Multi-network card equipment identification method and device

Abstract

The invention discloses a multi-network card equipment identification method and device. The method comprises the following steps: continuously sending a fixed load request to all network ports in an enterprise; receiving a data packet returned by each network port through a TCP protocol; the data packet carries timestamp information; calculating the timestamp progressive rate of each network port by using the timestamp information; and determining whether the plurality of network ports are from the same server or not according to the similarity of the timestamp progressive rates of the plurality of network ports. According to the invention, the problem of repeated asset recording caused by the fact that multiple network cards of the same server belong to different networks can be solved, and the accuracy of enterprise network card identification is improved.

Description

Technical Field

[0001] This invention relates to the fields of computer software and information security technology, and in particular to a method and apparatus for identifying multi-NIC devices. Background Technology

[0002] With the deepening of enterprise digital transformation and the popularization of hybrid cloud architecture, multi-NIC server deployment is commonly used in modern IT infrastructure. To meet the high availability requirements of business operations and adhere to the principle of security minimization, enterprise servers are typically equipped with dual Network Interface Cards (NICs), one for business traffic and one for management traffic. The business NIC connects to the production network and is responsible for handling core business operations such as user requests and data transmission; the management NIC connects to a dedicated management network for remote operation and maintenance, system monitoring, patch upgrades, and other management operations. While this physically isolated network architecture effectively reduces the risk of lateral movement attacks, it leads to serious data distortion problems for asset detection systems when identifying network assets.

[0003] Traditional asset detection technologies primarily rely on active scanning and passive traffic analysis, which can lead to double identification biases in multi-NIC scenarios. When scanners probe the business network segment, the IP addresses, MAC addresses, and open ports discovered through ARP, ICMP, or port scanning differ significantly from the corresponding characteristics of the same server in the management network segment. This causes asset management systems to misclassify the same physical server as two independent assets, creating "shadow asset" records. According to Gartner research data, in enterprises using dual-NIC architectures, the average redundancy rate of asset databases reaches 37.8%, with some financial industry clients even experiencing a 56% increase in fictitious assets. This data distortion not only wastes resources but also poses serious security risks—management NICs may have vulnerabilities due to incomplete inclusion in security baseline configurations, but the asset management system cannot accurately associate them with the business NICs, resulting in blind spots in the implementation of security measures such as vulnerability remediation and policy configuration. Therefore, how to achieve accurate identification and mapping of dual-NIC servers has become a pressing technical challenge in the field of enterprise asset management. Summary of the Invention

[0004] This invention provides a method for identifying multi-NIC devices to solve the problem of duplicate asset recording caused by multiple NICs belonging to different networks on the same server, thereby improving the accuracy of NIC identification for enterprises. The method includes:

[0005] Continuously send fixed load requests to all network ports in the enterprise;

[0006] Receive data packets returned by each network interface via the TCP protocol; the data packets carry timestamp information;

[0007] Calculate the timestamp progression rate for each network interface using timestamp information;

[0008] Based on the similarity of the timestamp progression rates of multiple network interfaces, it is determined whether the multiple network interfaces come from the same server.

[0009] This invention also provides a multi-NIC device identification apparatus to solve the problem of duplicate asset recording caused by multiple NICs belonging to different networks on the same server, thereby improving the accuracy of enterprise NIC identification. The apparatus includes:

[0010] The data acquisition module is used to continuously send fixed load requests to all network ports in the enterprise; receive data packets returned by each network port via the TCP protocol; the data packets carry timestamp information;

[0011] The progressive rate calculation module is used to calculate the timestamp progressive rate of each network interface using timestamp information;

[0012] The judgment module is used to determine whether the multiple network interfaces come from the same server based on the similarity of the timestamp progression rate of the multiple network interfaces.

[0013] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described multi-NIC device identification method.

[0014] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described multi-NIC device identification method.

[0015] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described multi-NIC device identification method.

[0016] In this embodiment of the invention, the similarity of timestamp progression rates is used to determine whether multiple network interfaces come from the same server. This enables accurate identification of multiple network cards on the same server, achieving comprehensive real-time detection and visibility of all assets of the entire enterprise (including previously undetected devices). This method simplifies asset management processes, reduces manual work, improves resource allocation, and solves the problem of duplicate asset recording caused by multiple network cards belonging to different networks on the same server. It also enables the network to quickly adapt to changes (such as the addition of new devices) and ensures the immediate discovery and management of new devices. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0018] Figure 1 This is a flowchart illustrating the multi-NIC device identification method in an embodiment of the present invention;

[0019] Figure 2 This is a specific example diagram of the multi-NIC device identification method in an embodiment of the present invention;

[0020] Figure 3 This is another specific example of the multi-NIC device identification method in the embodiments of the present invention;

[0021] Figure 4 This is a schematic diagram of a multi-NIC device identification device in an embodiment of the present invention;

[0022] Figure 5 This is a schematic diagram of a computer device in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0024] To facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order.

[0025] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0026] Figure 1 This is a flowchart illustrating the multi-NIC device identification method in an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0027] Step 101: Continuously send fixed load requests to all network ports in the enterprise;

[0028] Step 102: Receive data packets returned by each network interface via the TCP protocol; the data packets carry timestamp information;

[0029] Step 103: Calculate the timestamp progression rate for each network interface using timestamp information;

[0030] Step 104: Determine whether the multiple network interfaces come from the same server based on the similarity of their timestamp progression rates.

[0031] from Figure 1 As can be seen from the process shown, the embodiments of the present invention, based on the global message order-timestamp progression rate, determine the uniqueness of physical devices by the consistency of underlying operating system characteristics exposed by multiple network interface devices in cross-network communication, thereby solving the problem of duplicate asset records caused by multiple network interface cards belonging to different networks on the same server, and improving the accuracy of asset lists and the efficiency of security baseline management.

[0032] In practice, TCP timestamps are negotiated and enabled beforehand when establishing connections with all network ports within the enterprise. Specifically, a three-way handshake is used to establish the connection, and both communicating parties enter the ESTABLISHED state (connection established). In this way, all data packets returned by the enterprise's network ports will carry timestamp information, specifically TSval.

[0033] The fixed load request sent is a TCP SYN packet with a timestamp option, and the data packets returned by each network interface via the TCP protocol are received.

[0034] Using timestamp information, the timestamp progression rate of each network interface is calculated. Based on the similarity of the timestamp progression rates of multiple network interfaces, it is determined whether the multiple network interfaces come from the same server.

[0035] In practice, when receiving Transmission Control Protocol (TCP) packets with timestamp options from a remote server, these timestamps increment over time, and their rate of increase reflects the clock behavior and data processing patterns of the remote server. When monitoring the TCP timestamps of a server for an extended period, under normal operating conditions, if the server's clock speed is perfectly synchronized with the local clock, the observed timestamps will increment by exactly 1000 units (milliseconds) every second. However, in real-world applications, clocks may drift slightly, and data processing latency varies, causing fluctuations in the actual timestamp increment rate. The timestamp increment rate at any given time can be expressed as:

[0036] r(t) = [TSval(t + ) - TSval(t)] / ;

[0037] in, It is a small time window, usually 1 second in actual measurement. TSval comes from the TCP Option field.

[0038] When a burst sequence of data packets is sent to a specific network interface of a server, the server's central processing unit (CPU) needs to process these packets. This process temporarily affects its ability to process data packets from other NICs (Network Interface Cards). If the two NICs do belong to the same server, this processing load will cause a correlation change in the timestamp progression rates of the two network interfaces.

[0039] In one embodiment, it is necessary to understand the normal behavior of each network port before introducing any load. Figure 2 This is a specific example diagram of the multi-NIC device identification method in an embodiment of the present invention, such as... Figure 2 As shown, before continuously sending fixed load requests to all network ports in the enterprise, the method may further include:

[0040] Step 201: Send probe data packets to all network ports in the enterprise at fixed intervals, and establish a baseline for each network port based on the data returned by the network ports.

[0041] The baseline includes, but is not limited to, throughput, health, status, and queue data under normal network interface operation, or any combination thereof. Throughput includes, for example, inbound / outbound traffic (Bps), packet rate (pps), and bandwidth utilization; health includes, for example, CRC errors, FIFO errors, dropped packets, and very short / very long frames; status includes, for example, link status, negotiated rate, and duplex mode; and queues include, for example, input / output queue length and buffer packet loss.

[0042] Baselines are crucial for decision-making and network optimization. By establishing baselines, enterprise networks can be effectively monitored, anomalies can be quickly identified, and important decisions can be supported.

[0043] During implementation, for each network interface to be tested, probe packets are sent at fixed time intervals, with a request sent every 200 milliseconds. For each network interface i and each time point t, the following information is recorded:

[0044] Receive local time: t_local;

[0045] Remote TCP timestamp: TSval_i(t);

[0046] Round trip time: RTT_i(t);

[0047] This baseline data collection process should last at least 60 seconds to establish a baseline for normal behavior.

[0048] To improve the accuracy of network interface timestamp progression rate testing, in one embodiment, continuously sending fixed load requests to all network interfaces in the enterprise may include:

[0049] A fixed load request is sent to all network ports in the enterprise according to a preset load cycle; each load cycle includes a high load period and a low load period; the amount of data sent during the high load period is greater than the amount of data sent during the low load period.

[0050] Furthermore, using timestamp information to calculate the timestamp progression rate for each network interface can include:

[0051] Using timestamp information, calculate the timestamp progression rate for each network interface during the high-load and low-load periods of each load cycle.

[0052] In this example, the load cycle includes high-load and low-load periods, establishing a periodic pattern through stress testing. Before applying the preset load cycle, some potentially similar network interfaces are pre-screened by sending regular data packets to narrow down the scope. Then, a set load request volume is applied to a specific network interface, while all network interfaces are continuously monitored. This set load request volume must be significantly different from the previous regular behavior (regular data packet sending). For example, it alternates between a high-load period (sending 50 data packets within 500 milliseconds) and a low-load period (no data packets sent within 1500 milliseconds), repeating this pattern cyclically. During the load test, regular probe data packet monitoring is maintained on all network interfaces. If the test duration is 5 minutes and the load cycle is 2 seconds, 150 load cycles can be obtained for analysis.

[0053] In one embodiment, the timestamp information includes a TSval value;

[0054] Using timestamp information, calculate the timestamp progression rate for each network interface during both high-load and low-load periods of each load cycle, including:

[0055] The timestamp progression rate during high-load or low-load periods of the network interface can be calculated using the TSval value according to the following formula:

[0056] r(t) = [TSval(t + ) - TSval(t)] / ;

[0057] Where t represents time, r(t) represents the timestamp increment rate at time t, TSval(t) represents the TSval value at time t, and TSval(t + ... ) represents (t + The TSval value at time ) This indicates a time interval, i.e., a small time window.

[0058] For example, for each network interface, the timestamp progression rate is calculated using the sliding window method, with a time window size of 1 second. The calculation formula is as follows:

[0059] r_i (t) = [TSval_i (t) - TSval_i (t-1)] / 1 second; i represents the network port.

[0060] In one embodiment, the TSval value exists in the form of discrete data points;

[0061] The calculation of the timestamp progression rate during high-load or low-load periods of the network interface using the TSval value includes: calculating the timestamp progression rate during high-load or low-load periods of the network interface using the TSval values ​​at two time points based on a linear interpolation method; and forming the difference between the two time points.

[0062] In this example, considering the lack of continuous measurement data (the measurement data TSval is a point plot with each interval, not a continuous measurement), linear interpolation between actual measurement points is required for calculation. If measurement data is obtained at time points t1 and t2, the rate calculation formula is:

[0063] r_i = (TSval_i (t2) - TSval_i (t1)) / (t2 - t1).

[0064] Furthermore, by utilizing the similarity of the growth rate differences between the high and low load timestamps of each network interface's load cycle, it is determined whether the multiple network interfaces originate from the same server, including:

[0065] Filter out two network ports that are suspected to be similar from multiple network ports;

[0066] Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two suspected similar network interfaces;

[0067] By using the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, it can be determined whether the two suspected similar network interfaces come from the same server.

[0068] For example, for each load cycle, the timestamp progression rate is measured separately during high-load and low-load periods. This yields paired observations:

[0069] r_i_loaded: Incremental rate during periods of high load;

[0070] r_i_quiet: Incremental rate during periods of low load;

[0071] The difference between the two speeds reflects the impact of load on each network port, and the calculation formula is as follows:

[0072] r_i(k) = r_i_loaded(k) - r_i_quiet(k), where k is the load period.

[0073] r_i(k) represents the difference in the rate of increase of timestamps under high and low loads over period k. Compared with the detection method that does not have any load change or regularity, high and low load stress testing can more clearly show the correlation between the requests issued by the test and the rate of increase of the target timestamp.

[0074] In one embodiment, filtering two suspected similar network ports from a plurality of network ports may include:

[0075] Pre-select two potentially similar network ports from multiple network ports using one or any combination of the following methods:

[0076] Based on the server-side protocol or tool version set of each network interface, determine whether multiple network interfaces are suspected to be two similar network interfaces; server-side protocol, such as OpenSSH, tool version set, such as a specified version of Apache Tomcat, a specified version of Redis, etc.

[0077] Based on the client identifier (CIientIdentifier) ​​of each network port, determine whether multiple network ports are suspected to be two similar network ports;

[0078] Based on the clock frequency offset of the TCP timestamp of each network interface, it is determined whether multiple network interfaces are suspected to be similar network interfaces; the clock frequency offset of the TCP timestamp represents the deviation between the actual TCP timestamp counting rate and the ideal time unit; the formula for the clock frequency offset of the TCP timestamp can be expressed as: (TSval(t2)-TSval(t1)) / (t2-t1)-1.

[0079] In routine management practices, such as confirming annual project equipment usage statistics, when a project raises objections to the statistical data obtained from routine equipment detection, the first step is to compare and filter cases by server service feature profiling (i.e., observing whether the publicly exposed services on the server are consistent, such as two servers having Apache Tomcat 7.5, SSH 8.9, and Redis 6.0 installed, and the SSH connection banner being consistent) to identify situations where the same server has different network cards. Alternatively, monitoring the DHCP request client identifiers of different network ports can be used. If different network ports show the same client identifier, there is a high probability that it comes from the same server. When implementing this, it is important to note that the server needs special configuration; the two NICs cannot be on the same subnet, and the server must be specifically configured to use the same client ID.

[0080] In one embodiment, calculating the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps during the load cycle of two potentially similar network interfaces may include:

[0081] Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two potentially similar network interfaces using the following formula:

[0082] ;

[0083] In the formula, The Pearson correlation coefficient represents the difference in the growth rate of high and low load timestamps during the load cycles of network interface A and network interface B. , These represent the differences in the growth rate of high and low load timestamps across multiple load cycles for network interface A and network interface B, respectively. The expression indicates the calculation of standard deviation, and Cov() indicates the calculation of covariance.

[0084] Figure 3 This is another specific example diagram of the multi-NIC device identification method in the embodiments of the present invention, as shown in the figure. Figure 3 As shown, it includes:

[0085] Step 301: After a first time interval, send TCP SNY probe packets to all interface IPs.

[0086] The duration is, for example, 200ms. The interface IP is the enterprise network port.

[0087] Step 302: Collect timestamp information for each interface IP.

[0088] Specifically, the following information is collected for each interface IP:

[0089] Receive local time: t_local;

[0090] Remote TCP timestamp: TSval_i(t);

[0091] Round trip time: RTT_i(t).

[0092] Step 303, Stage 1: Clock offset filtering, measure for 5 to 10 minutes to obtain multiple suspected similar network port combinations.

[0093] Each suspected similar network interface combination includes multiple suspected similar network interfaces. Suspected similar network interfaces indicate that they are suspected to originate from the same server.

[0094] The offset of each network interface is calculated according to the formula for the clock frequency offset of the TCP timestamp.

[0095] For any two network ports A and B: if the offset of A minus the clock frequency offset of B is greater than 5ppm, it means that network ports A and B belong to different servers and should be marked; if the offset of A minus the clock frequency offset of B is less than or equal to 5ppm, it means that network ports A and B are suspected to be similar network ports.

[0096] Step 304, Phase Two: Fine-grained analysis, based on precise offset calculation of a longer baseline, with measurements lasting more than 30 minutes.

[0097] For any two network ports in the suspected similar network port combination in Phase 1: if the difference in clock frequency offset is greater than 1ppm, it means that these two network ports are likely from different servers and are marked; if the difference in clock frequency offset is less than or equal to 1ppm, they are retained in the suspected similar network port combination.

[0098] Step 305, Phase 3: Load correlation test to determine the final result.

[0099] Phase Three begins by establishing a baseline: a routine probe lasting 60 seconds to calculate the normal timestamp progression rate;

[0100] Then, apply the load pattern: during high load periods, send 50 data packets within 500 milliseconds; during low load periods, send no data packets within 1500 milliseconds; repeat this cycle more than 100 times.

[0101] Each loop calculates the network interface. r = Progress rate during high load periods - Progress rate during low load periods;

[0102] Calculate the Pearson correlation coefficient, and determine whether two suspected similar network interfaces come from the same server based on the specific value of the Pearson correlation coefficient.

[0103] For example, for network ports A and B that are suspected to originate from different network cards on the same server, it is necessary to calculate the Pearson correlation coefficient of their rate changes, as shown in the following formula:

[0104] .

[0105] The calculation of the Pearson correlation coefficient includes the following steps:

[0106] (1) Calculate the average rate change of each network port.

[0107] Calculate the mean value of the rate change over all load cycles for both network port A and network port B. , :

[0108] ;

[0109] ;

[0110] Where n is the total number of load cycles, and k is the load cycle time period (corresponding to different load cycles). This represents the summation of the differences in the growth rates of high and low load timestamps for all k values.

[0111] (2) Calculate the covariance.

[0112] Covariance is used to measure the linear correlation between the rate changes of network port A and network port B. The calculation formula is:

[0113] ;

[0114] in, Let be the deviation of the rate change of network port A in the k-th load cycle from the mean. Let k be the deviation of the load cycle k corresponding to network port B. The mean of the product of k and k is the covariance.

[0115] (3) Calculate the standard deviation.

[0116] Standard deviation is used to measure the dispersion of the rate variation of a single network port. It is calculated separately for network port A and network port B:

[0117] ;

[0118] ;

[0119] The squared term is used to eliminate the positive and negative effects of the deviation. After summing, the mean is taken and the square root is taken to obtain the standard deviation of the rate change.

[0120] (4) Calculate the correlation coefficient.

[0121] Substitute the calculated covariance and two standard deviations into the formula. The Pearson correlation coefficient between network port A and network port B was obtained.

[0122] In one embodiment, determining whether two potentially similar network interfaces originate from the same server using the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps during the load cycles of the two interfaces may include:

[0123] Based on the Pearson correlation coefficient value of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, the suspected similar network interfaces are divided into: confirmed to come from the same server, confirmed not to come from the same server, and requiring further judgment.

[0124] When two suspected similar network interfaces require further evaluation, it can be determined whether they originate from the same server by investigating the network interface topology and / or querying asset records.

[0125] In this embodiment, the correlation coefficient ranges from -1 to 1.

[0126] For example, when the Pearson correlation coefficient is greater than 0.8, this provides strong evidence that network interfaces belong to the same server. The load applied to one network interface will continuously and proportionally affect the timestamp progression of the other network interface. The core reason for this phenomenon is that the two network interfaces share the same CPU for packet processing. When the CPU is busy processing a load burst on network interface A, it will also delay packet processing on network interface B, thus causing the timestamp progression rate of both network interfaces to decrease simultaneously.

[0127] When the Pearson correlation coefficient is between 0.3 and 0.8, the evidence provided by the correlation coefficient in this range is ambiguous, and there may be some shared infrastructure. It is necessary to use other means to assist in verification, such as observing network topology, querying asset records, or calling for manual confirmation.

[0128] When the Pearson correlation coefficient is less than 0.3, the network interfaces exhibit independent behavior characteristics, which provides strong evidence for determining that they belong to different servers. The CPU load of each server only affects the timestamp processing of its own network interface, ultimately resulting in uncorrelated changes in the timestamp progression rate of each network interface.

[0129] The network interface topology is established in advance. For example, if two suspected IPs have a correlation coefficient of 0.6 and come from the same subnet, it means they are highly likely to originate from the same server. The asset records are obtained by the enterprise (group formula) periodically reviewing server owner information. These records may indicate that multiple suspected network ports come from the same project team or application system. While the asset records are not accurate, they can help in making judgments.

[0130] In summary, by implementing the asset discovery methods described above, the following effects can be achieved:

[0131] By implementing the above-mentioned asset discovery inventions, the following effects can be achieved:

[0132] Comprehensive network visibility: Enables full, real-time visibility into all assets across the enterprise, including previously undetected devices.

[0133] Efficient resource management: simplifies asset management processes, reduces manual work, and improves resource allocation.

[0134] Network adaptability: Enables networks to quickly adapt to changes (such as the addition of new devices), ensuring that these devices are discovered and managed immediately.

[0135] Minimize operational impact: Use lightweight and non-intrusive methods to filter and screen assets in a way that minimizes disruption to network operations.

[0136] Scalable solutions: Implement scalable solutions to effectively handle large and complex enterprise networks.

[0137] This invention also provides a multi-NIC device identification device, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the multi-NIC device identification method, the implementation of this device can refer to the implementation of the multi-NIC device identification method; repeated details will not be elaborated further.

[0138] Figure 4 This is a schematic diagram of a multi-NIC device identification device in an embodiment of the present invention, such as... Figure 4 As shown, the device 400 includes:

[0139] The data acquisition module 401 is used to continuously send fixed load requests to all network ports in the enterprise; receive data packets returned by each network port via the TCP protocol; the data packets carry timestamp information;

[0140] The progressive rate calculation module 402 is used to calculate the timestamp progressive rate of each network interface using timestamp information;

[0141] The judgment module 403 is used to determine whether the multiple network interfaces come from the same server based on the similarity of the timestamp progression rate of the multiple network interfaces.

[0142] In one embodiment, the device 400 further includes:

[0143] The baseline establishment module is used to establish a baseline for each network port by sending probe data packets to all network ports in the enterprise at fixed intervals before the data acquisition module 401 continuously sends fixed load requests to all network ports in the enterprise. The baseline includes one or any combination of throughput, health, status, and queue data under normal network port operation.

[0144] In one embodiment, the data acquisition module 401 is specifically used for:

[0145] A fixed load request is sent to all network ports in the enterprise according to a preset load cycle; each load cycle includes a high load period and a low load period; the amount of data sent during the high load period is greater than the amount of data sent during the low load period.

[0146] The progressive rate calculation module 402 is specifically used for:

[0147] Using timestamp information, calculate the timestamp progression rate for each network interface during the high-load and low-load periods of each load cycle.

[0148] In one embodiment, the determination module 403 is specifically used for:

[0149] Calculate the difference in the rate of increase of the high and low load timestamps for each network interface in each load cycle by using the timestamp progression rate of the high and low load periods in each load cycle; the difference in the rate of increase of the high and low load timestamps is the difference in the timestamp progression rate between the high load period and the low load period.

[0150] By utilizing the similarity of the growth rate differences between high and low load timestamps of each network interface's load cycle, it can be determined whether the multiple network interfaces originate from the same server.

[0151] In one embodiment, the timestamp information includes a TSval value;

[0152] The progressive rate calculation module 402 is specifically used for:

[0153] The timestamp progression rate during high-load or low-load periods of the network interface can be calculated using the TSval value according to the following formula:

[0154] r(t) = [TSval(t + ) - TSval(t)] / ;

[0155] Where t represents time, r(t) represents the timestamp increment rate at time t, TSval(t) represents the TSval value at time t, and TSval(t + ... ) represents (t + The TSval value at time ) Indicates a time interval.

[0156] In one embodiment, the TSval value exists in the form of discrete data points;

[0157] The calculation of the timestamp progression rate during high-load or low-load periods of the network interface using TSval values ​​includes: calculating the timestamp progression rate during high-load or low-load periods of the network interface using TSval values ​​at two time points based on a linear interpolation method; and forming the difference between the two time points. .

[0158] In one embodiment, the determination module 403 is specifically used for:

[0159] Filter out two network ports that are suspected to be similar from multiple network ports;

[0160] Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two suspected similar network interfaces;

[0161] By using the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, it can be determined whether the two suspected similar network interfaces come from the same server.

[0162] In one embodiment, the determination module 403 is specifically used for:

[0163] Pre-select two potentially similar network ports from multiple network ports using one or any combination of the following methods:

[0164] Based on the server-side protocol or tool version set of each network port, determine whether multiple network ports are suspected to be two similar network ports;

[0165] Based on the client identifiers of each network port, determine whether multiple network ports are suspected to be two similar network ports;

[0166] Based on the clock frequency offset of the TCP timestamps of each network interface, it is determined whether multiple network interfaces are suspected to be similar; the clock frequency offset of the TCP timestamps represents the deviation between the actual TCP timestamp counting rate and the ideal time unit.

[0167] In one embodiment, the determination module 403 is specifically used for:

[0168] Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two potentially similar network interfaces using the following formula:

[0169] ;

[0170] In the formula, The Pearson correlation coefficient represents the difference in the growth rate of high and low load timestamps during the load cycles of network interface A and network interface B. , These represent the differences in the growth rate of high and low load timestamps across multiple load cycles for network interface A and network interface B, respectively. This indicates the calculation of the standard deviation.

[0171] In one embodiment, the determination module 403 is specifically used for:

[0172] Based on the Pearson correlation coefficient value of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, the suspected similar network interfaces are divided into: confirmed to come from the same server, confirmed not to come from the same server, and requiring further judgment.

[0173] When two suspected similar network interfaces require further evaluation, it can be determined whether they originate from the same server by investigating the network interface topology and / or querying asset records.

[0174] Figure 5 This is a schematic diagram of a computer device in an embodiment of the present invention, such as... Figure 5 As shown, this embodiment of the invention also provides a computer device 500, including a processor 501, a memory 502, and a computer program 503 stored in the memory 502 and executable on the processor 501. When the processor 501 executes the computer program 503, it implements the above-mentioned multi-NIC device identification method.

[0175] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described multi-NIC device identification method.

[0176] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described multi-NIC device identification method.

[0177] The method proposed in this embodiment of the invention has been experimentally verified in the network security platform of a certain group company. The asset detection system in the group company's network security platform has cumulatively identified more than two million assets. After the method of this embodiment of the invention was deployed, the group sorted out its internal assets and found that more than 100,000 IP assets were the same as other existing IPs, of which more than 80,000 assets were identified as multi-NIC assets.

[0178] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0179] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0180] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0181] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0182] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying multi-NIC devices, characterized in that, include: Continuously send fixed load requests to all network ports in the enterprise; Receive data packets returned by each network interface via the TCP protocol; The data packet carries timestamp information; Calculate the timestamp progression rate for each network interface using timestamp information; Based on the similarity of the timestamp progression rates of multiple network interfaces, it is determined whether the multiple network interfaces come from the same server.

2. The method as described in claim 1, characterized in that, Before continuously sending fixed load requests to all network ports in the enterprise, the method also includes: Probe data packets are sent to all network ports in the enterprise at fixed intervals, and a baseline is established for each network port based on the data returned by the network port; the baseline includes one or any combination of throughput, health, status, and queue data of the network port under normal operating conditions.

3. The method as described in claim 1, characterized in that, Continuously send fixed load requests to all network ports in the enterprise, including: A fixed load request is sent to all network ports in the enterprise according to a preset load cycle; each load cycle includes a high load period and a low load period; the amount of data sent during the high load period is greater than the amount of data sent during the low load period. Using timestamp information, calculate the timestamp progression rate for each network interface, including: Using timestamp information, calculate the timestamp progression rate for each network interface during the high-load and low-load periods of each load cycle.

4. The method as described in claim 3, characterized in that, Determining whether multiple network interfaces originate from the same server based on the similarity of their timestamp progression rates includes: Calculate the difference in the rate of increase of the high and low load timestamps for each network interface in each load cycle by using the timestamp progression rate of the high and low load periods in each load cycle; the difference in the rate of increase of the high and low load timestamps is the difference in the timestamp progression rate between the high load period and the low load period. By utilizing the similarity of the growth rate differences between high and low load timestamps of each network interface's load cycle, it can be determined whether the multiple network interfaces originate from the same server.

5. The method as described in claim 3, characterized in that, The timestamp information includes the TSval value; Using timestamp information, calculate the timestamp progression rate for each network interface during both high-load and low-load periods of each load cycle, including: The timestamp progression rate during high-load or low-load periods of the network interface can be calculated using the TSval value according to the following formula: r(t) = [TSval(t + ) - TSval(t)] / ; Where t represents time, r(t) represents the timestamp increment rate at time t, TSval(t) represents the TSval value at time t, and TSval(t + ... ) represents (t + The TSval value at time ) Indicates a time interval.

6. The method as described in claim 5, characterized in that, The TSval value exists in the form of discrete data points; The calculation of the timestamp progression rate during high-load or low-load periods of the network interface using the TSval value includes: calculating the timestamp progression rate during high-load or low-load periods of the network interface using the TSval values ​​at two time points based on a linear interpolation method. The difference between two time points forms .

7. The method as described in claim 4, characterized in that, By leveraging the similarity of the growth rate differences between high and low load timestamps of each network interface's load cycle, it is determined whether the multiple network interfaces originate from the same server, including: Filter out two network ports that are suspected to be similar from multiple network ports; Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two suspected similar network interfaces; By using the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, it can be determined whether the two suspected similar network interfaces come from the same server.

8. The method as described in claim 7, characterized in that, Filter out two potentially similar network ports from multiple network ports, including: Pre-select two potentially similar network ports from multiple network ports using one or any combination of the following methods: Based on the server-side protocol or tool version set of each network port, determine whether multiple network ports are suspected to be two similar network ports; Based on the client identifiers of each network port, determine whether multiple network ports are suspected to be two similar network ports; Based on the clock frequency offset of the TCP timestamps of each network interface, it is determined whether multiple network interfaces are suspected to be similar; the clock frequency offset of the TCP timestamps represents the deviation between the actual TCP timestamp counting rate and the ideal time unit.

9. The method as described in claim 7, characterized in that, Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two potentially similar network interfaces, including: Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two potentially similar network interfaces using the following formula: ； In the formula, The Pearson correlation coefficient represents the difference in the growth rate of high and low load timestamps during the load cycles of network interface A and network interface B. , These represent the differences in the growth rate of high and low load timestamps across multiple load cycles for network interface A and network interface B, respectively. This indicates the calculation of the standard deviation.

10. The method as described in claim 7, characterized in that, Using the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps between two potentially similar network interfaces, we can determine whether two potentially similar network interfaces originate from the same server, including: Based on the Pearson correlation coefficient value of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, the suspected similar network interfaces are divided into: confirmed to come from the same server, confirmed not to come from the same server, and requiring further judgment. When two suspected similar network interfaces require further evaluation, it can be determined whether they originate from the same server by investigating the network interface topology and / or querying asset records.

11. A multi-NIC device identification device, characterized in that, include: The data acquisition module is used to continuously send fixed load requests to all network ports in the enterprise; Receive data packets returned by each network interface via the TCP protocol; The data packet carries timestamp information; The progressive rate calculation module is used to calculate the timestamp progressive rate of each network interface using timestamp information; The judgment module is used to determine whether the multiple network interfaces come from the same server based on the similarity of the timestamp progression rate of the multiple network interfaces.

12. The apparatus as claimed in claim 11, characterized in that, Also includes: The baseline establishment module is used to establish a baseline for each network port by sending probe data packets to all network ports in the enterprise at fixed intervals before the data acquisition module continuously sends fixed load requests to all network ports in the enterprise. The baseline includes one or any combination of throughput, health, status, and queue data under normal network port operation.

13. The apparatus as claimed in claim 11, characterized in that, The data acquisition module is specifically used for: A fixed load request is sent to all network ports in the enterprise according to a preset load cycle; each load cycle includes a high load period and a low load period; the amount of data sent during the high load period is greater than the amount of data sent during the low load period. The progressive rate calculation module is specifically used for: Using timestamp information, calculate the timestamp progression rate for each network interface during the high-load and low-load periods of each load cycle.

14. The apparatus as claimed in claim 13, characterized in that, The judgment module is specifically used for: Calculate the difference in the rate of increase of high and low load timestamps for each network interface in each load cycle by using the timestamp progression rate of high and low load periods in each load cycle of each network interface. The difference in the growth rate of timestamps under high and low load is the difference in the timestamp progression rate between high-load and low-load periods; By utilizing the similarity of the growth rate differences between high and low load timestamps of each network interface's load cycle, it can be determined whether the multiple network interfaces originate from the same server.

15. The apparatus as claimed in claim 13, characterized in that, The timestamp information includes the TSval value; The progressive rate calculation module is specifically used for: The timestamp progression rate during high-load or low-load periods of the network interface can be calculated using the TSval value according to the following formula: r(t) = [TSval(t + ) - TSval(t)] / ; Where t represents time, r(t) represents the timestamp increment rate at time t, TSval(t) represents the TSval value at time t, and TSval(t + ... ) represents (t + The TSval value at time ) Indicates a time interval.

16. The apparatus as claimed in claim 15, characterized in that, The TSval value exists in the form of discrete data points; The calculation of the timestamp progression rate during high-load or low-load periods of the network interface using the TSval value includes: calculating the timestamp progression rate during high-load or low-load periods of the network interface using the TSval values ​​at two time points based on a linear interpolation method. The difference between two time points forms .

17. The apparatus as claimed in claim 14, characterized in that, The judgment module is specifically used for: Filter out two network ports that are suspected to be similar from multiple network ports; Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two suspected similar network interfaces; By using the Pearson correlation coefficient of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, it can be determined whether the two suspected similar network interfaces come from the same server.

18. The apparatus as claimed in claim 17, characterized in that, The judgment module is specifically used for: Pre-select two potentially similar network ports from multiple network ports using one or any combination of the following methods: Based on the server-side protocol or tool version set of each network port, determine whether multiple network ports are suspected to be two similar network ports; Based on the client identifiers of each network port, determine whether multiple network ports are suspected to be two similar network ports; Based on the clock frequency offset of the TCP timestamps of each network interface, it is determined whether multiple network interfaces are suspected to be similar; the clock frequency offset of the TCP timestamps represents the deviation between the actual TCP timestamp counting rate and the ideal time unit.

19. The apparatus as claimed in claim 17, characterized in that, The judgment module is specifically used for: Calculate the Pearson correlation coefficient for the difference in the growth rate of high and low load timestamps during the load cycles of two potentially similar network interfaces using the following formula: ； In the formula, The Pearson correlation coefficient represents the difference in the growth rate of high and low load timestamps during the load cycles of network interface A and network interface B. , These represent the differences in the growth rate of high and low load timestamps across multiple load cycles for network interface A and network interface B, respectively. This indicates the calculation of the standard deviation.

20. The apparatus as claimed in claim 17, characterized in that, The judgment module is specifically used for: Based on the Pearson correlation coefficient value of the difference in the growth rate of high and low load timestamps of two suspected similar network interfaces, the suspected similar network interfaces are divided into: confirmed to come from the same server, confirmed not to come from the same server, and requiring further judgment. When two suspected similar network interfaces require further evaluation, it can be determined whether they originate from the same server by investigating the network interface topology and / or querying asset records.

21. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 10.

22. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 10.

23. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 10.

Images