.

[0036] For each segment, perform the following steps: First, parse the configuration items contained within the current segment. These configuration items are typically service listening-related key-value pairs or directives (such as `listen 80;`, `server_name example.com;`, `DocumentRoot / var / www;`, `ProxyPass / http: / / 127.0.0.1:8080;`, etc.). Then, categorize the configuration items by functional dimension. For example, functional dimensions can include, but are not limited to, at least one of the following: First, basic listening parameter dimension, such as the listening port (`listen`), the bound IP / domain name (`server_name`, port / IP after `VirtualHost`), etc. Second, resource path configuration dimension, such as the website root directory (`DocumentRoot`), index file (`indexindex.html;`), etc. Third, forwarding / proxy rule dimension, such as reverse proxy (`ProxyPass`, `ProxyPassReverse`), path rewriting (`rewrite`), etc. Fourth, access control dimension, such as allow / deny IPs (`allow`, `deny`), authentication configuration (`AuthType`).

[0037] Subsequently, based on the classification results, structured data with a preset structured format (e.g., JSON) is generated. Specifically, the classified configuration items are organized hierarchically according to "segment identifier → configuration unit type → category → configuration item" to generate structured data.

[0038] 101F: Traverse the structured configuration data to obtain the port information carried by the listening command in the configuration item.

[0039] For example, when traversing to the listen block, listen is an instruction that directly defines the listening port (e.g., listen 80;), and then the port information 80 following listen is extracted through syntax parsing.

[0040] 101G: Determine the port corresponding to the port information as the external port of the Web service.

[0041] Port information is used to represent a port, therefore the port corresponding to the port information is determined as the external port of the Web service. For example, the port information is 80, therefore the port represented by 80 is determined as the external port of the Web service. The external port of the Web service is the entry point connecting the external network and the Web service.

[0042] 102. Starting from the external port, recursively trace the forwarding relationship between the external port and the service port of the backend service, and generate a corresponding access chain for each external port.

[0043] The process of indirectly exposing a hidden external port through a web service creates an access relationship between the web service's external port and the hidden external port. Therefore, it is necessary to trace the access chain between the two in order to identify the target service port of the backend service that is bound to the loopback address and is suspected to be a hidden external port by capturing the forwarding relationship between the ports through the access chain.

[0044] In some embodiments, the process of recursively tracing the forwarding relationship between the external port and the service port of the backend service, starting from the external port, and generating a corresponding access chain for each external port may include at least the following steps 102A to 102B.

[0045] 102A. Select the first service port to participate in recursive tracing from the service ports of the backend services.

[0046] This step can be implemented using any one of the following three methods.

[0047] The first method involves parsing the configuration file of the web service to obtain the target instruction containing the loopback address. The target instruction is related to the forwarding of the web service. The port corresponding to the port information carried by the target instruction is selected as the first service port to participate in the recursive tracing.

[0048] If a backend service's service port is exposed externally, the web service's configuration file will explicitly include the port information (e.g., port number) of that exposed service port in its forwarding-related directives. Based on this, the target directive containing the loopback address is obtained, and the port corresponding to the port information carried by the target directive is selected as the first service port to participate in recursive tracing. The first service ports determined by this method are all service ports bound to the loopback address, thus enabling more targeted detection of whether these ports are actually exposed externally.

[0049] The second approach is to select all service ports in the backend services that are bound to the loopback address as the first service port to participate in the recursive tracing.

[0050] Considering situations such as Web service anomalies, some exposed service ports may not be recorded in the configuration file. Therefore, to avoid missing detections, all service ports bound to the loopback address in the backend service are selected as the first service ports to participate in recursive tracing.

[0051] The third approach is to select all service ports in the backend services as the first service port to participate in recursive tracing.

[0052] The forwarding relationships between service ports within the backend service are complex. It's possible that some service ports bound to loopback addresses are not directly exposed, but are indirectly exposed due to their forwarding relationships with already exposed service ports in the backend service. Therefore, to avoid missed detections, all service ports in the backend service are selected as the first service port to participate in recursive tracing.

[0053] The above three methods can be flexibly selected based on business needs, and this embodiment does not limit the choice of any one of them.

[0054] 102B. For each Web external port, execute the following steps 102B1 to 102B4 respectively.

[0055] The reason for starting the tracing from the external web port is that it is the entry point for external requests. Starting from it makes it easier to clearly reconstruct the complete access chain of the request.

[0056] 102B1. Determine the second service port in the first service port that has a forwarding relationship with the Web external port, and use the second service port as the service port to be detected.

[0057] The methods for determining the second service port within the first service port that has a forwarding relationship with the external Web port can include the following two: One method is to search for the reverse proxy rule (proxy_pass) corresponding to the external port in the Web service's configuration file (e.g., nginx.conf), obtain the service port of the backend service being forwarded, and determine the found service port as the second service port with a forwarding relationship with the external Web port. The other method is to use a packet capture tool (e.g., tcpdump, Wireshark) to capture inbound traffic on the external port of the Web service, analyze the destination address and port of the inbound traffic, and if the analyzed port is included in the first service port, then the analyzed port is determined as the second service port with a forwarding relationship with the external Web port. At least one of the above two methods can be selected based on business needs, and this embodiment does not limit this choice.

[0058] 102B2. Check if the service corresponding to the service port to be detected has a target configuration file and if the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected; if not, proceed to step 102B4; if yes, proceed to step 102B3.

[0059] After identifying the second service port, it needs to be designated as the service port to be tested to determine whether it might serve as the endpoint of the access link. Based on this, it is checked whether the service corresponding to the service port to be tested has a target configuration file, and whether the target configuration file indicates a third service port that has a forwarding relationship with the service port to be tested.

[0060] Furthermore, the access chain is mainly used to capture target service ports that are bound to the loopback address and are suspected to be hidden external ports. Therefore, after detecting that the service corresponding to the service port to be detected has a target configuration file and the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected, it is also possible to detect whether the third service port is bound to the loopback address. If so, step 102B3 is executed; if not, step 102B4 is executed.

[0061] 102B3. Take the third service port as the new service port to be detected, and return to step 102 to check whether the service corresponding to the service port to be detected has a target configuration file and whether the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected.

[0062] If a target configuration file is found for the service corresponding to the service port to be detected, and the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected, it means that there may be other service ports that have a forwarding relationship with the third service port. Therefore, in order to ensure that nothing is missed, the third service port is continued to be used as a new service port to be detected, and the above step 102 is returned to be executed.

[0063] 102B4. Based on the forwarding relationship between the Web external port and all detected service ports, construct the access chain.

[0064] If the service corresponding to the service port to be detected does not have a target configuration file or has a target configuration file but the target configuration file does not indicate a third service port that has a forwarding relationship with the service port to be detected, it means that there are no other service ports with the third service port. The third service port can be used as the end point of the access chain. Therefore, the access chain is constructed based on the forwarding relationship between the Web external port and all detected service ports.

[0065] For example, given Web external port 1, the second service port with a forwarding relationship to Web external port 1 is identified as 8081. The service corresponding to port 8081 (e.g., Tomcat on port 8081) has a configuration file (e.g., Tomcat's server.xml). Therefore, port 8081 is selected as the port to be detected. The system checks if the service corresponding to the port to be detected has a target configuration file indicating a third service port with a forwarding relationship to the port to be detected. After detection, it is determined that the Tomcat configuration file content "proxyPass / apihttp: / / 127.0.0.1:8084" indicates the third service port 8084 with a forwarding relationship to port 8081. Port 8084 does not have a corresponding configuration file. Therefore, based on the forwarding relationship between Web external port 1 and all detected service ports, an access chain is constructed: "Web external port → 8081 → 8084". This access chain is a multi-level chain, ensuring that no hidden external ports are missed.

[0066] 103. Based on the access chain, identify the target service port that is bound to the loopback address and is suspected to be a hidden external port.

[0067] The access chain clarifies the forwarding relationship between the external ports in the Web service and the hidden external ports in the backend service. Moreover, the service ports bound to the loopback address in the access chain may all be exposed to the outside world. Therefore, the service ports bound to the loopback address in the access chain can all be identified as target service ports that are suspected to be hidden external ports.

[0068] In some embodiments, due to business needs, some service ports bound to loopback addresses may be opened to the outside world instead of being accessible only to host-local processes. Therefore, to reduce additional computing power consumption, before identifying the target service port with a forwarding relationship to the Web service based on the network connection information corresponding to the external port and the target service port in step 104, the port detection method provided in this embodiment may further include the following step: removing target service ports whose port identification information exists in a whitelist from the determined target service ports.

[0069] The whitelist records the port identifiers of service ports that are allowed to be exposed externally, and the port identifiers recorded in the whitelist change dynamically according to port usage requirements. For example, if a service port bound to a loopback address needs to be exposed externally based on business requirements, its corresponding port identifier information (such as the backend service information, port number, etc.) is added to the whitelist. After a period of time, if it is no longer needed to be exposed externally, its corresponding port identifier information is removed from the whitelist.

[0070] 104. Based on the network connection information corresponding to the external port and the target service port, identify the target service port that has a forwarding relationship with the Web service.

[0071] The network connection information corresponding to the external port and the target service port are the basis for verifying whether the target service port, which is suspected to be a hidden external port, is actually exposed to the outside world.

[0072] In some embodiments, the process of identifying a target service port that has a forwarding relationship with a Web service based on the network connection information corresponding to the external port and the target service port may include the following steps 104A to 104D.

[0073] 104A. Parse the network connection information corresponding to the external port, and obtain the network connection established with the non-internal network address and the corresponding Web service process PID.

[0074] Network connection information for external ports can be obtained using pre-defined tools (such as Netlink). Network connections established with non-internal network addresses and the corresponding Web service process PID indicate that the external port is connected to the external network.

[0075] 104B. Parse the network connection information corresponding to the target service port and obtain the PID of the network connection source process associated with the target service port.

[0076] Network connection information corresponding to the target service port can be obtained through a preset tool (such as Netlink). The PID of the network connection source process corresponding to the target service port in the network connection information indicates that there is a forwarding relationship for the target service port.

[0077] 104C. Match the PID of the network connection source process with the PID of the Web service process.

[0078] The PID of the process originating the network connection to the target service port may arise from a forwarding relationship between the target service port and the external port of the web service, or it may arise from a forwarding relationship between the target service port and other ports on the host. Therefore, it is necessary to match the PID of the network connection originating process with the PID of the web service process to determine its source.

[0079] 104D. If there is a target network connection source process PID that successfully matches the Web service process PID, and the network connection corresponding to the Web service process PID that the target network connection source process PID successfully matches has an external request, then the target service port corresponding to the network connection information of the target network connection source process PID is identified as the target service port that has a forwarding relationship with the Web service.

[0080] If a target network connection source process PID is successfully matched with the Web service process PID, and the network connection corresponding to the Web service process PID that is successfully matched with the target network connection source process PID has external requests, it means that the target network connection source process PID originates from the forwarding relationship between the corresponding target service port and the external port of the Web service. The corresponding target service port is exposed to the outside world. Therefore, the target service port corresponding to the network connection information of the target network connection source process PID is identified as the target service port that has a forwarding relationship with the Web service.

[0081] Furthermore, if a target network connection source process PID is successfully matched with the Web service process PID, and the network connection corresponding to the Web service process PID matched with the target network connection source process PID has no external requests, it indicates that the target network connection source process PID originates from the forwarding relationship between the target service port and the external port of the Web service. Furthermore, due to certain measures, external access to the corresponding target service port has failed. In this case, two approaches can be taken: First, if the target service port is at risk of exposure, the target service port corresponding to the network connection information of the target network connection source process PID should be identified as a target service port with a forwarding relationship with the Web service. Second, if the target service port has not been successfully accessed, the risk of a security incident is low. Therefore, the target service port corresponding to the network connection information of the target network connection source process PID should not be identified as a target service port with a forwarding relationship with the Web service. Instead, the target service port should be marked to indicate that the target service port has a forwarding relationship with the external port but has not been successfully accessed, for reference by business personnel.

[0082] Furthermore, if no target network connection source process PID is successfully matched with the Web service process PID, it means that the target service port's network connection source process PID originates from the forwarding relationship between the target service port and other ports on the host. The target service port is not exposed to the outside world, so the target service port is identified as an unexposed port.

[0083] In some embodiments, the specific process of steps 104A to 104D is illustrated below with a specific example. The Web service has an external port "port 80", and the backend service includes target service ports "port 8080" and "port 9000". The network connection information corresponding to the external port "port 80" is parsed to obtain network connection 1 established with a non-internal network address and the corresponding Web service process PID "100". The network connection information corresponding to the target service port "port 8080" is parsed to obtain the network connection source process PID "100" associated with the target service port "port 8080". The network connection information corresponding to the target service port "port 9000" is parsed to obtain the network connection source process PID "200" associated with the target service port "port 9000". After matching the network connection source process PID with the Web service process PID, it is found that the network connection source process PID "100" associated with the target service port "port 8080" successfully matches the Web service process PID "100". Therefore, the target service port "port 8080" is identified as the target service port with a forwarding relationship with the Web service. In some embodiments, the target service port may not be exposed indirectly through a web service, but rather directly exposed to the outside world. Based on this, the port detection method provided in this embodiment further includes the following step: detecting whether there are network connections directly connecting to non-internal network addresses in the network connection information corresponding to the target service port.

[0084] If the network connection information corresponding to the target service port contains a network connection that directly connects to a non-internal network address, it means that these target service ports have been directly exposed. Therefore, the corresponding target service ports are identified as target service ports that have a forwarding relationship with the Web service.

[0085] 105. Identify the target service ports that have a forwarding relationship with the Web service as the hidden external ports of the backend service.

[0086] The target service ports identified that have a forwarding relationship with the Web service are indirectly exposed to the outside world through the Web service. Therefore, these target service ports are determined as hidden external ports of the backend service. In some embodiments, a corresponding list of hidden external ports can be generated based on the determined hidden external ports so that business personnel can understand the overall situation of hidden external ports.

[0087] The port detection method provided in this application first parses the configuration file of the Web service to determine the external ports of the Web service. Then, starting from the external ports, it recursively traces the forwarding relationship between the external ports and the service ports of the backend services, generating a corresponding access chain for each external port. Next, based on the access chains, it identifies target service ports bound to loopback addresses and suspected to be hidden external ports. Finally, based on the network connection information corresponding to the external ports and target service ports, it identifies target service ports with forwarding relationships with the Web service, and determines these identified target service ports as hidden external ports of the backend services. Therefore, the solution provided in this embodiment first ensures the comprehensiveness of port detection by sorting out the access chains, then captures target service ports bound to loopback addresses and suspected to be hidden external ports based on the access chains, effectively focusing and avoiding blind detection. Finally, it verifies the target service ports using the network connection information corresponding to the external ports and target service ports, thereby comprehensively and accurately detecting the hidden external ports of the backend services, thus reducing the possibility of false positives.

[0088] In some embodiments of this application, in order to ensure the real-time nature of the external port of the Web service, the port detection method provided in this embodiment may further include the following steps: monitoring changes to the configuration file; if a change to the configuration file is detected, using the changed configuration file as the configuration file to be parsed, and re-executing the step of parsing the configuration file of the Web service to determine the external port of the Web service, so as to re-determine the implicit external port for the backend service.

[0089] Web service configuration files typically reside in the host's file system. Therefore, file system monitoring mechanisms (such as inotify on Linux or ReadDirectoryChangesW on Windows) can be used to monitor changes to these configuration files. Changes can include, but are not limited to, at least one of the following: modification, addition, or deletion.

[0090] If a change in the configuration file is detected, it indicates that the external port of the Web service may have changed. The implicit external port of the backend service may also have changed due to these changes. Therefore, in order to detect the implicit external port of the backend service based on the actual situation, the changed configuration file is used as the configuration file to be parsed, and the above step 101 is re-executed to parse the configuration file of the Web service to determine the Web external port of the Web service, so as to re-determine the implicit external port of the backend service that is consistent with the actual situation.

[0091] In some embodiments of this application, the external exposure status of the hidden external port may change with changes in business requirements. Therefore, in order to grasp the external exposure status of the hidden external port, the port detection method provided in this embodiment may further include the following steps: periodically collecting network connection information corresponding to the external port and the target service port respectively, and in each period, after performing the above step 104 based on the network connection information corresponding to the external port and the target service port respectively to identify the target service port that has a forwarding relationship with the Web service; if it is determined that there is a fourth service port among the target service ports, then the fourth service port is marked as a temporarily invalid hidden external port. The fourth service port is the target service port that was identified as having a forwarding relationship with the Web service in the historical period and has not been identified as having a forwarding relationship with the Web service in the latest consecutive target number of periods; if it is determined that there is a fifth service port among the target service ports, then the fifth service port is marked as a valid hidden external port. The fifth service port is the target service port that is identified as having a forwarding relationship with the Web service in the current period.

[0092] The period can be dynamically configured based on business needs, and this embodiment does not limit it. For example, the period is 5 minutes. In each period, after executing step 104 above, if it is determined that a fourth service port exists in the target service ports, it means that the fourth service port has not received any forwarding from the Web service for a long time, and the probability of a security event occurring on the fourth service port during this period is low. Therefore, the fourth service port is marked as a temporarily disabled hidden external port so that business personnel can adjust the security protection strategy for the service corresponding to the fourth service port according to the mark. If it is determined that a fifth service port exists in the target service ports, it means that the fifth service port receives forwarding from the Web service, and the probability of a security event occurring is high. Therefore, the fifth service port is marked as a valid hidden external port so that business personnel can adjust the security protection strategy for the service corresponding to the fifth service port according to the mark and pay special attention to the service corresponding to the fifth service port.

[0093] Furthermore, the port detection method provided in this embodiment successfully detects hidden external ports that traditional scanning tools cannot detect, eliminating blind spots in host port security detection and preventing hidden external ports from becoming "backdoor entry points" for attackers. Specifically, in each cycle, the hidden external port list is dynamically updated based on the identification of hidden external ports within the cycle, and the hidden external port list can be integrated with a security management platform (such as outputting the hidden port list to a SIEM system), providing timely warnings of newly added hidden external port risks and risks of hidden external ports with changed identifiers, thereby improving the proactive defense capabilities of host network security.

[0094] In some embodiments of this application, the exposure of a hidden external port may pose a security risk. Therefore, in order to effectively address the security risk and reduce the probability of security incidents, the port detection method provided in this embodiment may further include the following steps: determining the security level of each hidden external port based on its port attributes; and performing a handling operation corresponding to the security level on each hidden external port, wherein the handling operation is used to prevent the exposure risk of the hidden external port.

[0095] The port attributes of a hidden external port can be characterized by at least one of the following: the type of data in the service corresponding to the port (reflecting the importance and sensitivity of the data), the function of the service corresponding to the port, and the port identifier. The security level of each hidden external port is determined by mapping port attributes to security levels. Subsequently, based on the mapping between security levels and corresponding actions, the appropriate actions for each hidden external port are determined to effectively address the security risks posed by the exposure of hidden external ports.

[0096] The handling operations may include, but are not limited to, at least one of the following: First, direct blocking operations may include, but are not limited to: (1) closing hidden external ports, for example, directly disabling the external communication permissions of hidden external ports through firewalls and security groups to completely cut off external access paths; (2) port isolation, for example, dividing hosts / services with hidden external ports into independent isolation zones to restrict their interaction with core resources of the internal network; (3) protocol blocking, for example, blocking specific protocols (such as TCP and UDP) used by hidden external ports, allowing only necessary protocols to pass. Second, rate limiting and access control operations may include, but are not limited to: (1) bandwidth rate limiting, for example, limiting the external data transmission bandwidth of hidden external ports to prevent them from occupying a large amount of network resources or leaking massive amounts of data; (2) access frequency limiting, for example, setting the maximum number of connections per unit time to resist brute-force attacks, port scanning and other attacks. Third, source tracing and auditing operations may include, but are not limited to: (1) traffic packet capture analysis, for example, capturing the external communication traffic of hidden external ports, parsing the data packet content, locating the connection object, the data type of transmission and risk behavior. (2) Process association investigation, for example, using system tools (such as netstat, lsof) to find processes bound to hidden external ports to confirm whether they are malicious programs or unauthorized services. Fourth, rectification and optimization operations, which may include but are not limited to: (1) Service migration, for example, if the service associated with the hidden external port is indeed necessary to be provided to the outside world, migrate it to a compliant explicit port and configure a complete access control policy.

[0097] Furthermore, one embodiment of this application also provides a port detection device, such as... Figure 2 As shown, the port detection device provided in this embodiment may include at least: Parsing module 21 is used to parse the configuration file of the Web service and determine the external port of the Web service; The generation module 22 is used to recursively trace the forwarding relationship between the external port and the service port of the backend service, starting from the external port, and generate a corresponding access chain for each external port. The first determining module 23 is used to determine, based on the access chain, the target service port that is bound to the loopback address and is suspected to be a hidden external port; The identification module 24 is used to identify the target service port that has a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port, respectively. The second determining module 25 is used to determine the target service port that has a forwarding relationship with the Web service as the hidden external port of the backend service.

[0098] The port detection device provided in this application first ensures the comprehensiveness of port detection by sorting out the access chain. Then, based on the access chain, it captures the target service port that is bound to the loopback address and is suspected to be a hidden external port, so as to effectively focus and avoid blind detection. Finally, it completes the verification of the target service port by using the network connection information corresponding to the external port and the target service port respectively, thereby comprehensively and accurately detecting the hidden external ports of the backend service, and reducing the possibility of false alarms.

[0099] In some embodiments of this application, such as Figure 3 As shown, the parsing module 21 may include at least: Segmentation unit 211 is used to segment the configuration file based on the syntax rules corresponding to the Web service, using the configuration unit carrying the listening command as the carrier. The first generation unit 212 is used to classify the configuration items corresponding to the configuration units in each segment and generate structured configuration data. Traversal unit 213 is used to traverse the structured configuration data and obtain the port information carried by the listening command in the configuration item; The determining unit 214 is used to determine the port corresponding to the port information as the external port of the Web service.

[0100] In some embodiments of this application, such as Figure 3 As shown, the generation module 22 may include at least: Selection unit 221 is used to select a first service port to participate in recursive tracing from the service ports of the backend service; The second generation unit 222 is configured to perform the following steps for each of the Web external ports: determine a second service port among the first service ports that has a forwarding relationship with the Web external port, and use the second service port as the service port to be detected; detect whether the service corresponding to the service port to be detected has a target configuration file and the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected; if not, construct an access chain based on the forwarding relationship between the Web external port and all detected service ports; if yes, use the third service port as a new service port to be detected, and return to the step of detecting whether the service corresponding to the service port to be detected has a target configuration file and the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected.

[0101] In some embodiments of this application, such as Figure 3 As shown, the second generation unit 222 is specifically used to parse the configuration file of the Web service to obtain a target instruction containing a loopback address, the target instruction being related to the forwarding of the Web service; and to select the port corresponding to the port information carried by the target instruction as the first service port to participate in recursive tracing. Alternatively, all service ports bound to the loopback address in the backend service can be selected as the first service ports to participate in recursive tracing; Alternatively, all service ports in the backend services can be selected as the first service port to participate in recursive tracing.

[0102] In some embodiments of this application, such as Figure 3 As shown, the recognition module 24 may include: The first parsing unit 241 is used to parse the network connection information corresponding to the external port, and obtain the network connection established with the non-internal network address and the corresponding Web service process PID; The second parsing unit 242 is used to parse the network connection information corresponding to the target service port and obtain the PID of the network connection source process associated with the target service port. Matching unit 243 is used to match the PID of the network connection source process with the PID of the Web service process; The identification unit 244 is configured to identify the target service port corresponding to the network connection information of the target network connection source process PID as a target service port that has a forwarding relationship with the Web service if there is a target network connection source process PID that is successfully matched with the Web service process PID, and the network connection corresponding to the Web service process PID that is successfully matched with the target network connection source process PID has an external request.

[0103] In some embodiments of this application, such as Figure 3 As shown, the identification unit 244 can also be used to identify the corresponding target service port as a target service port that has a forwarding relationship with the Web service if a network connection directly connecting to a non-internal network address appears in the network connection information corresponding to the target service port.

[0104] In some embodiments of this application, such as Figure 3 As shown, the port detection device provided in this embodiment may further include: an extraction module 26, used to determine the target Web service type of the Web service based on the Web service process of the Web service; determine the target configuration path corresponding to the target Web service type based on the mapping library of operating system, Web service type and configuration path; and extract the corresponding configuration file from the file system of the host where the Web service is located based on the target configuration path.

[0105] In some embodiments of this application, such as Figure 3 As shown, the port detection device provided in this embodiment may further include: a listening module 27, used to listen for changes in the configuration file; when a change in the configuration file is detected, the changed configuration file is used as the configuration file to be parsed, and the parsing module 21 is triggered to re-execute the step of parsing the configuration file of the Web service and determining the Web external port of the Web service, so as to re-determine the implicit external port for the backend service.

[0106] In some embodiments of this application, such as Figure 3 As shown, the port detection device provided in this embodiment may further include: a removal module 28, used to remove target service ports whose port identification information exists in the whitelist from the determined target service ports before the identification module 24 identifies the target service ports that have a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port respectively. The whitelist is used to record the port identification information of service ports that are allowed to be exposed to the outside, and the port identification information recorded in the whitelist changes dynamically with the port usage requirements. In some embodiments of this application, such as Figure 3 As shown, the port detection device provided in this embodiment may further include: a processing module 29, used to determine the security level of each hidden external port based on the port attributes of the hidden external port; and to perform a processing operation corresponding to the security level on each hidden external port, wherein the processing operation is used to prevent the exposure risk of the hidden external port.

[0107] In some embodiments of this application, such as Figure 3 As shown, the port detection device provided in this embodiment may further include: The acquisition module 30 is used to periodically acquire network connection information corresponding to the external port and the target service port, respectively.

[0108] The identification module 31 is used in each cycle, after the identification module 24 performs the step of identifying the target service port that has a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port respectively; if it is determined that there is a fourth service port among the target service ports, then the fourth service port is marked as a temporarily invalid hidden external port, the fourth service port being the target service port that was identified as having a forwarding relationship with the Web service in the historical cycle and has not been identified as having a forwarding relationship with the Web service in the latest consecutive target number of cycles; if it is determined that there is a fifth service port among the target service ports, then the fifth service port is marked as a valid hidden external port, the fifth service port being the target service port that was identified as having a forwarding relationship with the Web service in the current cycle.

[0109] For a detailed explanation of the various functional modules used in the port detection device provided in this application embodiment, please refer to the corresponding detailed explanation of the above port detection method embodiment, which will not be repeated here.

[0110] Furthermore, one embodiment of this application also provides a computer-readable storage medium, the storage medium including a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the above-described port detection method.

[0111] Furthermore, one embodiment of this application also provides an electronic device, the electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to perform the port detection method described above.

[0112] Furthermore, one embodiment of this application also provides a computer program product, the computer program product comprising: a computer program / computer executable instructions, the computer program / computer executable to perform the above-described port detection method.

[0113] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0114] It is understood that the relevant features in the above methods and apparatus can be referenced together. In addition, the terms "first," "second," etc., in the above embodiments are used to distinguish between the embodiments and do not represent the superiority or inferiority of the embodiments.

[0115] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0116] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing preferred embodiments of this application.

[0117] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0118] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data cutover device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data cutover device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data cutover device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data cutover device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0123] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0124] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0126] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.< / virtualhost>

Claims

1. A port detection method, characterized in that, The method includes: Parse the configuration file of the web service to determine the external port of the web service; Starting from the external port, recursively trace the forwarding relationship between the external port and the service port of the backend service, and generate a corresponding access chain for each external port; Based on the access chain, the target service port bound to the loopback address and suspected to be a hidden external port is identified; Based on the network connection information corresponding to the external port and the target service port, the target service port that has a forwarding relationship with the Web service is identified; The target service port that is identified as having a forwarding relationship with the Web service is determined as the hidden external port of the backend service.

2. The method according to claim 1, characterized in that, Parse the configuration file of the web service to determine the external port of the web service, including: Based on the syntax rules corresponding to the Web service, the configuration file is segmented using the configuration unit that carries the listening command as the carrier; The configuration items corresponding to the configuration units within each segment are categorized to generate structured configuration data; Traverse the structured configuration data to obtain the port information carried by the listening command in the configuration item; The port corresponding to the port information is determined as the external port of the Web service.

3. The method according to claim 1, characterized in that, Starting from the external port, the forwarding relationship between the external port and the service port of the backend service is recursively traced, generating a corresponding access chain for each external port, including: Select the first service port to participate in recursive tracing from the service ports of the backend services; For each of the aforementioned Web external ports, the following steps are performed: First, determine the second service port among the first service ports that has a forwarding relationship with the Web external port, and use the second service port as the service port to be detected. Then, check if the service corresponding to the service port to be detected has a target configuration file and if the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected. If not, construct an access chain based on the forwarding relationship between the Web external port and all detected service ports. If yes, use the third service port as the new service port to be detected, and return to the step of checking if the service corresponding to the service port to be detected has a target configuration file and if the target configuration file indicates a third service port that has a forwarding relationship with the service port to be detected.

4. The method according to claim 3, characterized in that, Selecting the first service port from the service ports of the backend services to participate in recursive tracing includes: Parse the configuration file of the Web service to obtain the target instruction containing the loopback address. The target instruction is related to the forwarding of the Web service. Select the port corresponding to the port information carried by the target instruction as the first service port to participate in recursive tracing. Alternatively, all service ports bound to the loopback address in the backend service can be selected as the first service ports to participate in recursive tracing; Alternatively, all service ports in the backend services can be selected as the first service port to participate in recursive tracing.

5. The method according to claim 1, characterized in that, Based on the network connection information corresponding to the external port and the target service port, the target service port that has a forwarding relationship with the Web service is identified, including: Parse the network connection information corresponding to the external port to obtain the network connection established with the non-internal network address and the corresponding Web service process PID; Parse the network connection information corresponding to the target service port to obtain the PID of the process that provides the network connection associated with the target service port. Match the process ID (PID) of the network connection source process with the process ID (PID) of the Web service process; If a target network connection source process PID is successfully matched with the Web service process PID, and the network connection corresponding to the Web service process PID that is successfully matched with the target network connection source process PID has an external request, then the target service port corresponding to the network connection information of the target network connection source process PID is identified as a target service port that has a forwarding relationship with the Web service.

6. The method according to claim 5, characterized in that, The method further includes: If a network connection directly connects to a non-internal network address in the network connection information corresponding to the target service port, then the corresponding target service port is identified as a target service port that has a forwarding relationship with the Web service.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: determining the target Web service type of the Web service based on the Web service process of the Web service; determining the target configuration path corresponding to the target Web service type based on the mapping library of operating system, Web service type and configuration path; and extracting the corresponding configuration file from the file system of the host where the Web service is located based on the target configuration path. And / or, The method further includes: monitoring changes to the configuration file; if a change to the configuration file is detected, using the changed configuration file as the configuration file to be parsed, and re-executing the step of parsing the configuration file of the Web service to determine the Web external port of the Web service, so as to re-determine the implicit external port for the backend service; And / or, Before identifying the target service port that has a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port respectively, the method further includes: removing the target service ports whose port identification information exists in the whitelist from the determined target service ports, wherein the whitelist is used to record the port identification information of service ports that are allowed to be exposed externally, and the port identification information recorded in the whitelist changes dynamically with the port usage requirements; And / or, The method further includes: determining the security level of each hidden external port based on the port attributes of the hidden external port; and performing a handling operation corresponding to the security level on each hidden external port, wherein the handling operation is used to prevent the exposure risk of the hidden external port; And / or, The method further includes: periodically collecting network connection information corresponding to the external port and the target service port respectively; and in each period, after performing the step of identifying the target service port with a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port respectively; if it is determined that there is a fourth service port among the target service ports, then the fourth service port is marked as a temporarily invalid hidden external port, wherein the fourth service port is a target service port that has been identified as having a forwarding relationship with the Web service in historical periods and has not been identified as having a forwarding relationship with the Web service in the latest consecutive target number of periods; if it is determined that there is a fifth service port among the target service ports, then the fifth service port is marked as a valid hidden external port, wherein the fifth service port is a target service port that has been identified as having a forwarding relationship with the Web service in the current period.

8. A port detection device, characterized in that, The device includes: The parsing module is used to parse the configuration file of the Web service and determine the external port of the Web service; The generation module is used to recursively trace the forwarding relationship between the external port and the service port of the backend service, starting from the external port, and generate a corresponding access chain for each external port. The first determining module is used to determine, based on the access chain, the target service port that is bound to the loopback address and is suspected to be a hidden external port; The identification module is used to identify the target service port that has a forwarding relationship with the Web service based on the network connection information corresponding to the external port and the target service port, respectively. The second determining module is used to determine the target service port that has a forwarding relationship with the Web service as the hidden external port of the backend service.

9. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the port detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, The electronic device includes: a memory for storing a program; and a processor coupled to the memory for running the program to perform the port detection method according to any one of claims 1 to 7.

11. A computer program product, characterized in that, The computer program product includes: a computer program / computer executable instructions, wherein the computer program / computer executable is the port detection method according to any one of claims 1 to 7.

Images