An Automatic Discovery Method for IT Assets Based on Multi-Protocol Fusion and Incremental Change Detection

Abstract

This invention relates to an automatic IT asset discovery method based on multi-protocol fusion and incremental change detection. Compared with existing technologies, it solves the shortcomings of existing IT asset discovery methods, such as incomplete protocol coverage, low scanning efficiency, improper handling of multi-source data conflicts, and high update overhead, resulting in low asset discovery coverage, low accuracy, and synchronization delays. This invention includes the following steps: building a multi-protocol parallel scanning framework; intelligent scheduling of protocol priorities; multi-dimensional device fingerprint extraction; confidence-weighted fusion deduplication; incremental change detection; and intelligent identification of asset model classification. This invention introduces an intelligent asset classification mechanism based on a machine learning model to achieve automatic identification and intelligent management of asset types, realizing high coverage, high accuracy, low overhead, and low latency automatic discovery and management of IT assets.

Description

Technical Field

[0001] This invention relates to the field of IT asset management and network asset discovery technology, specifically to an automatic IT asset discovery method based on multi-protocol fusion and incremental change detection. Background Technology

[0002] With the rapid expansion of enterprise IT infrastructure, IT asset management faces enormous challenges. Modern enterprise data centers typically contain thousands of servers, tens of thousands of network devices, and hundreds of thousands of software instances. Accurate and timely discovery and management of these assets are the foundation for building a Configuration Management Database (CMDB) and a prerequisite for IT operations automation.

[0003] Existing IT asset discovery technologies mainly include the following:

[0004] Option 1: Network discovery method based on SNMP protocol, which polls network devices through SNMP protocol to obtain Management Information Base (MIB) information for device discovery. This option has the following shortcomings: (1) Limited protocol coverage, only supports SNMP, and cannot discover devices that do not support SNMP; (2) Low scanning efficiency, sequential scanning takes a long time; (3) Incomplete information, only information exposed by SNMP can be obtained.

[0005] Option 2: Agent-based asset collection method, which deploys an agent on each device to actively report asset information. This option has the following shortcomings: (1) High deployment cost, as an agent needs to be installed on each device; (2) Incomplete coverage, as agents cannot be installed on network devices, security devices, etc.; (3) Complex maintenance, with high costs for agent version upgrades and fault handling.

[0006] Option 3: Multi-protocol scanning method, which supports scanning multiple protocols and summarizes the scan results. This option has the following shortcomings: (1) The protocol scheduling is fixed and cannot be adaptively adjusted according to the network environment; (2) The deduplication rules are simple and the conflict handling is not good when scanning the same device with multiple protocols; (3) The full scan has a large overhead, and each scan is a full scan, which puts pressure on the network and the device. Summary of the Invention

[0007] The purpose of this invention is to address the shortcomings of existing IT asset discovery methods, such as incomplete protocol coverage, low scanning efficiency, improper handling of multi-source data conflicts, and high update overhead, which lead to low asset discovery coverage, low accuracy, and synchronization delays. This invention provides an automatic IT asset discovery method based on multi-protocol fusion and incremental change detection to solve the above problems.

[0008] To achieve the above objectives, the technical solution of the present invention is as follows:

[0009] An automated IT asset discovery method based on multi-protocol fusion and incremental change detection includes the following steps:

[0010] Build a multi-protocol parallel scanning framework;

[0011] Intelligent scheduling of protocol priorities: dynamically adjusts protocol scanning priorities based on network environment and device type;

[0012] Multi-dimensional device fingerprint extraction: For each discovered asset model, extract multi-dimensional fingerprint features for unique identification and recognition of the asset model;

[0013] Confidence-weighted fusion deduplication: When multiple protocols discover the same device, confidence-weighted fusion is used to handle data conflicts;

[0014] Incremental change detection: Incremental change detection is performed on assets that have already been identified;

[0015] Intelligent identification of asset model classification: Based on the asset model fingerprint information, the processed asset model is automatically classified and identified using a machine learning model.

[0016] The construction of the multi-protocol parallel scanning framework includes the following steps:

[0017] Define a protocol adapter layer: Implement a unified adapter interface for different asset discovery protocols to ensure that the outputs of each protocol meet a unified data model and calling specifications; the protocols include network management protocols, remote management protocols, cloud platform interfaces, container platform interfaces, and application layer service protocols;

[0018] Setting up multi-protocol parallel scanning technology:

[0019] Each protocol is assigned an independent scanning thread pool to control concurrency and avoid network congestion; results are aggregated asynchronously. The scanning results of each protocol are converted into a unified asset model, and the data source protocol and collection time are marked.

[0020] The intelligent scheduling of the protocol priority includes the following steps:

[0021] The target network's protocol support is detected, and the response rate and response time of each protocol are statistically analyzed.

[0022] Priority calculation: The priority of each scanning protocol involved in the multi-protocol parallel scanning process is evaluated separately, using the following formula:

[0023] ,

[0024] in, The priority score for protocol i is given. For the historical response rate of protocol i, The average response time, For information completeness, , , These are weight parameters;

[0025] For any protocol i, obtain its corresponding historical or current response rate within the statistical window. Average response time and information completeness Regarding the average response time The reverse processing is performed to obtain the time evaluation index, so that the shorter the protocol response time, the higher the corresponding time evaluation index value; when performing the reverse processing, a minimum time threshold is set to avoid the influence of outliers.

[0026] For response rate Time evaluation indicators and information completeness Set weight parameters , , The system then weights each indicator according to its weight parameters, and calculates the weighted results to obtain the priority score of protocol i. ;

[0027] Based on the priority scores of each protocol Multiple protocols are sorted, and the protocol with the higher priority score is prioritized for asset scanning operations through multi-protocol parallel scanning technology; high-priority protocols are used for scanning first, and low-priority protocols are used as a supplement, and the process is dynamically adjusted based on real-time feedback.

[0028] The multi-dimensional device fingerprint extraction includes the following steps:

[0029] The unified asset model data obtained through multi-protocol scanning technology is used to parse and process the raw asset model data, and extract basic attribute information related to the asset from the data returned by different protocols, including hardware information, software information and network information.

[0030] Based on preset feature extraction rules, multi-dimensional fingerprint features are extracted from the parsed asset model data. These multi-dimensional fingerprint features include: hardware fingerprint features, software fingerprint features, and network fingerprint features.

[0031] The extracted multi-dimensional fingerprint features are standardized, including data format unification, field standardization, and outlier handling, so that data from different sources have a consistent expression form;

[0032] The multi-dimensional fingerprint features are combined in a preset order to construct the fingerprint vector F of the corresponding asset. The fingerprint vector F contains multiple feature components that correspond to different fingerprint features.

[0033] The output fingerprint vector F is used for subsequent asset similarity calculation, asset deduplication determination, and multi-source asset data fusion processing.

[0034] The confidence-weighted fusion deduplication includes the following steps:

[0035] The similarity between asset objects A and B is calculated based on their corresponding fingerprint vectors F, using the following formula:

[0036] ,

[0037] in, This represents the overall similarity between asset object A and asset object B, which is obtained by combining the similarity scores of multiple feature dimensions, where j represents the feature dimension index. and It is the value of the j-th feature of asset object A and asset object B.

[0038] This represents the feature similarity in the fingerprint vector. The value of a single feature similarity is between 0 and 1. Set corresponding weight coefficients for different fingerprint features;

[0039] Select the corresponding similarity calculation method based on the type of fingerprint feature:

[0040] For identifier-type feature terms, similarity is determined based on whether the feature values ​​are consistent.

[0041] For string-based feature terms, similarity is determined based on the degree of string matching.

[0042] For feature terms of sets, similarity is determined based on the degree of overlap between sets.

[0043] For numerical feature terms, normalization is performed based on the degree of numerical difference to determine similarity.

[0044] During the calculation process, each fingerprint feature term in the asset fingerprint vector is analyzed. Calculate the eigenvalue similarity of the feature terms in the fingerprint vectors F of the two assets respectively. And set corresponding weight coefficients for different fingerprint feature terms. It is used to reflect the importance of each fingerprint feature in the asset identification process; the weight coefficient is a pre-set fixed weight or dynamically adjusted according to the data quality, reliability or historical identification effect of the fingerprint feature;

[0045] The overall similarity between asset objects A and B is obtained by weighting and summing the feature sub-similarity of each fingerprint feature item with its corresponding weight coefficient. Overall similarity is used to determine whether asset objects A and B are the same asset;

[0046] Confidence assessment: A confidence assessment is conducted on asset discovery results obtained from different protocols to measure the reliability of each protocol's data source in the asset identification process. The calculation formula is as follows:

[0047] ,

[0048] in, For the historical accuracy of protocol i, For data freshness, For data integrity;

[0049] For any protocol i, first construct a set of confidence impact factors for it. The confidence impact factors include:

[0050] Historical accuracy This is used to reflect the level of correctness of the protocol in the process of discovering or identifying historical assets;

[0051] Data freshness This is used to reflect the proximity between the data acquisition time and the current time.

[0052] Data integrity This is used to reflect the completeness of the asset attribute information obtained by the agreement;

[0053] After obtaining the confidence level impact factor, the historical accuracy of protocol i was analyzed. Data freshness and data integrity A combined calculation is performed to obtain the original confidence score corresponding to the protocol. The combined calculation adopts the method of reducing the overall confidence score when any confidence level influence factor is low.

[0054] When multiple protocol data sources exist for the same asset, the original confidence scores corresponding to each protocol are normalized to obtain the confidence weights for each protocol. This ensures that confidence weights are comparable across multiple protocols;

[0055] Confidence weight As a weighting parameter input for subsequent asset fusion processing, it is used to characterize the contribution and priority of data from different protocols in the multi-source asset data fusion process;

[0056] The weighted fusion calculation formula is as follows:

[0057] ,

[0058] For multi-source asset data that is determined to point to the same asset based on similarity, the confidence weights of each data source are used. Weighted fusion processing is performed on multi-source asset data; among which The value represents the merged asset attribute value, used to characterize the final result obtained after weighted fusion processing of multi-source asset data; i represents the data source index, used to identify different protocols or different sources; This represents the confidence weight corresponding to the i-th data source, used to characterize the credibility of that data source during the fusion process; Σ represents the asset attribute value corresponding to the i-th data source; Σ represents the weighted sum of attribute values ​​from multiple data sources according to their corresponding confidence weights.

[0059] Conflict Detection and Handling:

[0060] The system detects conflicts in asset attributes in the fusion results. When a conflict that cannot be automatically resolved by preset fusion rules is detected, the conflicting asset attributes are marked and the system enters a state awaiting manual confirmation. At the same time, the conflict information is recorded for subsequent optimization of the confidence assessment strategy or asset processing rule model.

[0061] The incremental change detection includes the following steps:

[0062] Implement change monitoring on the discovered asset model to obtain change events such as asset addition, status change, or attribute change, which are used to trigger subsequent incremental scanning and information update processing;

[0063] During the change monitoring process, the online / offline status or attribute changes of assets are identified by monitoring asset behavior information, configuration status information or connectivity status information in the network environment.

[0064] By monitoring device address allocation information, address resolution information, or device connectivity detection results in the network, newly launched assets or changes in asset status can be identified; or by receiving or obtaining configuration change events or change information from the configuration management database, asset configuration changes can be obtained, and the corresponding asset information update process can be triggered accordingly.

[0065] The difference is calculated using the following formula:

[0066] ,

[0067] Perform difference calculations on the set of asset states used for comparison to identify additions, disappearances, or structural changes in assets. This represents the set of asset status difference results, used to characterize the differences between the current asset status set and the historical asset status set. 'a' represents any asset status element in the asset status set. These asset status elements include not only the asset entity itself, but also asset attribute information and information regarding the relationships or hierarchical relationships between assets. This represents the set of asset states acquired at the current moment or within the current processing cycle. This represents the set of historical asset states corresponding to it, where ∈ indicates a membership relation, ∉ indicates a non-member relation, ∧ indicates a logical AND operation, and ∪ indicates a set union operation.

[0068] The asset status set includes not only the asset entity itself, but also information on the relationships or hierarchical relationships between assets;

[0069] Incremental Synchronization: Based on the asset difference results, incremental processing operations are performed on assets that have changed. During the incremental synchronization process, only assets that are determined to be newly added, disappeared, or have undergone structural or attribute changes are triggered to obtain the latest asset status information. The asset information obtained from the detailed scan or information collection is compared with the corresponding asset information in the configuration management database, and the asset records in the configuration management database are incrementally updated according to the comparison results. At the same time, the asset change type, change content, and change time information are recorded as asset change history for subsequent audit analysis, status backtracking, or model optimization.

[0070] The intelligent identification of asset model classification includes the following steps:

[0071] Feature information for classification is extracted from the fingerprint vector corresponding to the asset model. The feature information includes network features, software features, service response features, or behavioral features. Among them, network features include open port combinations and communication protocol features, software features include operating system type and software component information, and service response features include protocol response status or service identification information.

[0072] Feature information is input into a pre-trained machine learning classification model to determine the type of the asset model. The machine learning classification model is a multi-classification model, and its specific implementation is a decision tree model or an ensemble learning model. Based on the model output, the assets are automatically classified into asset types, which include one or more of the following: server assets, network equipment assets, security equipment assets, storage equipment assets, terminal equipment assets, virtualization resource assets, or container assets.

[0073] Classification confidence processing: While outputting asset classification results, obtain the corresponding classification confidence information; when the classification confidence is lower than the preset threshold, mark the asset as pending confirmation for subsequent manual verification, model correction or strategy optimization.

[0074] It also includes bidirectional synchronization of the configuration management database, which performs bidirectional synchronization of asset model information with the configuration management database to maintain consistency between asset discovery results and configuration management data; it includes the following steps:

[0075] Perform forward synchronization:

[0076] The asset information obtained through the asset discovery process is compared with the configuration items in the configuration management database. For assets that exist in the asset discovery results but not in the configuration management database, corresponding configuration items are generated and written to the configuration management database. For assets that exist in both the asset discovery results and the configuration management database, the attribute information of the corresponding configuration items is updated according to the latest discovery results. For assets that exist in the configuration management database but are not detected in the asset discovery results, the corresponding configuration items are marked as inactive, offline, or other preset processing strategies are executed.

[0077] Perform reverse synchronization:

[0078] Read existing configuration item information from the configuration management database and use it as a reference for scanning targets, scanning seeds, or strategies during the asset discovery process; optimize and adjust the scanning scope, scanning method, or scanning priority during the asset discovery process based on the asset type, importance level, or historical scanning information recorded in the configuration management database.

[0079] Perform consistency checks:

[0080] Within a preset time period, a full comparison is performed based on the asset discovery results and the configuration item information in the configuration management database to detect inconsistencies between the two in terms of asset attributes, attribute values, or relationships. For detected inconsistencies, automatic correction, status updates, or difference reports are performed according to the preset consistency processing strategy to support manual confirmation or subsequent processing.

[0081] A computer-readable storage medium storing a computer program that, when executed by a processor, enables an automatic discovery method for IT assets based on multi-protocol fusion and incremental change detection.

[0082] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, which, when executed by the processor, enables an automatic discovery method for IT assets based on multi-protocol fusion and incremental change detection.

[0083] Beneficial effects

[0084] This invention presents an automated IT asset discovery method based on multi-protocol fusion and incremental change detection. Compared with existing technologies, it constructs a unified protocol adapter architecture to achieve unified access, scheduling, and management of various heterogeneous asset discovery protocols. Furthermore, it improves the efficiency and success rate of asset discovery through multi-protocol parallel scanning and intelligent priority scheduling mechanisms. Simultaneously, for multi-source asset data obtained from different protocols, it introduces a weighted fusion and deduplication mechanism based on confidence assessment to improve the accuracy of asset identification and attribute fusion. Through a change-driven incremental change detection mechanism, when new assets are detected, disappearances, or attribute changes occur, targeted scanning and synchronous processing are performed only on relevant assets or subsets of assets. This is combined with periodic full verification as a fallback measure to reduce system resource overhead and minimize the impact on the network environment. In addition, it introduces an intelligent asset classification mechanism based on machine learning models to achieve automatic asset type identification and intelligent management, realizing high coverage, high accuracy, low overhead, and low latency automated IT asset discovery and management.

[0085] The present invention has the following advantages:

[0086] 1. Comprehensive Protocol Coverage: Supports multiple mainstream asset discovery protocols, covering various asset types such as physical devices, virtual machines, containers, and cloud resources, significantly improving the coverage and completeness of asset discovery.

[0087] 2. High scanning efficiency: Multi-protocol parallel scanning combined with intelligent scheduling greatly improves scanning efficiency.

[0088] 3. High deduplication accuracy: Based on confidence-based multi-source data fusion, the deduplication accuracy is significantly improved compared to simpler rule-based methods.

[0089] 4. Low overhead for incremental updates: The incremental change detection mechanism reduces synchronization latency from hours to minutes, significantly reducing network overhead.

[0090] 5. Intelligent classification: Machine learning automatically classifies data with high accuracy, reducing the workload of manual classification. Attached Figure Description

[0091] Figure 1 This is a sequence diagram of the method of the present invention;

[0092] Figure 2 This is a diagram of the multi-protocol parallel scanning architecture involved in this invention;

[0093] Figure 3 This is a flowchart of the confidence fusion deduplication process involved in this invention;

[0094] Figure 4 This is a flowchart illustrating the incremental change detection process involved in this invention.

[0095] Figure 5This is a flowchart illustrating the intelligent asset classification process involved in this invention.

[0096] Figure 6 This is a schematic diagram of the bidirectional synchronization module of the Configuration Management Database (CMDB) involved in this invention. Detailed Implementation

[0097] To provide a better understanding of the structural features and effects achieved by the present invention, a detailed description is provided below, accompanied by preferred embodiments and accompanying drawings:

[0098] like Figure 1 As shown, this invention provides an automatic IT asset discovery method based on multi-protocol fusion and incremental change detection, comprising the following steps:

[0099] S1: Multi-protocol parallel scanning, such as Figure 2 As shown.

[0100] Construct a multi-protocol parallel scanning framework to simultaneously use multiple protocols for asset discovery on the target network:

[0101] S1.1 Protocol Adapter Layer: Implements a unified adapter interface for different asset discovery protocols, ensuring that the outputs of each protocol meet a unified data model and calling specifications. The protocols include, but are not limited to, network management protocols, remote management protocols, cloud platform interfaces, container platform interfaces, and application layer service protocols. For example, they may include SNMP, ICMP, ARP, SSH, WMI, WinRM, IPMI, HTTP / HTTPS, and cloud platform APIs such as AWS / Azure / Alibaba Cloud / Tencent Cloud, as well as container platform APIs such as Kubernetes / Docker.

[0102] S1.2 Parallel Scheduling Engine: Allocates an independent scan thread pool for each protocol, controls concurrency, avoids network congestion, and aggregates results asynchronously.

[0103] S1.3 Unified Protocol Output: Converts the scan results of various protocols into a unified asset model, marking the data source protocol and collection time.

[0104] S2: Intelligent scheduling of protocol priorities, such as Figure 2 As shown.

[0105] Dynamically adjust protocol scanning priority based on network environment and device type:

[0106] S2.1 Environment Probe: Probe the protocol support of the target network; and calculate the response rate and response time of each protocol.

[0107] S2.2 Priority Calculation:

[0108] Priority evaluation is performed on each scanning protocol involved in the multi-protocol parallel scanning process.

[0109] formula:

[0110] in, The priority score for protocol i is given. For the historical response rate of protocol i, The average response time, For information completeness, α, β, and γ are weighting parameters.

[0111] For any protocol i, obtain its corresponding historical or current response rate within the statistical window. Average response time and information completeness .

[0112] Among them, the average response time By performing reverse processing, a time evaluation index is obtained, so that the shorter the protocol response time, the higher the corresponding time evaluation index value; when performing reverse processing, a minimum time threshold can be set to avoid the influence of outliers.

[0113] Based on this, the response rates are respectively The time evaluation indicators and information completeness mentioned above Set the corresponding weight parameters α, β, and γ, and perform weighted processing on each indicator according to the weight parameters. Then, perform comprehensive calculation on the weighted results to obtain the priority score of protocol i. .

[0114] Based on the priority scores of each protocol The system sorts multiple protocols and controls the parallel scanning engine to prioritize the protocols with higher priority scores for asset scanning operations.

[0115] S2.3 Dynamic Scheduling: Prioritize scanning with high-priority protocols, supplemented by low-priority protocols, and dynamically adjust based on real-time feedback.

[0116] By constructing a unified protocol adapter architecture, parallel asset discovery of multiple heterogeneous protocols is achieved, and the discovery results of each protocol are converted into a unified asset model for output. At the same time, based on the statistical characteristics of each protocol such as historical response rate, response time and information completeness, the protocols are prioritized and dynamically scheduled. During the scanning process, high-priority protocols are used first, thereby solving the problems of incomplete protocol coverage, low efficiency of serial scanning and reliance on manual experience in existing technologies, and improving the success rate and overall efficiency of asset discovery.

[0117] S3: Multi-dimensional device fingerprint extraction, such as Figure 3 .

[0118] For each discovered asset, extract multi-dimensional fingerprint features for unique asset identification and recognition.

[0119] The multi-dimensional fingerprint features include at least: hardware fingerprint features, used to characterize the physical or hardware-level attributes of the asset, including but not limited to MAC address, device serial number, UUID or GUID, hash value of hardware configuration information, etc.; software fingerprint features, used to characterize the software environment attributes of the asset, including but not limited to operating system type and version, hostname, list of installed key software or their hash values, etc.; and network fingerprint features, used to characterize the behavior and location characteristics of the asset in the network environment, including but not limited to hardware, software and network information such as MAC address, serial number, universal unique identifier, operating system, hostname, list of software information IP addresses, open port characteristics, network topology location information, etc.

[0120] After extracting the above-mentioned fingerprint features, the fingerprint features are combined and encoded in a preset order to construct the fingerprint vector F of the corresponding asset, wherein the fingerprint vector F contains multiple feature components that correspond to different fingerprint features.

[0121] Calculation formula:

[0122]

[0123] The fingerprint vector F is used for subsequent asset similarity calculation, asset deduplication determination, and multi-source asset data fusion processing.

[0124] S4: Confidence-weighted fusion deduplication, such as Figure 3 As shown.

[0125] When multiple protocols discover the same device, confidence-weighted fusion is used to handle data conflicts:

[0126] S4.1 Similarity Calculation: Based on the asset fingerprint vectors corresponding to asset objects A and B, the similarity between the two is calculated.

[0127] Calculation formula:

[0128] in This represents the overall similarity between asset A and asset B, which is obtained by combining the similarity of multiple feature dimensions, where j represents the feature dimension index. This represents the feature similarity in the fingerprint vector. The value of a single feature similarity is between 0 and 1. Set corresponding weight coefficients for different fingerprint features.

[0129] Select the corresponding similarity calculation method based on the type of the fingerprint feature:

[0130] For identifier-type feature items, similarity is determined based on whether the feature values ​​are consistent.

[0131] For string-based feature items, similarity is determined based on the degree of string matching.

[0132] For feature terms of sets, similarity is determined based on the degree of overlap between sets.

[0133] For numerical features, normalization is performed based on the degree of numerical difference to determine similarity.

[0134] During the calculation process, each fingerprint feature term in the asset fingerprint vector is analyzed. Calculate the feature sub-similarity of the feature term in the two asset fingerprint vectors respectively. And set corresponding weight coefficients for different fingerprint feature terms. This is used to reflect the importance of each fingerprint feature in the asset identification process; wherein, the weight coefficient can be a pre-set fixed weight, or dynamically adjusted according to the data quality, reliability, or historical identification effect corresponding to the fingerprint feature. The feature sub-similarity of each fingerprint feature is weighted and summed with its corresponding weight coefficient to obtain the overall similarity between asset objects A and B. The overall similarity is used to determine whether asset objects A and B are the same asset.

[0135] S4.2 Confidence Assessment: Conduct a confidence assessment on the asset discovery results obtained from different protocols to measure the credibility of each protocol's data source in the asset identification process.

[0136] Calculation formula:

[0137]

[0138] in, For the historical accuracy of protocol i, For data freshness, For data integrity.

[0139] For any protocol i, first construct a corresponding set of confidence impact factors, wherein the confidence impact factors include at least:

[0140] Historical accuracy This is used to reflect the level of correctness of the protocol in the process of discovering or identifying historical assets;

[0141] —Data freshness This is used to reflect the proximity between the data acquisition time and the current time.

[0142] Data integrity This is used to reflect the completeness of the asset attribute information obtained by the agreement.

[0143] After obtaining the aforementioned confidence level influence factors, the historical accuracy of protocol i was analyzed. Data freshness and data integrity A combined calculation is performed to obtain the original confidence score corresponding to the protocol, wherein the combined calculation adopts a method that reduces the overall confidence score accordingly when any confidence influence factor is low.

[0144] When multiple protocol data sources exist for the same asset, the original confidence scores corresponding to each protocol are normalized to obtain the confidence weights for each protocol. This ensures that the confidence weights are comparable across multiple protocols.

[0145] The confidence weight As a weighting parameter input for subsequent asset fusion processing, it is used to characterize the contribution and priority of different protocol data in the multi-source asset data fusion process.

[0146] S4.3 Weighted fusion:

[0147] Calculation formula:

[0148]

[0149] For multi-source asset data that are determined to point to the same asset based on similarity, the confidence weights of each data source obtained in step S4.2 are used as a basis. The multi-source asset data is then subjected to weighted fusion processing.

[0150] During the integration process, the attribute values ​​of the same asset attribute in different protocol data sources are compared. Based on the confidence weights corresponding to each data source The attribute values ​​are weighted and calculated to obtain the merged asset attribute result. .

[0151] Among them, confidence weight It is used to characterize the credibility of the corresponding data source in the asset attribute fusion process. The higher the confidence weight, the greater the influence of its corresponding attribute value in the fusion result.

[0152] For numerical asset attributes, the attribute values ​​are based on the corresponding data sources. With confidence weight Weighted calculations are performed to generate the fused numerical asset attribute results; for non-numerical asset attributes, the attribute values ​​corresponding to the data sources with higher confidence weights are selected first, or the final fusion result is determined from multiple candidate attribute values ​​according to preset rules.

[0153] Through the aforementioned confidence-weighted fusion process, unique and reliable asset attribute information is generated for subsequent asset management and synchronization.

[0154] S4.4 Conflict Detection and Handling:

[0155] The system detects conflicts in asset attributes within the fusion results. When a conflict is detected that cannot be automatically resolved using preset fusion rules, the conflicting asset attribute is marked and enters a state awaiting manual confirmation. Simultaneously, the conflict information is recorded for subsequent optimization of the confidence assessment strategy or asset processing rule model.

[0156] For multi-source asset data obtained from multiple protocols for the same asset, a confidence index including historical accuracy, data freshness, and data completeness is calculated for each data source. The multi-source data is then weighted and fused based on the confidence scores. During the fusion process, the results from data sources with higher confidence scores are prioritized for non-numerical asset attributes. Combined with asset fingerprint similarity calculation, duplicate assets are identified, deduplicated, and data conflicts are resolved. This addresses issues such as data conflicts, asset duplication, and erroneous coverage caused by the coexistence of multiple data sources during multi-protocol asset discovery, improving the consistency, accuracy, and reliability of asset data.

[0157] S5: Incremental change detection, such as Figure 4 As shown.

[0158] For identified assets, implement incremental change detection to avoid full scans:

[0159] S5.1 Change Monitoring:

[0160] Change monitoring is implemented on discovered assets to obtain change events such as asset additions, status changes, or attribute changes, which are used to trigger subsequent incremental scanning and information update processing.

[0161] During the change monitoring process, the online / offline status or attribute changes of assets are identified by monitoring asset behavior information, configuration status information or connectivity status information in the network environment.

[0162] In one implementation, newly launched assets or changes in asset status are identified by monitoring device address allocation information, address resolution information, or device connectivity detection results in the network.

[0163] In another implementation, by receiving or obtaining configuration change events or change information from the configuration management database, the asset configuration changes are obtained, and the corresponding asset information update process is triggered accordingly.

[0164] S5.2 Difference Calculation:

[0165] Calculation formula:

[0166]

[0167] A difference calculation is performed on the asset state set used for comparison to identify the addition, disappearance, or structural changes of assets. The asset state set obtained at the current time or in the current processing cycle is denoted as... The corresponding set of historical asset states is denoted as The asset status set includes not only the asset entities themselves, but also information on the relationships or hierarchical relationships between assets.

[0168] By the above and Compare and extract only those existing in Not existing The asset entity in the data is treated as a new asset; withdrawals only exist in the data. Not existing The assets in the record are treated as lost assets; at the same time, the assets in the record are identified. and Assets that exist in all of them but whose relationships or hierarchical structures have changed are classified as structurally changed assets.

[0169] The newly added assets, disappeared assets, and structurally changed assets are merged into an asset difference result, which is used for subsequent asset change processing, incremental scan triggering, structural relationship update, or synchronous update operations.

[0170] Among them, the and These can correspond to full scan results, incremental scan results, or asset subsets constructed based on change events, respectively.

[0171] S5.3 Incremental Synchronization: Based on the asset difference results obtained in step S5.2, incremental processing operations are performed on assets that have changed. During the incremental synchronization process, only assets determined to be newly added, disappeared, or undergoing structural or attribute changes are triggered to obtain the latest status information of the assets. The asset information obtained from the detailed scan or information collection is compared with the corresponding asset information in the configuration management database, and the asset records in the configuration management database are incrementally updated according to the comparison results. At the same time, information such as the asset change type, change content, and change time is recorded as the asset change history for subsequent audit analysis, status backtracking, or model optimization.

[0172] By constructing a change monitoring mechanism to detect the addition, disappearance, or attribute changes of assets, targeted and localized incremental scanning and information update processing are triggered only for the assets that have changed or the corresponding subset of assets after a change event is detected. Simultaneously, periodic full-scale comparisons are supported as a fallback verification mechanism to ensure the integrity and consistency of asset data. This solves the problems of high resource consumption, high asset update latency, and significant disturbance to the network environment caused by frequent full-scale scans in existing technologies.

[0173] S6: Intelligent asset classification recognition, such as Figure 5 As shown.

[0174] For assets processed through the aforementioned steps, the asset type is automatically classified and identified using a machine learning model based on the corresponding asset fingerprint information.

[0175] S6.1 Feature Construction: Extract feature information for classification from the fingerprint vector corresponding to the asset. The feature information includes, but is not limited to, network features, software features, service response features, or behavioral features. Among them, the network features may include open port combinations, communication protocol features, etc., the software features may include operating system type, software component information, etc., and the service response features may include protocol response status or service identification information.

[0176] S6.2 Classification Model Recognition: The classification features are input into a pre-trained machine learning classification model to determine the asset type. The machine learning classification model is a multi-classification model, and its specific implementation is not limited to decision tree models, ensemble learning models, or other models suitable for asset classification. Based on the model output, the assets are automatically classified into the corresponding asset types, which include at least one or more of the following: server assets, network equipment assets, security equipment assets, storage equipment assets, terminal equipment assets, virtualization resource assets, or container assets.

[0177] S6.3 Classification Confidence Processing: While outputting the asset classification results, obtain the corresponding classification confidence information; when the classification confidence is lower than a preset threshold, mark the asset as pending confirmation for subsequent manual verification, model correction or strategy optimization.

[0178] This method extracts multi-dimensional features from asset fingerprint vectors as classification input, employs a machine learning multi-classification model to automatically identify asset types, and outputs corresponding classification results and confidence scores. Classification results with confidence scores below a preset threshold are marked or trigger manual verification. This solves the problems of low efficiency, high subjectivity, limited rule coverage, and poor adaptability to new or complex asset forms that exist in existing technologies that rely on manual or static rules for asset classification.

[0179] S7: Configuration Management Database (CMDB) bidirectional synchronization, such as Figure 6 As shown.

[0180] The asset information processed through the aforementioned steps is then bidirectionally synchronized with the configuration management database to maintain consistency between the asset discovery results and the configuration management data.

[0181] S7.1 Forward Synchronization: Compare the asset information output by the asset discovery module with the configuration items in the configuration management database; for assets that exist in the asset discovery results but not in the configuration management database, generate corresponding configuration items and write them to the configuration management database; for assets that exist in both the asset discovery results and the configuration management database, update the attribute information of the corresponding configuration items according to the latest discovery results; for assets that exist in the configuration management database but are not detected in the asset discovery results, mark the corresponding configuration items as inactive, offline, or execute other preset processing strategies.

[0182] S7.2 Reverse Synchronization: Read existing configuration item information from the configuration management database and use the configuration information as scanning targets, scanning seeds or strategy reference information in the asset discovery process; optimize and adjust the scanning scope, scanning method or scanning priority in the asset discovery process according to the asset type, importance level or historical scanning information recorded in the configuration management database.

[0183] S7.3 Consistency Verification: Within a preset time period, a full comparison is performed between the asset discovery results and the configuration item information in the configuration management database to detect inconsistencies between the two in terms of asset attributes, attribute values, or relationships. For detected inconsistencies, automatic correction, status updates, or difference reports are performed according to the preset consistency processing strategy to support manual confirmation or subsequent processing.

[0184] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. An automatic IT asset discovery method based on multi-protocol fusion and incremental change detection, characterized in that, Includes the following steps: 11) Build a multi-protocol parallel scanning framework; 12) Intelligent scheduling of protocol priorities: Dynamically adjust protocol scanning priorities based on network environment and device type; 13) Multi-dimensional device fingerprint extraction: For each discovered asset model, extract multi-dimensional fingerprint features for unique identification and recognition of the asset model; 14) Confidence-weighted fusion deduplication: When multiple protocols discover the same device, confidence-weighted fusion is used to handle data conflicts; 15) Incremental change detection: For assets that have been identified, incremental change detection is performed; 16) Intelligent identification of asset model classification: Based on the asset model fingerprint information, the processed asset model is automatically classified and identified by machine learning model.

2. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, The construction of the multi-protocol parallel scanning framework includes the following steps: 21) Define the protocol adapter layer: Implement a unified adapter interface for different asset discovery protocols to ensure that the output of each protocol meets the unified data model and calling specifications; the protocols include network management protocols, remote management protocols, cloud platform interfaces, container platform interfaces and application layer service protocols; 22) Configure multi-protocol parallel scanning technology: Each protocol is assigned an independent scanning thread pool to control concurrency and avoid network congestion; results are aggregated asynchronously. The scanning results of each protocol are converted into a unified asset model, and the data source protocol and collection time are marked.

3. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, The intelligent scheduling of the protocol priority includes the following steps: 31) Detect the protocol support of the target network and count the response rate and response time of each protocol; 32) Priority Calculation: Priority is evaluated for each scanning protocol involved in the multi-protocol parallel scanning process, using the following formula: ， in, The priority score for protocol i is given. For the historical response rate of protocol i, The average response time, For information completeness, , , These are weight parameters; 33) For any protocol i, obtain its corresponding historical or current response rate within the statistical window. Average response time and information completeness Regarding the average response time The reverse processing is performed to obtain the time evaluation index, so that the shorter the protocol response time, the higher the corresponding time evaluation index value; when performing the reverse processing, a minimum time threshold is set to avoid the influence of outliers. For response rate Time evaluation indicators and information completeness Set weight parameters , , The system then weights each indicator according to its weight parameters, and calculates the weighted results to obtain the priority score of protocol i. ; 34) Scoring based on the priority of each protocol. Multiple protocols are sorted, and the protocol with the higher priority score is prioritized for asset scanning operations through multi-protocol parallel scanning technology; high-priority protocols are used for scanning first, and low-priority protocols are used as a supplement, and the process is dynamically adjusted based on real-time feedback.

4. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, The multi-dimensional device fingerprint extraction includes the following steps: 41) Using unified asset model data obtained through multi-protocol scanning technology, the raw asset model data is parsed and processed to extract basic attribute information related to the asset from the data returned by different protocols, including hardware information, software information and network information. 42) Based on the preset feature extraction rules, extract multi-dimensional fingerprint features from the parsed asset model data. The multi-dimensional fingerprint features include: hardware fingerprint features, software fingerprint features, and network fingerprint features. 43) Standardize the extracted multi-dimensional fingerprint features, including data format unification, field standardization, and outlier handling, so that data from different sources have a consistent expression form; 44) Combine the multi-dimensional fingerprint features in a preset order to construct the fingerprint vector F of the corresponding asset. The fingerprint vector F contains multiple feature components that correspond to different fingerprint features. 45) Output fingerprint vector F, which is used for subsequent asset similarity calculation, asset deduplication determination and multi-source asset data fusion processing.

5. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, The confidence-weighted fusion deduplication includes the following steps: 51) Calculate the similarity between asset objects A and B based on their corresponding fingerprint vectors F. The calculation formula is as follows: ， in, This represents the overall similarity between asset object A and asset object B, which is obtained by combining the similarity scores of multiple feature dimensions, where j represents the feature dimension index. and It is the value of the j-th feature of asset object A and asset object B. This represents the feature similarity in the fingerprint vector. The value of a single feature similarity is between 0 and 1. Set corresponding weight coefficients for different fingerprint features; Select the corresponding similarity calculation method based on the type of fingerprint feature: For identifier-type feature terms, similarity is determined based on whether the feature values ​​are consistent. For string-based feature terms, similarity is determined based on the degree of string matching. For feature terms of sets, similarity is determined based on the degree of overlap between sets. For numerical feature terms, normalization is performed based on the degree of numerical difference to determine similarity. During the calculation process, each fingerprint feature term in the asset fingerprint vector is analyzed. Calculate the eigenvalue similarity of the feature terms in the fingerprint vectors F of the two assets respectively. And set corresponding weight coefficients for different fingerprint feature terms. It is used to reflect the importance of each fingerprint feature in the asset identification process; the weight coefficient is a pre-set fixed weight or dynamically adjusted according to the data quality, reliability or historical identification effect of the fingerprint feature; The overall similarity between asset objects A and B is obtained by weighting and summing the feature sub-similarity of each fingerprint feature item with its corresponding weight coefficient. Overall similarity is used to determine whether asset objects A and B are the same asset; 52) Confidence Assessment: Conduct confidence assessments on asset discovery results obtained from different protocols to measure the reliability of each protocol's data source in the asset identification process. The calculation formula is as follows: ， in, For the historical accuracy of protocol i, For data freshness, For data integrity; For any protocol i, first construct a set of confidence impact factors for it. The confidence impact factors include: Historical accuracy This is used to reflect the level of correctness of the protocol in the process of discovering or identifying historical assets; Data freshness This is used to reflect the proximity between the data acquisition time and the current time. Data integrity This is used to reflect the completeness of the asset attribute information obtained by the agreement; After obtaining the confidence level impact factor, the historical accuracy of protocol i was analyzed. Data freshness and data integrity A combined calculation is performed to obtain the original confidence score corresponding to the protocol. The combined calculation adopts the method of reducing the overall confidence score when any confidence level influence factor is low. When multiple protocol data sources exist for the same asset, the original confidence scores corresponding to each protocol are normalized to obtain the confidence weights for each protocol. This ensures that confidence weights are comparable across multiple protocols; Confidence weight As a weighting parameter input for subsequent asset fusion processing, it is used to characterize the contribution and priority of different protocol data in the multi-source asset data fusion process; 53) Weighted fusion, the calculation formula is as follows: ， For multi-source asset data that is determined to point to the same asset based on similarity, the confidence weights of each data source are used. Weighted fusion processing is performed on multi-source asset data; among which The value represents the merged asset attribute value, used to characterize the final result obtained after weighted fusion processing of multi-source asset data; i represents the data source index, used to identify different protocols or different sources; This represents the confidence weight corresponding to the i-th data source, used to characterize the credibility of that data source during the fusion process; Σ represents the asset attribute value corresponding to the i-th data source; Σ represents the weighted sum of attribute values ​​from multiple data sources according to their corresponding confidence weights. 54) Conflict Detection and Handling: The system detects conflicts in asset attributes in the fusion results. When a conflict that cannot be automatically resolved by preset fusion rules is detected, the conflicting asset attributes are marked and the system enters a state awaiting manual confirmation. At the same time, the conflict information is recorded for subsequent optimization of the confidence assessment strategy or asset processing rule model.

6. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, The incremental change detection includes the following steps: 61) Monitor changes to the identified asset models to obtain change events such as asset additions, status changes, or attribute changes, which will trigger subsequent incremental scanning and information update processing. During the change monitoring process, the online / offline status or attribute changes of assets are identified by monitoring asset behavior information, configuration status information or connectivity status information in the network environment. By monitoring device address allocation information, address resolution information, or device connectivity detection results in the network, newly launched assets or changes in asset status can be identified; or by receiving or obtaining configuration change events or change information from the configuration management database, asset configuration changes can be obtained, and the corresponding asset information update process can be triggered accordingly. 62) Perform the difference calculation, using the following formula: ， Perform difference calculations on the set of asset states used for comparison to identify additions, disappearances, or structural changes in assets. This represents the set of asset status difference results, used to characterize the differences between the current asset status set and the historical asset status set. 'a' represents any asset status element in the asset status set. These asset status elements include not only the asset entity itself, but also asset attribute information and information regarding the relationships or hierarchical relationships between assets. This represents the set of asset states acquired at the current moment or within the current processing cycle. This represents the set of historical asset states corresponding to it, where ∈ indicates a membership relation, ∉ indicates a non-member relation, ∧ indicates a logical AND operation, and ∪ indicates a set union operation. The asset status set includes not only the asset entity itself, but also information on the relationships or hierarchical relationships between assets; 63) Incremental Synchronization: Based on the asset difference results, incremental processing operations are performed on assets that have changed. During the incremental synchronization process, only assets that are determined to be newly added, disappeared, or have undergone structural or attribute changes are triggered to obtain the latest asset status information. The asset information obtained from the detailed scan or information collection is compared with the corresponding asset information in the configuration management database, and the asset records in the configuration management database are incrementally updated according to the comparison results. At the same time, the asset change type, change content, and change time information are recorded as asset change history for subsequent audit analysis, status backtracking, or model optimization.

7. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, The intelligent identification of asset model classification includes the following steps: 71) Extract feature information for classification from the fingerprint vector corresponding to the asset model. The feature information includes network features, software features, service response features or behavioral features. Among them, network features include open port combinations and communication protocol features, software features include operating system type and software component information, and service response features include protocol response status or service identification information. 72) Input the feature information into the pre-trained machine learning classification model to determine the type of the asset model; the machine learning classification model is a multi-classification model, and its specific implementation is a decision tree model or an ensemble learning model. Based on the model output, the assets are automatically classified into asset types, which include one or more of the following: server assets, network equipment assets, security equipment assets, storage equipment assets, terminal equipment assets, virtualization resource assets, or container assets. 73) Classification confidence processing: While outputting the asset classification results, obtain the corresponding classification confidence information; when the classification confidence is lower than the preset threshold, mark the asset as pending confirmation for subsequent manual verification, model correction or strategy optimization.

8. The automatic IT asset discovery method based on multi-protocol fusion and incremental change detection according to claim 1, characterized in that, It also includes bidirectional synchronization of the configuration management database, which performs bidirectional synchronization of asset model information with the configuration management database to maintain consistency between asset discovery results and configuration management data; It includes the following steps: 81) Perform forward synchronization: The asset information obtained through the asset discovery process is compared with the configuration items in the configuration management database. For assets that exist in the asset discovery results but not in the configuration management database, corresponding configuration items are generated and written to the configuration management database. For assets that exist in both the asset discovery results and the configuration management database, the attribute information of the corresponding configuration items is updated according to the latest discovery results. For assets that exist in the configuration management database but are not detected in the asset discovery results, the corresponding configuration items are marked as inactive, offline, or other preset processing strategies are executed. 82) Perform reverse synchronization: Read existing configuration item information from the configuration management database and use it as a reference for scanning targets, scanning seeds, or strategies during the asset discovery process; optimize and adjust the scanning scope, scanning method, or scanning priority during the asset discovery process based on the asset type, importance level, or historical scanning information recorded in the configuration management database. 83) Perform consistency checks: Within a preset time period, a full comparison is performed based on the asset discovery results and the configuration item information in the configuration management database to detect inconsistencies between the two in terms of asset attributes, attribute values, or relationships. For detected inconsistencies, automatic correction, status updates, or difference reports are performed according to the preset consistency processing strategy to support manual confirmation or subsequent processing.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, enables the automatic discovery method for IT assets based on multi-protocol fusion and incremental change detection as described in any one of claims 1-8.

10. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it can implement the automatic discovery method for IT assets based on multi-protocol fusion and incremental change detection as described in any one of claims 1-8.

Images