Network asset fingerprint construction method and device, computer device, and medium

Abstract

Embodiments of the present application provide a network asset fingerprint construction method and device, computer equipment and medium, wherein the method comprises: generating initial structured fingerprint data based on basic asset information; matching known fingerprint information in the initial structured fingerprint data with trigger rules in configuration information of all tools, scheduling tools that match successfully to scan target network assets, and updating fingerprint information output by the scheduled tools to the structured fingerprint data, listening to data updates in the structured fingerprint data, and performing recursive trigger scheduling of tools according to updated incremental data; until no data updates are listened to in the structured fingerprint data or the updated incremental data does not match the trigger rules of all tools, ending the scanning task, and taking the current structured fingerprint data as the final network asset fingerprint of the target network assets. The scheme improves the effectiveness and accuracy of scanning, and improves resource efficiency or scanning accuracy.

Description

Technical Field

[0001] This invention relates to the field of network security scanning technology, and in particular to a method, apparatus, computer equipment, and medium for constructing network asset fingerprints. Background Technology

[0002] In the field of network security scanning, asset fingerprints are not only a component in building asset profiles, but more importantly, they serve as crucial information that bridges the gap between previous and subsequent steps. They help network security operations and penetration testing personnel discover potential security flaws (vulnerabilities) based on known network assets. For example, if a web service fingerprint is identified in a target asset, a web application vulnerability scanning tool is invoked for automated scanning to discover potential security vulnerabilities; if a database service fingerprint is identified, a weak password brute-force attack is attempted to identify accounts using weak passwords, and so on.

[0003] However, it's unrealistic to expect a single network security scanning tool to discover all security vulnerabilities. In reality, both network security operations and penetration testing typically involve using a combination of numerous different tools to comprehensively identify various issues. These tools are developed using different standards, and users can only invoke them in batches based on simple classification rules. For example, both general-purpose web vulnerability scanning tools and dedicated scanning tools for specific web applications are usually categorized as "Web vulnerability scanning," and all "Web vulnerability scanning" tools are executed linearly after a web application fingerprint is discovered. Furthermore, users need to integrate the output information from these tools to obtain valuable security assessment results.

[0004] In this process, due to the lack of a unified standard, various scanning tools have difficulty utilizing known detailed fingerprint information, and are even less able to perform deep scanning based on information discovered by other scanning tools. As a result, they may perform ineffective scanning tasks on assets that do not actually have the conditions for attack, resulting in wasted resources without any output, or outputting false positives due to incorrect conditions.

[0005] like Figure 1 As shown, existing automated scanning systems typically include the following modules: user input module, asset discovery module, fingerprint recognition module, task scheduling module, plug-in tool module, and reporting module. Among them:

[0006] The user input module is used to receive basic information input from users, including IP address, domain name, website URL, etc. The asset discovery module is used to expand the discovery of more network asset information based on user input. The fingerprint recognition module is used to identify the fingerprint features of these network asset information and attach corresponding fingerprint tags. The task scheduling module is key to solving the problem of calling various tools in the current technical solution. It mainly achieves relatively fine-grained one-way tool scheduling based on the pre-defined logic of tag mapping (that is, mapping the tags attached to the assets by the fingerprint recognition module to different tools). After completing the tag mapping-based scheduling, the system will linearly execute each tool and record the output, and finally provide the user with complete scan results through the reporting module.

[0007] Compared to traditional broad-based scheduling, the aforementioned existing technical solutions, through label mapping management, can alleviate the problems of resource waste or false alarms to some extent, but they also have the following drawbacks: 1. To facilitate label mapping in task scheduling, the output of the fingerprint recognition module is usually a "flat" label. This is advantageous for linear task execution, but it lacks the expression of the inherent causal relationship between different fingerprints, fails to provide users with a three-dimensional presentation of information from a professional perspective, and is difficult to support high-level decision-making. 2. Linearly executed tasks inevitably suffer from data silos: all tools are isolated from each other, lacking data connectivity. Even if a tool makes a new discovery, it cannot share it with other tools to modify its execution prerequisites to improve resource efficiency or scanning accuracy. 3. Difficulty in state backtracking: Since fingerprint recognition in the current technology is stateless, if the tool does provide key discoveries, such as discovering new fingerprints that the fingerprint recognition module did not discover, the user may even need to adjust the input and re-execute the complete task in order to schedule the tool corresponding to those new fingerprints. 4. Weak Customization and Extension Capabilities: For a commercial network security automated scanning system solution, its fingerprinting module and fingerprinting rules are usually critical trade secrets and not disclosed to users. For open-source automated scanning system solutions, users must learn its recognition logic and rule definitions, which presents a high learning curve. In either case, users will find it difficult to identify a custom fingerprint and invoke custom tools in the desired manner; however, this is particularly important when identifying fingerprints of self-developed systems or scanning for zero-day vulnerabilities. Summary of the Invention

[0008] In view of this, embodiments of the present invention provide a method for constructing network asset fingerprints to solve the technical problems of missing fingerprint information dimensions, data silos, and weak scalability in the prior art. The method includes: Receive basic asset information of the target network asset, and generate initial structured fingerprint data based on the basic asset information. The structured fingerprint data includes multiple structural layers related to the target network asset. Each structural layer includes one or more sub-data structures, and each sub-data structure includes a type of fingerprint information item of the structural layer to which it belongs. The known fingerprint information in the initial structured fingerprint data is matched with the trigger rules in the configuration information of all tools. The successfully matched tools are scheduled to scan the target network assets, and the fingerprint information output by the scheduled tools is updated in the structured fingerprint data. Data updates in the structured fingerprint data are monitored, and tools are recursively triggered and scheduled based on the updated incremental data. The data in the structured fingerprint data is updated based on the fingerprint information output by the scheduled tools. The configuration information of each tool is input by the user, and the trigger rules include the logical relationship between one or more fingerprint information items in the structured fingerprint data and the mapping relationship between each tool. The scanning task ends when the structured fingerprint data is found to be unupdated or the incremental data does not match the triggering rules of all tools. The current structured fingerprint data is then used as the final network asset fingerprint of the target network asset. The final network asset fingerprint is a three-dimensional network asset fingerprint that reflects the internal logical dependencies of the target network asset.

[0009] This invention also provides a device for constructing network asset fingerprints to address the technical problems of missing fingerprint information dimensions, data silos, and weak scalability in the prior art. The device includes: The input module is used to receive basic asset information of the target network asset and generate initial structured fingerprint data based on the basic asset information. The structured fingerprint data includes multiple structural layers related to the target network asset. Each structural layer includes one or more sub-data structures, and each sub-data structure includes a type of fingerprint information item of the structural layer to which it belongs. The scheduling module is used to match the known fingerprint information in the initial structured fingerprint data with the trigger rules in the configuration information of all tools, schedule the successfully matched tools to scan the target network assets, update the structured fingerprint data with the fingerprint information output by the scheduled tools, monitor data updates in the structured fingerprint data, recursively trigger the scheduling of tools based on the updated incremental data, and update the data in the structured fingerprint data based on the fingerprint information output by the scheduled tools. The configuration information of each tool is input by the user, and the trigger rules include the mapping relationship between one or more fingerprint information items in the structured fingerprint data and each tool. The fingerprint construction module is used to end the scanning task until the data in the structured fingerprint data is not updated or the incremental data of the update does not match the triggering rules of all tools. The current structured fingerprint data is used as the final network asset fingerprint of the target network asset. The final network asset fingerprint is a three-dimensional network asset fingerprint that can reflect the internal logical dependencies of the target network asset.

[0010] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for constructing any of the network asset fingerprints, thereby solving the technical problems of missing fingerprint information dimensions, data silos, and weak scalability in the prior art.

[0011] This invention also provides a computer-readable storage medium storing a computer program that executes any of the above-described methods for constructing network asset fingerprints, in order to solve the technical problems of missing fingerprint information dimensions, data silos, and weak scalability in the prior art.

[0012] Compared with the prior art, the beneficial effects achieved by at least one of the above-mentioned technical solutions adopted in the embodiments of this specification include at least the following: Structured fingerprint data is proposed as accurate and three-dimensional data based on multiple structural layers, which better reflects the internal logical dependencies of target network assets. Based on the structured fingerprint data, each tool is matched and scheduled through the logical relationship of one or more fingerprint information items in different structural layers of the structured fingerprint data. Compared with the existing "flat" label scheduling method, this application can match and schedule each tool based on the multi-information dimensions of accurate and three-dimensional structured fingerprint data, improving the effectiveness, accuracy, and refinement of scheduling, which is beneficial for supporting high-level decision-making. Simultaneously, during the recursive triggering scheduling process of tools, the scanning output data of different tools will further update the structured fingerprint data, and the tools will be matched and scheduled again based on the updated incremental data, so that the scanning output data of each different tool are further processed within the structured fingerprint data. By sharing and integrating data, the system avoids data silos and lack of connectivity between tools. This allows for adjustments to tool scheduling and execution prerequisites based on shared and updated structured fingerprint data from different tools, improving resource efficiency and scanning accuracy. It implements a task dispatch mechanism driven by data state changes (Events) of structured fingerprint data rather than preset sequences (i.e., a reactive scheduling mechanism). Even if new fingerprint information is discovered, a complete scan task does not need to be re-executed; the corresponding tool can be scheduled based on the new fingerprint information in a subsequent iteration, achieving fingerprint information state management. Furthermore, the use of configuration information for each tool decouples the scheduling logic from the tool logic. Users can integrate new tools without modifying the core system code, requiring only simple configuration information. This lowers the technical barrier to custom fingerprint recognition and rapid response to zero-day vulnerabilities, enabling flexible integration and expansion capabilities. Attached Figure Description

[0013] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of an automated scanning system provided by existing technology; Figure 2 This is a flowchart of a method for constructing network asset fingerprints provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the principle of a method for constructing network asset fingerprints as provided in an embodiment of the present invention; Figure 4This is a flowchart illustrating a custom tool provided in an embodiment of the present invention; Figure 5 This is a structural block diagram of a computer device provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of a network asset fingerprint construction device provided in an embodiment of the present invention. Detailed Implementation

[0015] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0016] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0017] In this embodiment of the invention, a method for constructing network asset fingerprints is provided, such as... Figure 2 As shown, the method includes: Step S201: Receive the input basic asset information of the target network asset, and generate initial structured fingerprint data based on the basic asset information. The structured fingerprint data includes multiple structural layers related to the target network asset. Each structural layer includes one or more sub-data structures, and each sub-data structure includes a type of fingerprint information item of the structural layer to which it belongs. Step S202: Match the known fingerprint information in the initial structured fingerprint data with the trigger rules in the configuration information of all tools, schedule the successfully matched tools to scan the target network assets, update the structured fingerprint data with the fingerprint information output by the scheduled tools, monitor data updates in the structured fingerprint data, recursively trigger and schedule tools according to the updated incremental data, and update the data in the structured fingerprint data according to the fingerprint information output by the scheduled tools. The configuration information of each tool is input by the user, and the trigger rules include the logical relationship between one or more fingerprint information items in the structured fingerprint data and the mapping relationship between each tool. Step S203: Until the data in the structured fingerprint data is not updated or the incremental data of the update does not match the triggering rules of all tools, the scanning task ends and the current structured fingerprint data is taken as the final network asset fingerprint of the target network asset. The final network asset fingerprint is a three-dimensional network asset fingerprint that can reflect the internal logical dependencies of the target network asset.

[0018] In practical implementation, to present structured fingerprint data in a more refined and comprehensive manner, multiple structural layers similar to the network structure of the target network asset can be generated during the initial generation of structured fingerprint data. For example, generating initial structured fingerprint data based on the basic asset information includes: Multiple structural layers are generated, including a basic structural layer, a transport structural layer, and an application structural layer; Multiple first sub-data structures are generated in the infrastructure layer, including: basic attribute data structure, physical device data structure and operating system data structure; Multiple second sub-data structures are generated in the transport structure layer, including: a transport protocol data structure and an encryption protocol data structure; Multiple third sub-data structures are generated in the application structure layer, including: application protocol data structure, product data structure, and component data structure.

[0019] In specific implementation, during the process of generating initial structured fingerprint data based on the basic asset information, multiple structural layers, multiple first sub-data structures, multiple second sub-data structures, and multiple third sub-data structures can be generated based on the network architecture of the target network asset. Since the initial input basic asset information may not be able to identify the content of all fingerprint information items included in each first sub-data structure, second sub-data structure, and third sub-data structure, the fingerprint information items in some structural layers, some first sub-data structures, some second sub-data structures, or some third sub-data structures in the initial structured fingerprint data may be unknown or empty. During the subsequent recursive triggering of the scheduling tool scanning process, the content of fingerprint information items in the structured fingerprint data can be updated according to the fingerprint information output by the tool to improve and enrich the multiple information dimensions of the structured fingerprint data.

[0020] In specific implementation, the multiple structural layers may include a basic structural layer, a transport structural layer, and an application structural layer; multiple first sub-data structures are generated in the basic structural layer, including: a basic attribute data structure, a physical device data structure, and an operating system data structure, for example... The basic attribute data structure may include fingerprint information items related to the basic attributes of the target network asset. The fingerprint information items related to the basic attributes may be information used to determine the physical or logical location of the network asset and necessary task information, including but not limited to IP address, MAC address, hostname, domain name, discovery time, update time, etc. The physical device data structure may include fingerprint information items related to the physical devices of the target network assets. The fingerprint information items related to the physical devices may be information about the physical devices where the network assets are located, which may be entered by users or discovered through analysis, including but not limited to device model, device name, device manufacturer, various hardware attributes, and confidence level. The operating system data structure may include fingerprint information items related to the operating system of the target network asset. The fingerprint information items related to the operating system may be the operating system information of the network asset that is running on it, which is either input by the user or discovered through analysis, including but not limited to the operating system series, system version, system name and confidence level.

[0021] Multiple second sub-data structures are generated in the transport structure layer, including: a transport protocol data structure and an encryption protocol data structure; for example... The transport protocol data structure may include transport protocol-related fingerprint information items. These fingerprint information items may be protocol information used to describe the network data packets received by the network asset, including but not limited to the transport protocol name and port (if any) and confidence level. The encryption protocol data structure may include encryption protocol-related fingerprint information items. These fingerprint information items may be information used to describe the encryption transmission technology used in the transmission protocol used by the network asset, including but not limited to the encryption protocol name, encryption protocol version, supported encryption suites, digital certificates used, and confidence level.

[0022] Multiple third-level sub-data structures are generated in the application structure layer. These third-level sub-data structures include: application protocol data structure, product data structure, and component data structure, for example... The application protocol data structure may include fingerprint information items related to the application protocol. These fingerprint information items may be information used to describe what application protocol the target network asset uses to construct and parse the network data packet content transmitted, including but not limited to the application protocol name, original response content, and confidence level. The product data structure may include product-related fingerprint information items. These fingerprint information items may be information used to describe the service that monitors and transmits data in the target network asset and its service purpose or function, including but not limited to product name, product version, category, and confidence level. The component data structure may include component-related fingerprint information items, which may be information used to describe one or more components found in the target network asset for the purpose of supporting the current product, including but not limited to component name, component version, category, and confidence level.

[0023] In practice, the structure layer and sub-data structures in the structured fingerprint data can be dynamically expanded. Users can define new sub-data structures in their tools or configurations to meet their actual scanning needs.

[0024] In practical implementation, to present multi-dimensional and three-dimensional structured fingerprint data, a recursive scheduling mechanism is proposed, using updated incremental data from the structured fingerprint data to trigger tool scheduling. This implements a task assignment mechanism driven by data state changes (Events), i.e., a reactive scheduling mechanism. For example, it monitors data updates in the structured fingerprint data, recursively triggers tool scheduling based on the updated incremental data, and updates the data in the structured fingerprint data based on the fingerprint information output by the scheduling tool. This includes: Repeat the following steps until no updates are detected in the structured fingerprint data or the incremental data does not match the trigger rules of any of the tools: Monitor whether there are any updates in the current structured fingerprint data; If so, the updated incremental data is matched with the trigger rules in the configuration information of each tool, and the tool is scheduled to perform a scanning operation on the target network asset according to the scheduling policy in the configuration information of each successfully matched tool. The scheduling policy includes the scheduling method of the tool and the parameters to be transmitted. The fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated with the fingerprint information output by scanning according to the parsing configuration in the configuration information of the scheduling tool. The parsing configuration is used to define the method of obtaining the output data of the tool and the operation strategy of the output data.

[0025] In practical implementation, to further improve the accuracy of structured fingerprint data, it is proposed to consider using confidence levels to measure the accuracy of the tool's scan output data during the structured fingerprint data update process. For example, based on the parsing configuration in the scheduling tool's configuration information, the fingerprint information of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated with the fingerprint information of the scan output, including: Each scheduling tool outputs fingerprint information and its corresponding confidence level; Based on the confidence level requirements in the configuration information of the scheduling tool, the fingerprint information items of the corresponding sub-data structures in the corresponding structural layer of the structured fingerprint data are updated based on the fingerprint information that meets the confidence level requirements. This is so that information with higher confidence level can be used to trigger subsequent scanning task processes and presentation logic, while information with lower confidence level can be stored in another data table for information backtracking and analysis.

[0026] In specific implementation, based on the confidence level requirements in the configuration information of the scheduling tool, the fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated according to the fingerprint information whose confidence level meets the requirements, including: Based on the prior confidence of the tool provided by the configuration information of the scheduling tool and the actual confidence of the fingerprint information output by the tool, the posterior confidence of the fingerprint information is calculated (e.g., using Bayes' theorem, Blair scores, or calibration algorithms, or a combination thereof). The posterior confidence level is compared with the confidence threshold of the corresponding fingerprint information item in the structured fingerprint data. Based on the fingerprint information where the posterior confidence level is greater than the confidence threshold, the data of the fingerprint information item of the corresponding sub-data structure of the corresponding structural layer in the structured fingerprint data is updated.

[0027] In practical implementation, for different target network assets, the confidence thresholds for corresponding fingerprint information items in the structured fingerprint data can be pre-stored so that they can be directly read and compared during subsequent comparisons of posterior confidence with the corresponding fingerprint information item's confidence threshold. Confidence is generally expressed as a percentage. Here, the confidence threshold can be a specific percentage value or a percentage range. The specific value or range of the confidence threshold can be determined according to the specific network scenario. For example, taking a specific percentage value as an example, the confidence threshold for each fingerprint information item in the physical device data structure or operating system data structure can be 40%; the confidence threshold for each fingerprint information item in the transmission protocol data structure, encryption protocol data structure, or application protocol data structure can be 80%; and the confidence threshold for each fingerprint information item in the product data structure or component data structure can be 60%.

[0028] In practice, different tools can read or write (considering confidence level) the structured fingerprint data completely or partially throughout the scanning process, thereby enabling state management of network asset fingerprints and providing a three-dimensional data presentation when finally displayed to users.

[0029] In practical implementation, to address the issues of poor scalability and high coupling with tools, a proposal was made to provide configuration information for each tool. This configuration information can be in the form of a declarative configuration file, which contains one or more mapping relationships between structured fingerprint data and tool calls. Each mapping relationship can be decomposed into the following three key configuration contents: Triggering rules are mappings between the logical relationships (which can be logical combinations, such as AND, OR, and NOT) of one or more fingerprint information items in the structured fingerprint data and each tool. This mapping allows the corresponding tool to be invoked. For example, triggering rules define which information in the structured fingerprint data has been changed or added, triggering the current tool to perform an operation. This is the matching rule between the tool and the structured fingerprint data. For instance, when IP address information is added to the structured fingerprint data, an open port identification tool can be invoked; when product information is updated, especially if it's a database service, a corresponding weak password brute-force tool can be invoked. Triggering rules support configuring one or more matching rules, as well as different logical combinations (AND, OR, and NOT) of these rules.

[0030] The scheduling strategy includes the tool's scheduling method and the parameters to be passed. The scheduling strategy configuration defines how the tool should be invoked when the triggering rules are met, including the invocation method and the required parameters. For example, the invocation method can include system commands or system socket calls, calls via network service API interfaces or RPC services, etc. The system will prepare the corresponding isolated runtime environment (such as dependency libraries, runtime code, container images, etc.) based on the corresponding invocation method. Passed parameters can be information such as IP addresses and ports obtained from known structured fingerprint data, or specific parameters extracted from configurations and secrets stored in the environment, such as environment variables and system files. It supports defining retry or timeout logic in task configurations to improve the user experience. The scheduling strategy allows configuring one or more invocation logics to merge different operations that apply the same matching rules (i.e., the aforementioned triggering rules). Furthermore, the prior confidence level of this invocation can be configured to make a choice when information conflicts arise between different tools.

[0031] The parsing configuration defines how to acquire the tool's output data and the strategies for manipulating that data. Specifically, it defines how to extract key information from the tool's output after the tool is invoked, including how to acquire the output, how to extract information from it, and what operations to perform on the extracted information. For example, methods for acquiring tool output may include reading standard or error output from system commands or socket calls, reading content output to a file, or reading network packets returned by API interfaces or RPC services. Methods for extracting information from the output (i.e., the aforementioned operational strategies) may include string splitting, matching, regular expression matching, or deserializing the string into program-operable objects before extraction. After extracting the information, operations on that information can be defined, such as writing a portion of the information back into the structured fingerprint data to update the fingerprint status.

[0032] In practical implementation, this application proposes task scheduling based on label mapping relationships using these configuration information rather than pre-defined logic, invoking different tools to perform various operations. Therefore, users only need to write the corresponding configuration information to quickly integrate new tools into the system to identify custom fingerprints or vulnerabilities.

[0033] In practice, the tools may include asset discovery tools, fingerprint recognition tools, and scanning tools.

[0034] In practice, after preparing the tools and configuration information, you can follow... Figure 3 The process described above executes the network asset fingerprint construction method for automated scanning. Taking the user's input IP address as the basic asset information as an example (the principle is basically the same for other input cases), the automated execution process of a certain task may be as follows: 1. Basic asset information is entered by the user; 2. The system initiates reactive task scheduling; 3. The system generates the most basic structured fingerprint data (i.e., the initial structured fingerprint data mentioned above) and enters it into the database. At this point, the structured fingerprint data includes: a) Basic layer: IP address known, device, operating system, etc. unknown; b) Transport layer: Unknown; c) Application layer: Unknown; 4. The following fingerprint information updates were detected, and matching logic was performed based on the trigger rules: a) Basic layer → Basic attributes → IP address; 5. If the following tools are matched, the scheduling tools will begin executing the corresponding operations based on the scheduling strategy: a) Asset discovery tool: Performs port discovery operations; b) System information tools: Perform information acquisition operations; c)… 6. After one or more tools are invoked, the fingerprint information in the structured fingerprint data is updated according to the parsing configuration in the configuration information. At this time, the structured fingerprint data may include: a) Basic layer: Known IP address, MAC address, hostname and other information, known device and operating system information (but with low confidence); b) Transport layer: It is known that some ports are open, and some of these ports use encryption protocols; c) Application layer: Unknown; 7. The following fingerprint information updates were detected, and matching logic was performed based on the trigger rules: a) Base layer → Basic information → MAC address, hostname, etc.; b) Base layer → Equipment → Equipment model; c) Basic Layer → Operating System → Operating System Series; d) Transport layer → Transport protocol → Transport protocol name, open ports, etc.; e) Transport layer → Encryption protocol → Encryption protocol name, version, etc.; 8. If the following tools are matched, the scheduling tools will begin executing the corresponding operations based on the scheduling policy: a) Fingerprint recognition tool: Performs port service identification operations; b) Encryption Protocol Analysis Tool: Performs encryption protocol risk analysis operations; c) Operating system analysis tools: Perform operating system baseline analysis operations; d)… 9. After one or more tool calls are completed, the fingerprint information in the structured fingerprint data is updated according to the parsing configuration in the configuration information. At this time, the structured fingerprint data may include: a) Basic layer: Known IP address, MAC address, hostname, etc.; known device information (low confidence); known operating system and its version information (high confidence). b) Transport Layer: It is known that some ports are open, and the encryption protocols and encryption suites supported by some of these ports are known. c) Application Layer: The application protocols and original responses of all open ports are known, some products are known, and the information of the remaining products and their components is unknown; 10. The following fingerprint information updates were detected, and matching logic was performed based on the trigger rules: a) Basic layer → Operating system → Operating system version; b) Transport layer → Encryption protocol → Encryption protocol name, version, supported encryption suites, etc.; c) Application layer → Application protocol → Application protocol name, original response content, etc.; d) Application layer → Product → Product name, product version, etc.; 11. If the following tools are matched, the scheduling tools will be scheduled to begin executing the corresponding operations based on the scheduling policy: a) Operating system analysis tools: Perform operating system vulnerability analysis operations; b) Database connection tools: Perform database weak password brute-force operations; c) Web application analysis tools: Perform web application baseline checks and general web vulnerability analysis; d) System information tools: Perform raw response content analysis operations; e)… 12. After one or more tool calls are completed, the fingerprint information in the structured fingerprint data is updated according to the parsing configuration in the configuration information. At this time, the structured fingerprint data may include: a) Basic layer: Known IP address, MAC address, hostname, etc., known device model and name, etc. (high confidence level), known operating system and version information (high confidence level); b) Transport Layer: It is known that some ports are open, and the encryption protocols and encryption suites supported by some of these ports are known. c) Application Layer: The application protocols and original responses of all open ports are known, some product information is known, some component information is known, and the information of the remaining products and their components is unknown; 13. The following fingerprint information updates were detected, and matching logic was performed based on the trigger rules: a) Basic layer → Equipment → Equipment name; b) Application layer → Components → Component name, version, etc.; 14. No matching tool was found for fingerprint information update; task scheduling complete. 15. Based on information recorded in the database, provide user-readable reports, which may include: a) Status of discovered assets; b) The fingerprinting status of the discovered assets; c) Identified security defects in assets; d) Cases where some fingerprints were not recognized; 16. Users can subsequently supplement the corresponding recognition capabilities through the custom tool module based on the unrecognized fingerprints, and independently improve the system functions.

[0035] In practice, when information is extracted from the tool's output according to the configuration and attempted to be written back to the structured fingerprint data in the database, the operation is performed based on the confidence level. That is, based on the prior confidence level of the tool provided by the user in the configuration information and the actual confidence level of the tool's output (calculated as 100% if not provided), the posterior confidence level is obtained through calculation (such as Bayes' theorem). This posterior confidence level is then compared with the confidence threshold of the corresponding field in the stored structured fingerprint data. Based on the fingerprint information whose posterior confidence level is greater than the confidence threshold, the fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated. This is so that information with higher confidence levels will be used to trigger subsequent task processes and presentation logic, while information with lower confidence levels will be stored in another data table for information backtracking and analysis.

[0036] In practical implementation, initially, the system executing the above-mentioned network asset fingerprint construction method includes modules that implement relevant functions, default tool modules, and the required isolated operating environment. Users can access the system through methods such as... Figure 4 Add custom tools to the process shown: 1. Enter the system; 2. Enter the custom tool; 3. Provide configuration information by generating or uploading files according to the system instructions; 4. System configuration information parsing: a) If it fails, return to the previous step and regenerate / upload; 5. Upload custom tools (optional; skip this step if the operations defined in the configuration information do not require uploading); 6. Prepare the necessary isolated operating environment for the system; 7. Check if the system detection environment and tools are available; a) If unavailable, the user needs to provide the corresponding runtime environment and then prepare again; 8. Mark the corresponding configuration information and tools as "valid" in the database so that they can be invoked when the actual task is executed.

[0037] In practice, the storage of the above-mentioned structured fingerprint data can be achieved not only by using relational databases and non-relational databases, but also by using file system storage, graph database storage, etc., and by using file system traversal and graph traversal algorithms to discover and update fingerprint information.

[0038] In practice, in the process of monitoring data updates in structured fingerprint data, in addition to using database change monitoring, message queues, distributed event buses, version management systems and other solutions can also be used to realize the calls between fingerprint information updates and tool execution.

[0039] In practice, during the matching and scheduling process, in addition to defining scheduling rules using configuration information, intelligent agents (such as large language models or reinforcement learning models pre-trained in the field of network security) can also be used. The intelligent agents can automatically analyze information change events in structured fingerprint data, infer the toolchain that needs to be called next, construct the required calling parameters, execute the corresponding calling methods, analyze the output of the tools, extract structured fingerprint information, and compare it with the content in the database in conjunction with the context to determine the information with higher confidence.

[0040] In practical implementation, the above-mentioned method for constructing network asset fingerprints has the following beneficial effects: 1. Improved scanning efficiency and resource utilization: Through the combination of reactive scheduling mechanism and structured fingerprint and configuration file to provide fine-grained matching, the corresponding tool execution logic will only be triggered when the asset fingerprint meets the strictly defined conditions, avoiding full tool calls or fuzzy label matching corresponding to linear scanning methods, reducing ineffective resource overhead and scanning time; 2. Improve the accuracy and three-dimensionality of asset fingerprint recognition: By defining structured fingerprints, the original flat and labeled fingerprint presentation is transformed into a three-dimensional structure that can reflect the internal logical relationship. The confidence mechanism is used to resolve information conflicts between different tools, realize the fine characterization of asset details, and reduce false alarms of security risks caused by fingerprint misjudgment. 3. Flexible integration and expansion capabilities: Decoupling between scheduling logic and tool logic is achieved through declarative configuration files. Users do not need to modify the core system code; they only need to write simple configuration files to integrate new tools, which lowers the technical threshold for custom fingerprint recognition and rapid response to zero-day vulnerabilities.

[0041] In this embodiment, a computer device is provided, such as... Figure 5 As shown, it includes a memory 501, a processor 502, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-described methods for constructing network asset fingerprints.

[0042] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0043] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that executes any of the above-described methods for constructing network asset fingerprints.

[0044] Specifically, computer-readable storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0045] Based on the same inventive concept, this invention also provides a network asset fingerprint construction apparatus, as described in the following embodiments. Since the principle of the network asset fingerprint construction apparatus in solving the problem is similar to that of the network asset fingerprint construction method, the implementation of the network asset fingerprint construction apparatus can refer to the implementation of the network asset fingerprint construction method, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0046] Figure 6 This is a structural block diagram of a network asset fingerprint construction device according to an embodiment of the present invention, such as... Figure 6 As shown, it includes: The input module 601 is used to receive basic asset information of the target network asset and generate initial structured fingerprint data based on the basic asset information. The structured fingerprint data includes multiple structural layers related to the target network asset. Each structural layer includes one or more sub-data structures, and each sub-data structure includes a type of fingerprint information item of the structural layer to which it belongs. The scheduling module 602 is used to match the known fingerprint information in the initial structured fingerprint data with the trigger rules in the configuration information of all tools, schedule the successfully matched tools to scan the target network assets, update the structured fingerprint data with the fingerprint information output by the scheduled tools, monitor data updates in the structured fingerprint data, recursively trigger the scheduling of tools based on the updated incremental data, and update the data in the structured fingerprint data based on the fingerprint information output by the scheduled tools. The configuration information of each tool is input by the user, and the trigger rules include the mapping relationship between one or more fingerprint information items in the structured fingerprint data and each tool. The fingerprint construction module 603 is used to end the scanning task until the data in the structured fingerprint data is not updated or the incremental data of the update does not match the triggering rules of all tools, and to take the current structured fingerprint data as the final network asset fingerprint of the target network asset. The final network asset fingerprint is a three-dimensional network asset fingerprint that can reflect the internal logical dependencies of the target network asset.

[0047] In specific implementation, the scheduling module is used to repeatedly execute the following steps until it detects that the data in the structured fingerprint data has not been updated or that the updated incremental data does not match the triggering rules of all tools: Monitor whether there are any updates in the current structured fingerprint data; If so, the updated incremental data is matched with the trigger rules in the configuration information of each tool, and the tool is scheduled to perform a scanning operation on the target network asset according to the scheduling policy in the configuration information of each successfully matched tool. The scheduling policy includes the scheduling method of the tool and the parameters to be transmitted. The fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated with the fingerprint information output by scanning according to the parsing configuration in the configuration information of the scheduling tool. The parsing configuration is used to define the method of obtaining the output data of the tool and the operation strategy of the output data.

[0048] In specific implementation, the scheduling module is used to output fingerprint information and corresponding confidence level for each scheduled tool; based on the confidence level requirements in the configuration information of the scheduled tool, the fingerprint information item of the corresponding sub-data structure of the corresponding structural layer in the structured fingerprint data is updated based on the fingerprint information whose confidence level meets the confidence level requirements.

[0049] In specific implementation, the scheduling module is used to calculate the posterior confidence of the fingerprint information based on the prior confidence of the tool provided by the configuration information of the scheduling tool and the actual confidence of the fingerprint information output by the tool. The posterior confidence level is compared with the confidence threshold of the corresponding fingerprint information item in the structured fingerprint data. Based on the fingerprint information where the posterior confidence level is greater than the confidence threshold, the data of the fingerprint information item of the corresponding sub-data structure of the corresponding structural layer in the structured fingerprint data is updated.

[0050] The embodiments of this invention achieve the following technical effects: Structured fingerprint data is proposed as accurate and three-dimensional data based on multiple structural layers, better reflecting the internal logical dependencies of target network assets. Based on structured fingerprint data, each tool is matched and scheduled according to the logical relationships of one or more fingerprint information items in different structural layers. Compared with the existing "flat" tag scheduling method, this application can match and schedule each tool based on the multi-information dimensions of accurate and three-dimensional structured fingerprint data, improving the effectiveness, accuracy, and refinement of scheduling, which is beneficial for supporting high-level decision-making. Simultaneously, during the recursive triggering of tool scheduling, the scan output data of different tools further updates the structured fingerprint data, and the tools are matched and scheduled again based on the updated incremental data. This allows the scan output data of different tools to be shared and integrated within the structured fingerprint data, avoiding conflicts between tools. The problem of data silos and lack of data connectivity allows for the modification of tool scheduling and execution prerequisites based on shared and updated structured fingerprint data from different tools. This improves resource efficiency and scanning accuracy, enabling a task dispatch mechanism driven by data state changes (Events) of structured fingerprint data rather than by preset sequences (i.e., a reactive scheduling mechanism). Even if new fingerprint information is discovered, it is not necessary to re-execute a complete scanning task. Instead, the corresponding tool can be scheduled based on the new fingerprint information in a certain iteration, thus achieving fingerprint information state management. Furthermore, the use of configuration information for each tool decouples the scheduling logic from the tool logic. Users do not need to modify the core system code; they only need to write simple configuration information to integrate new tools. This lowers the technical threshold for custom fingerprint recognition and rapid response to zero-day vulnerabilities, enabling flexible integration and expansion capabilities.

[0051] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0052] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for constructing network asset fingerprints, characterized in that, include: Receive basic asset information of the target network asset, and generate initial structured fingerprint data based on the basic asset information. The structured fingerprint data includes multiple structural layers related to the target network asset. Each structural layer includes one or more sub-data structures, and each sub-data structure includes a type of fingerprint information item of the structural layer to which it belongs. The known fingerprint information in the initial structured fingerprint data is matched with the trigger rules in the configuration information of all tools. The successfully matched tools are scheduled to scan the target network assets, and the fingerprint information output by the scheduled tools is updated in the structured fingerprint data. The data updates in the structured fingerprint data are monitored, and the tools are recursively triggered and scheduled according to the updated incremental data. The data in the structured fingerprint data is updated according to the fingerprint information output by the scheduled tools. This realizes a task assignment mechanism for tool scheduling driven by data state changes of structured fingerprint data. The configuration information of each tool is input by the user, and the trigger rules include the logical relationship between one or more fingerprint information items in the structured fingerprint data and the mapping relationship between each tool. The scanning task ends when the data in the structured fingerprint data is not updated or the incremental data of the update does not match the triggering rules of all tools. The current structured fingerprint data is taken as the final network asset fingerprint of the target network asset. The final network asset fingerprint is a three-dimensional network asset fingerprint that can reflect the internal logical dependencies of the target network asset. Monitor data updates in the structured fingerprint data, recursively trigger tool scheduling based on the updated incremental data, and update the data in the structured fingerprint data according to the fingerprint information output by the scheduling tool, including: Repeat the following steps until no updates are detected in the structured fingerprint data or the incremental data does not match the trigger rules of any of the tools: Monitor whether there are any updates in the current structured fingerprint data; If so, the updated incremental data is matched with the trigger rules in the configuration information of each tool, and the tool is scheduled to perform a scanning operation on the target network asset according to the scheduling policy in the configuration information of each successfully matched tool. The scheduling policy includes the scheduling method of the tool and the parameters to be transmitted. The fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated with the fingerprint information output by scanning according to the parsing configuration in the configuration information of the scheduling tool. The parsing configuration is used to define the method of obtaining the output data of the tool and the operation strategy of the output data. Initial structured fingerprint data is generated based on the aforementioned basic asset information, including: Multiple structural layers are generated, including a basic structural layer, a transport structural layer, and an application structural layer; Multiple first sub-data structures are generated in the infrastructure layer; multiple second sub-data structures are generated in the transport structure layer; and multiple third sub-data structures are generated in the application structure layer.

2. The method as described in claim 1, characterized in that, Based on the parsing configuration in the scheduling tool's configuration information, the fingerprint information item in the corresponding sub-data structure of the corresponding structural layer in the structured fingerprint data is updated with the fingerprint information output by the scan, including: Each scheduling tool outputs fingerprint information and its corresponding confidence level; Based on the confidence requirements in the configuration information of the scheduling tool, the fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated based on the fingerprint information that meets the confidence requirements.

3. The method as described in claim 2, characterized in that, Based on the confidence requirements in the configuration information of the scheduling tool, the fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated based on the fingerprint information that meets the confidence requirements, including: Based on the prior confidence of the tool provided by the configuration information of the scheduling tool and the actual confidence of the fingerprint information output by the tool, the posterior confidence of the fingerprint information is calculated. The posterior confidence level is compared with the confidence threshold of the corresponding fingerprint information item in the structured fingerprint data. Based on the fingerprint information where the posterior confidence level is greater than the confidence threshold, the data of the fingerprint information item of the corresponding sub-data structure of the corresponding structural layer in the structured fingerprint data is updated.

4. The method according to any one of claims 1 to 3, characterized in that, The multiple first sub-data structures include: basic attribute data structure, physical device data structure, and operating system data structure; The multiple second sub-data structures include: transport protocol data structure and encryption protocol data structure; Multiple third-level sub-data structures include: application protocol data structure, product data structure, and component data structure.

5. The method as described in claim 4, characterized in that, The tools include asset discovery tools, fingerprint recognition tools, and scanning tools.

6. A device for constructing network asset fingerprints, characterized in that, include: The input module is used to receive basic asset information of the target network asset and generate initial structured fingerprint data based on the basic asset information. The structured fingerprint data includes multiple structural layers related to the target network asset. Each structural layer includes one or more sub-data structures, and each sub-data structure includes a type of fingerprint information item of the structural layer to which it belongs. The scheduling module is used to match the known fingerprint information in the initial structured fingerprint data with the trigger rules in the configuration information of all tools. The successfully matched tools are scheduled to scan the target network assets, and the fingerprint information output by the scheduled tools is updated in the structured fingerprint data. The module monitors data updates in the structured fingerprint data, recursively triggers tool scheduling based on the updated incremental data, and updates the data in the structured fingerprint data based on the fingerprint information output by the scheduled tools. This realizes a task assignment mechanism for tool scheduling driven by data state changes in structured fingerprint data. The configuration information of each tool is input by the user, and the trigger rules include the mapping relationship between one or more fingerprint information items in the structured fingerprint data and each tool. The fingerprint construction module is used to end the scanning task until the data in the structured fingerprint data is not updated or the incremental data of the update does not match the triggering rules of all tools. The current structured fingerprint data is used as the final network asset fingerprint of the target network asset. The final network asset fingerprint is a three-dimensional network asset fingerprint that can reflect the internal logical dependencies of the target network asset. The scheduling module is used to repeatedly execute the following steps until it detects that the data in the structured fingerprint data has not been updated or that the incremental data being updated does not match the triggering rules of any of the tools: Monitor whether there are any updates in the current structured fingerprint data; If so, the updated incremental data is matched with the trigger rules in the configuration information of each tool, and the tool is scheduled to perform a scanning operation on the target network asset according to the scheduling policy in the configuration information of each successfully matched tool. The scheduling policy includes the scheduling method of the tool and the parameters to be transmitted. The fingerprint information item of the corresponding sub-data structure in the corresponding structural layer of the structured fingerprint data is updated with the fingerprint information output by scanning according to the parsing configuration in the configuration information of the scheduling tool. The parsing configuration is used to define the method of obtaining the output data of the tool and the operation strategy of the output data. The input module is used to generate multiple structural layers, including a basic structural layer, a transmission structural layer, and an application structural layer; generate multiple first sub-data structures in the basic structural layer; generate multiple second sub-data structures in the transmission structural layer; and generate multiple third sub-data structures in the application structural layer.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for constructing network asset fingerprints as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method for constructing a network asset fingerprint according to any one of claims 1 to 5.

Images