A multi-stage port layered scanning detection method and system

Abstract

The application relates to the technical field of network space security and asset detection, and discloses a multi-gear port layered scanning detection method and system, which has the technical scheme as follows: an initial scanning port set is obtained through gear port list matching and category customized port clipping processing; a network node survival level division result and a secondary verification port set are obtained through multi-source survival evidence grading processing and differential timeout scanning; an updated asset baseline is obtained through port secondary verification, service identification and deep detection processing; and a typical port opening mode of the network node is generated through unsupervised density clustering to obtain scanning optimization configuration. The application realizes the collaborative improvement of port scanning efficiency and detection accuracy through layered progressive detection and strategy self-optimization closed loop based on multi-gear scanning rules and multi-source survival evidence information.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security and asset detection technology, specifically to a multi-level port layered scanning detection method and system. Background Technology

[0002] As network assets continue to expand in scale and become increasingly diverse, port scanning, as a fundamental technology for network asset mapping and security assessment, directly impacts network security operation capabilities in terms of scanning efficiency and detection accuracy. Existing technologies have developed various approaches, including fixed port list scanning, dynamic timeout adjustment, and switch information-assisted liveness detection, which can meet port detection needs in basic scenarios. However, in complex network environments, general fixed port lists are difficult to adapt to the port open characteristics of different asset types, resulting in a high proportion of invalid probes; the determination of port timeout failures is ambiguous, easily leading to asset underreporting and misjudgment of status; the aging mechanism of switch address tables can easily cause misjudgment of liveness; and asset classification and scanning strategies largely rely on manual configuration and external fingerprint databases, making it impossible to autonomously iterate and optimize based on scan data, thus making it difficult to balance overall scanning efficiency and adaptability. Therefore, existing technologies have shortcomings. Summary of the Invention

[0003] To address the shortcomings of existing technologies, the present invention aims to provide a multi-level port hierarchical scanning detection method and system. Through a progressive scanning architecture involving multi-level scanning rules and customized port pruning, secondary port verification, and deep probing, and based on a survival determination mechanism using multi-source survival evidence hierarchical processing and differentiated timeout scanning, the scanning strategy is adaptively optimized according to typical port open patterns generated by unsupervised density clustering. This achieves a leap from static configuration to data-driven closed-loop optimization of the scanning strategy, solving problems in existing technologies such as lack of data linkage between multi-level strategies, misjudgments due to single and binary survival determination evidence, missed detections due to port unresponsiveness ambiguity, and the difficulty in balancing efficiency and coverage completeness with a fixed port list. This improves the efficiency and accuracy of port scanning in large-scale network environments.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In a first aspect, the present invention provides a multi-level port layered scanning detection method, comprising:

[0006] Based on the preset multi-level scanning rules and the range of network nodes to be scanned, an initial set of scanning ports is obtained by matching the port list by level and cropping the customized ports by category.

[0007] Based on the initial scan port set and multi-source survival evidence information, through multi-source survival evidence hierarchical processing and differentiated timeout scanning, the survival level division result of network nodes and the port set to be verified a second time are obtained.

[0008] Based on the survival level classification results and the set of ports to be verified, the updated asset baseline is obtained through port secondary verification, service identification and deep probing.

[0009] Based on the updated asset baseline, a typical port open pattern of network nodes is generated through unsupervised density clustering to obtain the scan-optimized configuration.

[0010] Furthermore, based on preset multi-level scanning rules and the range of network nodes to be scanned, an initial set of scanning ports is obtained through matching the port list by level and cropping the ports by category, including:

[0011] Based on the preset multi-level scanning rules and the range of network nodes to be scanned, the initial global port list of the network nodes is obtained by matching the global port list corresponding to the level.

[0012] The raw dataset is obtained based on the SNMP protocol and target switch information, and multi-source survival evidence information is obtained through preprocessing.

[0013] Based on the initial global port list and the first mapping table, the tailored port set is obtained by querying the target node category and replacing the global list with a customized list;

[0014] Based on the clipped port set, the initial scan port set of the network node is obtained by confirming whether the size of the clipped list is less than or equal to the preset upper limit.

[0015] Furthermore, based on the initial scan port set and multi-source survival evidence information, the process of hierarchical processing of multi-source survival evidence and differentiated timeout scanning yields the survival level classification result of network nodes and the set of ports to be verified a second time, including:

[0016] Based on the multi-source survival evidence information, the preliminary survival level classification result of network nodes is obtained through multi-source evidence fusion and hierarchical determination;

[0017] Based on the preliminary survival level classification results and the initial scan port set, the preliminary state classification results of the ports and the set of ports to be verified a second time are obtained through differentiated timeout scanning.

[0018] Based on the preliminary status classification results of the ports, the preliminary survival level of the network nodes is verified and corrected by counting the number of ports confirmed to be open in the network nodes, thus obtaining the survival level classification results of the network nodes.

[0019] Furthermore, the step of obtaining preliminary state classification results and a set of ports to be verified a second time through differentiated timeout scanning based on the preliminary survival level classification results and the initial scan port set includes:

[0020] Based on the preliminary survival level division results and the initial scan port set, a hierarchical differentiation strategy is used to allocate scan port queues to the hierarchical nodes to obtain the actual scan port queues of the network nodes.

[0021] Based on port round-trip time samples, the estimated value of the current network transmission delay is obtained by estimating the mean value in a sliding window.

[0022] Based on the estimated current network transmission delay and the preset security factor, the timeout threshold of the port is obtained by calculating the upper bound of the expected response time.

[0023] By waiting for a response according to the timeout threshold and terminating immediately upon timeout and marking the port, a preliminary state classification result of the port and a set of ports to be verified a second time are obtained.

[0024] Furthermore, based on the survival level classification results and the set of ports to be re-verified, the updated asset baseline is obtained through port re-verification, service identification, and deep probing, including:

[0025] Based on the set of ports to be verified a second time, the final state and service activity level of the ports are obtained through TCP handshake and half-closed state verification.

[0026] Based on the survival level classification results and the final state and service activity level of the port, the scanning target queue for entering the service identification layer is obtained through admission decision and differentiated timeout strategy.

[0027] Based on the scan target queue, the asset fingerprint table of the network node is obtained through port and probe mapping and service fingerprint matching;

[0028] Based on the asset fingerprint table, the updated asset baseline is obtained by combining service depth detection and risk scoring with maintenance window event identification, asset change comparison and zombie IP dual condition judgment.

[0029] Furthermore, based on the asset fingerprint table, through service depth probing and risk scoring, combined with maintenance window event identification, asset change comparison, and zombie IP dual-condition judgment, an updated asset baseline is obtained, including:

[0030] Based on the asset fingerprint table, ports that hit the preset list of key services are selected as deep probing targets to obtain a probing target queue.

[0031] Based on the target queue, deep service information is obtained by performing deep protocol interaction. The risk level score of the network node is obtained by weighted calculation of the number of open ports, the number of services hit in the list, and the number of unknown services.

[0032] Based on the multi-source survival evidence information, the maintenance window event identification result is obtained by detecting the pattern of a large number of devices refreshing their timestamps in a short period of time.

[0033] Based on the risk level score and maintenance window event identification results, the non-response count of the corresponding device is exempted during the maintenance window. The zombie IP is determined by combining the continuous non-response count and the comprehensive survival credibility and automatically downgraded to obtain the updated asset baseline.

[0034] Furthermore, the step of generating typical port open patterns of network nodes through unsupervised density clustering based on the updated asset baseline to obtain the scan optimization configuration includes:

[0035] Based on the updated asset baseline, the open port set of each network node is extracted to obtain the port open vector dataset of all network nodes.

[0036] Based on the port open vector dataset, the similarity of port open patterns between each pair of nodes is calculated using the Jaccard similarity coefficient to obtain a similarity matrix;

[0037] Based on the similarity matrix, unsupervised density clustering is used to obtain the category affiliation and noise point label of each network node;

[0038] Based on the category affiliation of each network node, a category-center port set and semantic labels are generated by statistically analyzing the open ratio of each port in each category, thus obtaining the optimized scanning configuration.

[0039] Further, based on the port open vector dataset, the similarity matrix is ​​obtained by calculating the port open pattern similarity between each pair of nodes using the Jaccard similarity coefficient, including:

[0040] Based on the open port sets of any two network nodes, the Jaccard similarity coefficient between each pair of nodes is obtained by calculating the ratio of the intersection size to the union size.

[0041] Based on the Jaccard similarity coefficients of the node pairs, the similarity matrix of all network nodes is obtained by organizing them into a symmetric matrix form.

[0042] Furthermore, the step of obtaining the category affiliation and noise point label of each network node through unsupervised density clustering based on the similarity matrix includes:

[0043] Based on the similarity matrix, the labeling results of the core nodes are obtained through neighborhood definition and core point identification;

[0044] Based on the labeling results of the core nodes, the density expansion algorithm is used to recursively merge all nodes in the neighborhood of any unvisited core node to obtain the category and noise point label of each network node.

[0045] Furthermore, based on the category affiliation of each network node, the process of generating a category-center port set and semantic labels by statistically analyzing the open ratio of each port in each category, and obtaining the scan optimization configuration, includes:

[0046] Based on the category affiliation of the network nodes, the set of category center ports is determined by statistically analyzing the open ratio, thus obtaining the typical port open mode of the network nodes;

[0047] Based on the typical port opening patterns of the network nodes, category semantic tags are automatically generated by matching MAC address OUI vendor information with well-known port service semantics.

[0048] Based on the category semantic tags and the category center port set, the scanning optimization configuration is obtained.

[0049] Secondly, the present invention provides a multi-level port layered scanning detection system, comprising:

[0050] Scan configuration module: Based on preset multi-level scanning rules and the range of network nodes to be scanned, the module obtains an initial set of scanning ports through matching the port list by level and cropping the customized ports by category.

[0051] Survival determination module: Based on the initial scan port set and multi-source survival evidence information, through multi-source survival evidence hierarchical processing and differentiated timeout scanning, the survival level division result of network nodes and the set of ports to be verified a second time are obtained;

[0052] Service identification module: Based on the survival level classification results and the set of ports to be verified, the updated asset baseline is obtained through port secondary verification, service identification and deep probing.

[0053] Clustering optimization module: Based on the updated asset baseline, typical port opening patterns of network nodes are generated through unsupervised density clustering to obtain scan optimization configuration.

[0054] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0055] This invention achieves autonomous closed-loop optimization of a hierarchical, progressive port detection and scanning strategy by customizing port categories, performing differentiated timeout scanning, conducting secondary port verification and deep probing, and generating typical port open patterns through unsupervised density clustering. Based on preset multi-level scanning rules and multi-source survival evidence information, and according to the network node survival level classification results and the updated asset baseline, it solves the problems of insufficient port list adaptability, ambiguous timeout status judgment, and inability to autonomously iterate scanning strategies in existing technologies. This improves the execution efficiency, detection accuracy, and environmental adaptability of port scanning in large-scale complex network environments. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating the steps of a multi-position port layered scanning detection method according to the present invention.

[0057] Figure 2 Flowchart of steps to obtain the initial set of scan ports;

[0058] Figure 3 A flowchart outlining the steps to obtain the network node survival hierarchy classification and the set of ports to be verified.

[0059] Figure 4 A flowchart outlining the steps to obtain the updated asset baseline;

[0060] Figure 5 A flowchart outlining the steps to obtain the optimized scan configuration;

[0061] Figure 6 This is a schematic diagram of the structure of a multi-port layered scanning detection system according to the present invention. Detailed Implementation

[0062] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof.

[0063] Identical parts are indicated by the same reference numerals. It should be noted that the terms "front," "rear," "left," "right," "up," and "down" used in the following description refer to directions in the accompanying drawings, while the terms "bottom surface," "top surface," "inner," and "outer" refer to directions toward or away from the geometric center of a specific part, respectively.

[0064] The term "and / or" in the following text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0065] Example 1

[0066] like Figure 1 As shown, this embodiment provides a multi-level port layered scanning detection method, including:

[0067] Based on the preset multi-level scanning rules and the range of network nodes to be scanned, an initial set of scanning ports is obtained by matching the port list by level and cropping the customized ports by category.

[0068] Based on the initial scan port set and multi-source survival evidence information, the survival level classification results of network nodes and the set of ports to be verified are obtained through multi-source survival evidence hierarchical processing and differentiated timeout scanning.

[0069] Based on the survival level classification results and the set of ports to be verified, the updated asset baseline is obtained through port secondary verification, service identification and deep probing.

[0070] Based on the updated asset baseline, typical port opening patterns of network nodes are generated through unsupervised density clustering, resulting in scan-optimized configurations.

[0071] The multi-level scanning rule consists of a five-level progressively increasing scanning strategy preset by the system. Each level corresponds to a different size of the global port list and the subsequent identification depth. The level values ​​cover levels 1 to 5. The global port list is initially derived from the IANA service port registry and generated according to the historical scanning open frequency. The range of network nodes to be scanned is a set of network nodes generated by parsing the target IP address or IP address range specified by the user in CIDR format, which serves as the detection target range for this scanning task. Level port list matching involves retrieving the corresponding level of the global port list from the configuration database based on the scan level selected by the user, as the initial global port list. The process involves several steps: First, the category-customized ports are open sets of typical ports corresponding to identified asset categories, generated through unsupervised density clustering. These sets are stored in an asset category-port list mapping table and are used to replace the global port list for targeted scanning. Second, the pruning process involves replacing the global port list with the category-customized port list for categorized network nodes and setting a tier limit fallback mechanism. When the size of the customized list exceeds the maximum number of ports for the selected tier, it automatically falls back to the global port list to ensure the scanning scale remains within the expected tier range. Third, the initial scanning port set is the final set of ports determined after tier matching and category pruning, used for the first round of port scanning.

[0072] Multi-source liveness evidence information is obtained by collecting traffic counters, MAC address table timestamps, and ARP entry data from the switch management information database via SNMP protocol, and combining them with ICMP response data after preprocessing. This multi-dimensional liveness evidence specifically includes traffic evidence credibility, MAC address table hierarchy credibility, ARP evidence credibility, and ICMP response credibility. The credibility values ​​for each item range from 0 to 1 and are calculated based on the characteristics of the corresponding evidence dimension. For example, traffic evidence credibility is calculated based on the traffic increment within a specified time interval of the port and a preset extremely low activity threshold. Multi-source liveness evidence hierarchical processing involves using an independent evidence probability fusion model to comprehensively calculate the comprehensive liveness credibility of the multi-source liveness evidence, and then classifying network nodes into three liveness levels—high credibility, medium credibility, and low credibility—based on the credibility threshold. The comprehensive liveness credibility value ranges from 0 to 1.

[0073] Differential timeout scanning is a scanning mechanism that estimates network transmission latency in real time based on the median of the sliding window, dynamically calculates the timeout threshold for each port by combining a security factor and the host processing latency baseline, and allocates scanning port queues of different sizes according to the survival level. The security factor ranges from 1.2 to 2.0, and is usually set to 1.5. The host processing latency baseline is the standard processing time of the target network node's TCP / IP protocol stack for processing port probe requests, ranging from 1 to 5 milliseconds, and is usually set to 2 milliseconds. The survival level classification of network nodes is the final classification result of each network node's survival level after multi-source evidence fusion and reverse verification of the number of open ports, divided into three levels: Level A (high credibility), Level B (medium credibility), and Level C (low credibility). The set of ports to be verified in the second round is the set of ports that did not return a response within the dynamic timeout threshold in the first round of differential timeout scanning, and needs to enter the subsequent second verification process to confirm the true status of the ports.

[0074] Port two-factor authentication involves performing a full TCP three-way handshake on the set of ports to be authenticated, and observing service response behavior through a half-closed state. Based on the TCP protocol standard RFC793, it determines the port's open, closed, or filtered state, while also differentiating service activity levels. The standard TCP connection timeout ranges from 2000 to 5000 milliseconds, typically set to 3000 milliseconds. Service identification involves sending corresponding protocol probes to confirmed open ports using a port-probe mapping table, and performing regular expression matching of the response results with a service fingerprint database to identify the service name and version corresponding to the port. Deep probing involves... Deep protocol interaction is performed on ports that hit the list of key services to obtain more detailed service information. An asset risk score is calculated by combining the number of open ports and the number of high-risk services. At the same time, a comprehensive processing process is performed to identify maintenance windows, determine zombie IPs, and compare asset baselines. The threshold for determining continuous no response of zombie IPs ranges from 20 to 50 times, with a typical value of 30 times. The lower limit threshold for comprehensive survival credibility ranges from 0.15 to 0.25, with a typical value of 0.20. The updated asset baseline is a network asset ledger that has been updated with port status, service information, survival level, and asset change records after full-process scanning and asset comparison.

[0075] Unsupervised density clustering is a learning process that uses port openness vectors as input, constructs a similarity matrix based on the Jaccard similarity coefficient, and automatically classifies network nodes and labels noise points using density-based unsupervised clustering logic. The typical port openness pattern of network nodes is obtained by statistically analyzing the openness ratio of each port within each asset category generated by clustering, and selecting the category center port set through majority voting, which represents the common port openness feature of the asset category. The scan optimization configuration is a strategy configuration formed by writing the typical port openness pattern of the category and its corresponding semantic label into the asset category and port list mapping table, which can be fed back to the pre-scan stage for dynamic pruning of the port list in subsequent scan tasks.

[0076] This embodiment achieves a balance between scanning efficiency and detection accuracy through a pre-screening mechanism that combines multi-level scanning rules with category-customized port pruning, a hierarchical scanning mechanism that uses multi-source liveness evidence grading and dynamic timeout adaptation, a status confirmation mechanism that combines TCP half-closed secondary verification and deep probing, and a self-optimizing closed-loop mechanism for scanning strategies driven by unsupervised density clustering. This enhances the adaptive capability of port scanning in complex network environments, reduces network bandwidth overhead caused by invalid probes, and ensures the accuracy of port status determination and the continuity of dynamic updates to asset baselines.

[0077] Furthermore, this embodiment provides a step for obtaining an initial set of scanning ports based on preset multi-level scanning rules and the range of network nodes to be scanned, through matching the port list by level and cropping the ports by category, including:

[0078] Based on the preset multi-level scanning rules and the range of network nodes to be scanned, the initial global port list of the network nodes is obtained by matching the global port list corresponding to the level.

[0079] The raw dataset is obtained based on the SNMP protocol and target switch information, and multi-source survival evidence information is obtained through preprocessing.

[0080] Based on the initial global port list and the first mapping table, the set of clipped ports is obtained by querying the target node category and replacing the global list with a customized list;

[0081] Based on the pruned port set, the initial scan port set of the network node is obtained by confirming whether the size of the pruned list is less than or equal to the preset upper limit.

[0082] In this step, the multi-level scanning rules are consistent with the previous definitions. Specifically, they are a five-level progressive scanning strategy divided according to the differences in scanning depth and port coverage scale. Each level corresponds to a global port list of different sizes and subsequent identification levels. The range of network nodes to be scanned is the set of target objects for this scanning task, which is obtained by parsing the IP address or CIDR format IP address range entered by the user. The level is the specific execution level in the multi-level scanning rules, which includes five levels from level 1 to level 5. The global port list is the set of base ports corresponding to each level, which is generated by sorting well-known ports and registered ports in the Internet Corporation for Assigned Numbers (ICANN) service port registry from high to low according to the opening frequency in historical scans. The initial global port list of network nodes is the global port list corresponding to the level selected by the user and retrieved from the configuration database, which serves as the base scan set before port pruning.

[0083] SNMP, or Simple Network Management Protocol, is used to communicate with switches in the target network to read statistical data from the device management information database. The target switch information consists of the management address and access permissions of the switches in the target network, obtained from a pre-configured network asset ledger. The raw dataset is the raw statistical data read from the switch's management information database via SNMP, collected by accessing the switch's MIB node, including traffic counter data, MAC address table timestamp data, and ARP entry data. Preprocessing involves standardizing and correcting the raw dataset and performing feature calculations to eliminate anomalies such as counter wraparound and extract liveness quantification features. Multi-source liveness evidence information is a set of multi-dimensional asset liveness quantification indicators obtained after preprocessing, including traffic evidence credibility, MAC address table hierarchy credibility, ARP evidence credibility, and ICMP response credibility. Each credibility value ranges from 0 to 1; a higher value indicates stronger support for the node's liveness status.

[0084] The first mapping table is the asset category to port list mapping table, which is constructed based on typical port opening patterns generated by unsupervised density clustering of historical scan data; the target node category is the asset type classification of the network node to be scanned, which is obtained by clustering based on the port opening patterns in the historical scan results; the customized list is the typical port opening set of the corresponding asset category, which is generated based on the common open ports of the same type of assets; the pruned port set is the port set obtained after replacing the customized ports of the category, and the customized list replaces the global list for the classified nodes, while the global list remains unchanged for the unclassified nodes.

[0085] The size of the pruned list is the total number of ports contained in the pruned port set, obtained by counting the number of port entries in the pruned port set; the preset upper limit of the gear level is the maximum number of ports corresponding to the user-selected gear level, which is set according to the scanning intensity level of the gear level, and the value increases with the increase of the gear level. For example, the upper limit of gear level 1 is usually 10, gear level 2 is usually 100, gear level 3 is usually 500, gear level 4 is usually 2000, and gear level 5 is usually 65535; the initial scan port set of the network node is the first round scan port set finally determined after the gear level upper limit is verified.

[0086] Specifically, such as Figure 2As shown, the system first obtains the user-configured scan task parameters to generate the initial global port list. The user inputs the range of network nodes to be scanned through the system management interface, supporting both single IP addresses and CIDR-formatted IP address ranges. The system performs address resolution on the input address ranges to generate a continuous list of network nodes to be scanned. The user selects the execution level for this task from five preset scan levels: Level 1 (Extreme Speed ​​Survival Scan), Level 2 (Standard Port Scan), Level 3 (Deep Fingerprint Scan), Level 4 (Professional Full Scan), and Level 5 (Full Port Deep Scan). Higher levels cover more ports and provide more complete subsequent identification layers. Based on the user-selected level, the system retrieves the corresponding global port list from the configuration database, serving as the initial global port list for the network nodes. The global port list initially originates from the service port registry published by the Internet Corporation for Assigned Numbers (ICANN). The system extracts well-known and registered ports, sorts them from highest to lowest frequency of open ports discovered in historical scan tasks, and uses the corresponding number of ports to form the default global port list for each level.

[0087] Then, the system first accesses the target switch's Interface Management Information Base (MIB) and Forwarding Database (MIB) nodes based on the pre-configured switch management address and access credentials, collecting raw data in three categories: The first category is traffic counter data, including the number of inbound bytes, outbound bytes, inbound error packets, and outbound error packets for each switch port. The corresponding data type is a 32-bit unsigned counter, conforming to the RFC1213 standard definition. The second category is MAC address table timestamp data, including the time when each MAC address was learned by the switch and its corresponding physical port number. The third category is ARP table entry data, including the mapping relationship between IP addresses and MAC addresses. The system reads the current values ​​of all the above counters at the first moment, waits for a preset time interval, and then reads the values ​​of the same set of counters again at the second moment. The time interval between the two readings ranges from 20 to 60 seconds, typically 30 seconds. For switches that support direct reading of learning timestamps, the system directly obtains the learning time of MAC entries; for switches that do not support direct reading of timestamps, the system infers time information by reading the MAC address table twice consecutively and comparing the results. The online time of newly added entries is estimated to be the time of the second reading. Entries that exist in both readings are determined to have a continuous online duration of at least the time interval between the two readings.

[0088] The system performs wraparound preprocessing on the two collected flow counter data, and calculates the flow increment using a modulo-differential algorithm conforming to RFC2578: For any 32-bit counter, if the count value at the second time step is greater than or equal to the count value at the first time step, the flow increment is the value at the second time step minus the value at the first time step; if the count value at the second time step is less than the value at the first time step, it indicates that the counter has experienced a wraparound phenomenon where the maximum value returns to zero, and the flow increment is the value at the second time step plus 2 to the power of 32 and then minus the value at the first time step. The corresponding calculation formula is: When hour, ;when hour, ;in This is the counter reading at the first moment. This is the counter reading at the second time step. This corresponds to the increment of the counter within the time interval.

[0089] Port activity scores are calculated based on incremental traffic. The score is calculated by dividing the total number of bytes of port traffic by the product of the extremely low activity threshold and the time interval. The final result is the smaller of 1 and the calculated value, ensuring that the score range is between 0 and 1. The extremely low activity threshold is used to distinguish whether there is basic traffic activity on the port, with a value ranging from 64 bytes / second to 256 bytes / second, typically 128 bytes / second. The port activity score is mapped to traffic evidence credibility, which is calculated by multiplying the port activity score by a traffic evidence weighting coefficient. The traffic evidence weighting coefficient is set according to the strength of evidence support for network node survival based on traffic characteristics, combined with the weighting rules of the multi-source survival evidence fusion model, and its value ranges from 0.6 to 0.8, typically 0.70.

[0090] Preprocessing is performed on the timestamp data of the MAC address table. The existing duration and remaining aging ratio of each MAC address table entry are calculated. The existing duration of the entry is the current system time minus the entry's learning timestamp. The remaining aging ratio is 1 minus the ratio of the existing duration of the entry to the aging time of the switch's MAC address table. The default aging time for the switch's MAC address table is 300 seconds. Based on the remaining aging ratio and traffic evidence, the MAC address table hierarchy credibility is obtained. The credibility value for high-credibility nodes ranges from 0.85 to 0.95, typically 0.90; the credibility value for medium-credibility nodes ranges from 0.60 to 0.70, typically 0.65; and the credibility value for low-credibility nodes ranges from 0.35 to 0.45, typically 0.40.

[0091] Preprocessing is performed on ARP entry data. If the target IP has a corresponding record in the ARP table and the corresponding MAC address is at a high trust level, the ARP evidence trust value ranges from 0.45 to 0.55, typically 0.50. If the target IP has a corresponding record in the ARP table but the corresponding MAC address is at a medium to low trust level, the ARP evidence trust value ranges from 0.25 to 0.35, typically 0.30. In scenarios where no-ping mode is not enabled, the system supplements the data by collecting ICMP response data. The ICMP response trust value is calculated based on the deviation of the round-trip time of the ICMP echo request from the historical baseline. The closer the round-trip time is to the historical baseline, the higher the trust value; the greater the deviation, the lower the trust value. The final value is normalized to the range of 0 to 1. Finally, the above four types of trust values ​​are integrated to form complete multi-source liveness evidence information, which is used for subsequent node liveness classification determination.

[0092] Then, a first mapping table is preloaded, which stores all identified asset categories and their corresponding customized port lists. Each asset category corresponds to a set of typical open ports. The system traverses all network nodes to be scanned and queries the category affiliation information of each node in the asset baseline. If the node has been classified into a certain asset category and there is a customized list corresponding to that category in the first mapping table, the system replaces the initial global port list with the customized list as the clipped port set for that node. If the node has not been classified into any asset category, or there is no customized list for the corresponding category in the first mapping table, the clipped port set for that node remains consistent with the initial global port list.

[0093] Finally, the total number of ports in the clipped port set for each node is counted and compared with the preset upper limit corresponding to the user-selected tier. If the number of ports in the clipped list is less than or equal to the preset upper limit, the clipped port set is used as the initial scanning port set for that network node. If the number of ports in the clipped list is greater than the preset upper limit, the system automatically reverts to using the initial global port list corresponding to that tier as the initial scanning port set for that node. This avoids customized clipping causing the scanning scale to exceed the expected tier. The time interval, confidence threshold, and port number upper limit mentioned in this embodiment are merely examples. Those skilled in the art can set these parameters according to the actual network environment and business needs; this embodiment does not impose any limitations on them.

[0094] This embodiment achieves fine-grained pre-screening of the scan port set through a multi-level scanning rule configuration mechanism, a passive multi-source liveness evidence collection mechanism based on the SNMP protocol, a customized port list pruning mechanism for asset category matching, and a backoff verification mechanism with upper limit constraints for each level. This improves the flexibility and scenario adaptability of the scan task configuration, reduces the network bandwidth overhead caused by invalid port detection, and ensures that the scan scale is always within the user's expected controllable range.

[0095] Furthermore, this embodiment provides a step for obtaining the network node survival level classification result and the set of ports to be re-verified based on the initial scan port set and multi-source survival evidence information, through multi-source survival evidence hierarchical processing and differentiated timeout scanning, including:

[0096] Based on multi-source survival evidence information, the preliminary survival level classification of network nodes is obtained through multi-source evidence fusion and hierarchical judgment.

[0097] Based on the preliminary survival level classification results and the initial scan port set, the preliminary status classification results of the ports and the port set to be verified a second time are obtained through differentiated timeout scanning.

[0098] Based on the initial state classification results of the ports, the number of ports confirmed to be open in the network nodes is counted, and the initial survival level of the network nodes is verified and corrected in reverse to obtain the survival level classification results of the network nodes.

[0099] Among them, multi-source evidence fusion is a process of comprehensively calculating multi-dimensional survival evidence using an independent evidence probability fusion model, which is used to integrate mutually independent multi-source survival evidence information to obtain an accurate comprehensive node survival assessment result; hierarchical judgment is a process of classifying network nodes into levels based on a preset level threshold of comprehensive survival credibility, which is used to classify nodes according to their survival credibility to adapt to differentiated scanning strategies; the preliminary survival level classification result of network nodes is a set of node survival level classifications that have not been reverse-verified by port scan results.

[0100] Differentiated timeout scanning is a scanning mechanism that dynamically adjusts the size of scanning ports and response timeouts by combining node survival level and real-time network transmission status. It is used to reduce invalid waiting time and scanning overhead while ensuring detection accuracy. The hierarchical differentiation strategy is a scheduling strategy that allocates different sizes of scanning port sets to nodes with different survival levels. It is used to allocate full scanning resources to high-trust nodes and lightweight verification resources to low-trust nodes, so as to achieve skewed allocation of scanning resources. Hierarchical nodes are network nodes belonging to different survival trust levels, which are determined according to the preliminary survival level classification results of network nodes. The scanning port queue is the set of ports to be scanned allocated to the corresponding level nodes, which is generated according to the historical port opening frequency and hierarchical scanning strategy. The actual scanning port queue of a network node is the set of ports that each network node actually scans after being allocated by the hierarchical differentiation strategy. The port round-trip time sample is the time interval from sending a TCPSYN probe to receiving the corresponding SYN-ACK response, which is calculated by recording the sending and receiving times in real time during the port scanning process.

[0101] The sliding window median estimation is a method for estimating network latency by maintaining a fixed-length sample window of the most recent response time and taking the median. This method is used to suppress latency estimation bias caused by network jitter and improve the stability of timeout threshold calculation. The current network transmission latency estimate is a baseline value of network link transmission latency calculated based on the median value of the sliding window, which is used as the basis for calculating the port timeout threshold. The preset safety factor is an empirical coefficient used to amplify the latency baseline value to reserve response redundancy. It is set according to the standard empirical value of the TCP protocol retransmission timer, with a value range of 1.2 to 2.0. In this embodiment, the value is 1.5. The upper bound of the expected response time is the longest normal response time of the port calculated by combining the network transmission latency estimate, the safety factor, and the host processing latency baseline. It is obtained by multiplying the network transmission latency estimate by the safety factor and then adding the host processing latency baseline.

[0102] The port timeout threshold is the maximum time to wait for a response after a single port probe is sent. It is set according to the upper bound of the expected response time, calculated independently for each port, and dynamically adjusted according to the network status. In this embodiment, the initial default value is 152 milliseconds. Port marking is the process of labeling the corresponding status of a port based on its response, used to distinguish different probe results of the port to match the subsequent processing flow. The preliminary status classification result of the port is the preliminary set of port status judgments obtained after the first round of scanning, including three statuses: open, closed, and pending secondary verification. The set of ports pending secondary verification is the set of ports that have not returned any response within the dynamic timeout threshold and need to enter the subsequent secondary verification process to confirm the true status.

[0103] The number of ports confirmed as open is the total number of ports on a single network node that are initially determined to be open, which is statistically obtained based on the initial port status classification results. Reverse verification and correction is a correction process that uses the actual port open results to adjust the node survival level in reverse, in order to correct the level determination bias caused by relying solely on evidence information. The network node survival level classification result is the final node survival level classification set obtained after reverse verification and correction of the port scan results, which is divided into three levels: Level A (high confidence), Level B (medium confidence), and Level C (low confidence).

[0104] Specifically, such as Figure 3 As shown, firstly, the credibility of traffic evidence, MAC address table level credibility, ARP evidence credibility, and ICMP response credibility are extracted for each network node. Then, an independent evidence probability fusion model is used to calculate the overall survival credibility. This model is derived from the probability formula of at least one occurrence of multiple independent events in probability theory, and is a standard multi-source evidence combination method. The calculation formula is as follows: ;in To assess overall survival reliability, the value ranges from 0 to 1; For MAC address table level trust, To ensure the credibility of traffic evidence, To assess the credibility of ARP evidence, The ICMP response credibility is represented by four independent credibility parameters, each ranging from 0 to 1. The physical meaning of this formula is that if any one piece of evidence proves a node's survival, then the node as a whole has a possibility of survival. When multiple pieces of evidence support a node, the overall credibility is higher than any single piece of evidence. After calculating the overall survival credibility, the system performs a hierarchical judgment based on preset level thresholds. These level thresholds are set comprehensively based on the accuracy requirements of network asset detection, the accuracy statistics of survival judgment in historical scanning tasks, and the differentiated scanning strategies corresponding to different survival levels. This is used to divide the overall survival credibility into intervals to match the differentiated scanning strategies. For example, the high credibility threshold is 0.75, and the low credibility threshold is 0.40. Nodes with an overall survival credibility greater than or equal to the high credibility threshold are classified as Level A high credibility nodes; those greater than or equal to the low credibility threshold but less than the high credibility threshold are classified as Level B medium credibility nodes; and those less than the low credibility threshold are classified as Level C low credibility nodes. This yields the preliminary survival level classification results for network nodes.

[0105] Then, a tiered differentiated scanning strategy is used to allocate scanning port queues to nodes at each level, generating the actual scanning port queues for network nodes. For Level A high-trust nodes, the complete initial set of scanning ports is allocated as the actual scanning port queue, and a full scan is performed. For Level B medium-trust nodes, only the top 10 ports sorted by historical open frequency are allocated as the actual scanning port queue, and a fast verification scan is performed. For Level C low-trust nodes, only the top 3 ports sorted by historical open frequency are allocated as the actual scanning port queue, and a lightweight verification scan is performed. During the scanning process, the estimated value of the current network transmission delay is obtained through the midpoint estimation of the sliding window. A fixed-length sliding window is maintained for each target network node to store the most recent port round-trip time sample. The sliding window length is set comprehensively based on the fluctuation characteristics of network transmission delay, the stability requirements of delay estimation, and the real-time requirements of scanning, with a value ranging from 5 to 20, typically set to 10. Whenever the system sends a TCPSYN probe to a port and receives a SYN-ACK response, it calculates the round-trip time of that port and adds it to a sliding window. When the number of valid samples in the window has not reached the window length, the system uses a preset default delay value as an estimate of the current network transmission delay. The default delay value is set based on the empirical baseline of the standard round-trip time of the local area network, and is usually set to 100 milliseconds. When the number of valid samples in the window reaches the window length, the system switches to using the median of all samples in the window as an estimate of the current network transmission delay. Using the median can avoid the interference of extreme values ​​caused by network jitter and has stronger robustness than the arithmetic mean.

[0106] Based on the estimated current network transmission delay and a preset security factor, the upper bound of the expected response time is calculated to obtain the port's timeout threshold. Before sending the SYN probe to each port, the timeout threshold for that port is calculated independently. The calculation method involves multiplying the estimated current network transmission delay by the preset security factor and then adding a preset host processing delay baseline. The host processing delay baseline is the standard processing time of the target device's TCP / IP protocol stack for the SYN probe, typically set to 2 milliseconds. This calculation method implies that under the current network conditions, a normally open port should return a SYN-ACK response within this timeframe. Failure to respond within this timeframe likely indicates that the port has been filtered, rather than due to network latency. Further, responses are waited for according to the timeout threshold, and port marking is performed to obtain the preliminary port status classification results and the set of ports awaiting secondary verification. After sending a SYN probe to the port, the system waits for a response according to the calculated timeout threshold. If a SYN-ACK response is received within the timeout threshold, the port is marked as open. If an RST response is received within the timeout threshold, the port is marked as closed. If no response is received within the timeout threshold, the system immediately terminates the wait for the port, does not extend the waiting time, and marks the port as pending secondary verification, adding it to the set of ports pending secondary verification.

[0107] Finally, based on the initial port status classification results, the number of ports confirmed as open on each network node is counted, reverse verification is performed, and the initial survival level is corrected to obtain the survival level classification result of the network nodes. For a Class B trusted node, if at least one port in its fast verification is confirmed to be open, the node is upgraded to a Class A high-trust node, and the remaining ports in the initial scan port set are scanned. For a Class C low-trust node, if at least one port in its verification is confirmed to be open, the node is upgraded to a Class B trusted node, and the corresponding fast verification port is scanned. For a Class A high-trust node, if the number of open ports confirmed after a complete scan is lower than the expected level for similar assets, the system reassesses its survival based on multi-source survival evidence information, and downgrades it to a Class B trusted node if necessary. After the above upgrade and downgrade correction, the final survival level classification result of the network nodes is output, and the port set to be verified a second time is compiled and passed to the subsequent processing stage. The parameters mentioned in this embodiment, such as the hierarchical division threshold, sliding window length, security factor, and host processing latency baseline, are merely examples. Those skilled in the art can set them according to the actual network environment and business needs. This embodiment does not impose any restrictions on them.

[0108] This embodiment achieves precise allocation of scanning resources to high-trust nodes through a multi-source evidence probability fusion survival comprehensive evaluation mechanism, a port queue scheduling mechanism with survival level differentiation, a dynamic timeout adaptive mechanism driven by the middle value of the sliding window, and a hierarchical correction mechanism with reverse verification of open port results. This improves the overall execution efficiency of port scanning, reduces network bandwidth and time overhead caused by invalid probes and invalid waiting, and ensures the accuracy of node survival determination and port status identification.

[0109] Furthermore, this embodiment provides a step-by-step approach to obtain an updated asset baseline based on the survival level classification result and the set of ports to be re-verified, through port re-verification, service identification, and deep probing processing, including:

[0110] Based on the set of ports to be verified, the final state and service activity level of the ports are obtained through TCP handshake and half-closed state verification.

[0111] Based on the survival level classification results and the final status and service activity level of the ports, the scanning target queue for entering the service identification layer is obtained through admission decision and differentiated timeout strategy.

[0112] Based on the target queue, the asset fingerprint table of the network node is obtained through port and probe mapping and service fingerprint matching;

[0113] Based on the asset fingerprint table, the updated asset baseline is obtained by combining service depth detection and risk scoring with maintenance window event identification, asset change comparison and zombie IP dual condition judgment.

[0114] The TCP handshake is a three-way connection establishment process based on the TCP protocol standard, used to verify the true connectivity of the port at the protocol level, conforming to the definition of RFC793. The half-closed state verification is a verification method that actively closes the local write direction and listens for server response behavior after a successful TCP connection establishment, used to further differentiate the service's response activity level after confirming the port is open. The final port state is the true connectivity attribute of the port determined after two verifications, including filtered state, closed state, and open state. The filtered state is the state where the port cannot establish a TCP connection due to network access control policy blocking; it is determined when a SYN-ACK response is not received within the standard connection timeout period. The service activity level is defined as follows: The half-closed state is when the port is not open for service and an RST connection rejection response is received; the open state is when the port normally responds to TCP connection requests and can complete the three-way handshake; the service activity level is a service operation status level based on the server's response behavior in the half-closed state, including service active, service abnormal, and service silent; service active is the state in which application layer response data is continuously received in the half-closed state, indicating that the corresponding service is running normally and actively returning data; service abnormal is the state in which an RST reset response is received in the half-closed state, indicating that there is an abnormality in the service connection processing; service silent is the state in which no application layer response is received in the half-closed state, indicating that the port is open but the service is not returning valid data.

[0115] The admission decision is a two-level service scanning permission determination mechanism based on the network node liveness level, used to filter target nodes entering the service identification layer and avoid investing too many scanning resources in low-trust nodes; the differentiated timeout strategy is a scheduling strategy that sets different service scanning timeout times based on the port's previous verification results, used to improve scanning efficiency while ensuring identification accuracy; the scanning target queue entering the service identification layer is a set of IP and port combinations that need to perform service fingerprinting after being filtered by the admission decision.

[0116] Port and probe mapping is a process of matching port numbers with corresponding protocol probe packets, used to send adapted application layer probe data to different ports; service fingerprint matching is an identification process of comparing the response data returned by the target port with a preset service feature database, used to determine the service type and version information corresponding to the port; the network node asset fingerprint table is a summary data table that records the service name, service version and operating system information corresponding to each open port of all surviving network nodes.

[0117] Service deep probing is a deeper-level protocol interaction process performed on services of high security concern to obtain more detailed service operation information. The preset list of key services is a pre-configured set of high-security-risk service types, set according to the key focus of network security protection, including SSH, RDP, Telnet, database services, caching services, etc. The deep probing target is the port that hits the list of key services and requires deep protocol interaction. The probe target queue is a set of tasks to be executed, consisting of all deep probing targets. Deep protocol interaction is a probing action that sends complete application-layer protocol handshake and query commands to the target port to obtain deep data such as service version and configuration information. Service deep information is extended information such as detailed service version and running status obtained through deep probing. Risk scoring is a calculation process that quantitatively assesses the security risk level of network nodes to distinguish the risk levels of different nodes.

[0118] The number of open ports is the total number of ports confirmed to be open on a single network node, calculated based on the final status of the ports; the number of services hit in the service hit list is the number of ports on a single network node that hit the list of key services, calculated based on the service identification results of the asset fingerprint table; the number of unknown services is the number of ports on a single network node whose corresponding service type cannot be identified, calculated based on the service fingerprint matching results; the risk level score of a network node is a risk quantification value calculated by weighting the number of open ports, the number of services hit in the service hit list, and the number of unknown services, with a higher value indicating a higher node security risk; maintenance window event identification is the process of detecting planned device restart events based on MAC address table timestamp data, used to avoid misjudging zombie IPs caused by device maintenance; the timestamp centralized refresh mode is the characteristic pattern of synchronous update of timestamps in the MAC address table learning of a large number of devices in a short period of time, used to determine the occurrence of maintenance window events; the maintenance window event identification result is the conclusion of whether a planned maintenance window has occurred; asset change comparison is the process of comparing the current scan results with the historical asset baseline one by one, used to identify asset changes in the network.

[0119] The maintenance window period refers to the corresponding time range during which maintenance window events are detected; the exemption of non-response count for corresponding devices is a mechanism to prevent the cumulative number of non-response counts for affected devices during the maintenance window period, used to eliminate the interference of planned maintenance on the determination of zombie IPs; the continuous non-response count is the cumulative number of times a single network node fails to identify effective services after multiple consecutive scans, calculated based on the results of previous scans; the comprehensive survival credibility is a quantitative value of node survival calculated by multi-source evidence fusion, consistent with the previous definition; the dual-condition determination of zombie IPs is a mechanism that uses the dual-dimensional standard of continuous non-response count and survival credibility to determine long-term offline nodes, used to accurately identify idle network nodes; the updated asset baseline is the network asset ledger after this scan updates the port status, service information, survival level, asset changes, and zombie IP markings.

[0120] Specifically, such as Figure 4 As shown, the system first iterates through the set of ports to be verified, performing TCP handshake and half-closed state verification on each port to obtain the final state and service activity level of the port. The system first sets a standard TCP connection timeout for each port to be verified. This timeout is set based on empirical values ​​for standard TCP connection timeouts, typically 3000 milliseconds. Then, the system sends a SYN packet to the target port to initiate the TCP three-way handshake process. If no SYN-ACK response is received within the standard TCP connection timeout period, the port is determined to be in a filtered state. If an RST response is received during the handshake phase, the port is determined to be in a closed state. If a SYN-ACK is successfully received and ACK confirmation is completed, meaning the TCP three-way handshake successfully establishes a connection, the port is determined to be in an open state. For ports determined to be open, the system further performs half-close verification, sending lightweight application-layer probes to the ports. For well-known ports, a minimal probe packet corresponding to the corresponding protocol is sent; for unknown ports, a newline character is sent as a general probe. After the probe is sent, the system actively sends a FIN packet to close the local write direction, putting the TCP connection into a half-closed state. Simultaneously, a service response observation window is set, with a duration ranging from 1500 milliseconds to 3000 milliseconds, typically 2000 milliseconds. Within the observation window, if application-layer data is continuously received from the server, the service is considered active; if an RST reset response is received, the service is considered abnormal; if no valid application-layer response is received, the service is considered silent. After verification, the system summarizes the final state and corresponding service activity level of all ports, and sets resource constraint rules to ensure that the number of ports performing half-close verification within a single node and single scan task does not exceed a preset limit, avoiding excessive consumption of system connection resources.

[0121] Then, based on the survival level classification results and the final state and service activity level of the ports, admission decisions and differentiated timeout policy configurations are executed to obtain the scanning target queue for entering the service identification layer. A two-level admission decision is executed: for Class A high-trust nodes with a comprehensive survival trustworthiness greater than or equal to the high-trust threshold, all their open ports directly enter the service identification layer for a full scan; for Class B medium-trust nodes with a comprehensive survival trustworthiness between the low-trust and high-trust thresholds, a fast verification mode is first entered, sending lightweight probes only to the top 3 high-frequency ports ranked by historical open frequency. If a valid response is received, a full scan is initiated; otherwise, service identification for that node is skipped; for Class C low-trust nodes with a comprehensive survival trustworthiness lower than the low-trust threshold, service identification scanning is directly skipped.

[0122] Simultaneously, the system maintains a network environment health index, calculated based on the service identification success rate of high-trust nodes in historical scanning tasks. The initial value is typically set to 0.80. When the network environment health index is greater than 0.90, the admission threshold is appropriately lowered to expand the scanning coverage; when the network environment health index is less than 0.60, the admission threshold is raised to reduce invalid probes. For ports that pass admission, the system implements a differentiated timeout strategy. Ports confirmed as open through previous standard verification use the standard service identification timeout, while ports in the fast verification mode use a shortened service identification timeout. Both timeouts are calculated based on an estimated current network transmission latency, overlaid with the corresponding application layer processing latency baseline: 1000 milliseconds for standard mode and 500 milliseconds for fast verification mode. After admission screening and timeout configuration, a final scanning target queue is formed to enter the service identification layer.

[0123] Then, for the scan target queue entering the service identification layer, port and probe mapping and service fingerprint matching are performed to obtain the asset fingerprint table of network nodes. The system has a built-in port and probe mapping table, which stores the mapping relationship between commonly used port numbers and corresponding application layer protocol probe packets, covering mainstream service types such as web services, remote login, databases, and file transfer. For each IP and port pair in the scan target queue, the system queries the port and probe mapping table according to the port number, obtains the corresponding protocol probe content, and sends it; if there is no record for the corresponding port in the probe mapping table, a general empty data packet containing only the TCP header is sent as the probe. After receiving the response data returned by the target port, the system matches it with the built-in service fingerprint database. Each record in the service fingerprint database contains a regular expression matching pattern, service name, service version, and matching priority. The matching process is executed from high to low priority, and the first successfully matched record is the service identification result for that port. When the user selects a scan level of 3 or higher, an additional operating system type identification is performed. A set of TCP probe packets is sent to the target node to collect protocol stack characteristic parameters such as TTL, window size, and TCP options. These parameters are then weighted and matched against the operating system fingerprint database to obtain the node's operating system type. The service identification results for all ports are then aggregated with the operating system information to form the network node's asset fingerprint table.

[0124] Finally, based on the asset fingerprint table, service deep probing and risk scoring are performed. Combined with maintenance window event identification, asset change comparison, and zombie IP dual-condition judgment, an updated asset baseline is obtained. First, deep probing targets are screened and deep protocol interactions are performed to calculate risk level scores. Ports matching the preset key service list from the asset fingerprint table are selected to form a target queue. Deep protocol interactions are performed on the ports in the queue, sending complete protocol handshakes and information query commands for the corresponding services, such as SSH version negotiation, database login handshake, and cache service status queries, to obtain in-depth service information. The timeout for deep probing is increased by 2000 milliseconds compared to the standard service identification timeout. Then, the risk level score for each network node is calculated. The calculation method is based on the number of open ports, multiplied by the number of services in the matching list by a high-risk weight, and multiplied by the number of unknown services by a medium-risk weight. The sum of these three factors is the risk level score. The corresponding calculation formula is as follows: ;in For the first Nodes Risk level rating For the number of open ports, Number of services to the hit list, Unknown service count; high-risk weight Based on the security risk level settings for key services, there is a positive correlation between the service's security risk level and its vulnerability: the easier the exploitation of a service's vulnerability, and the greater the harm to confidentiality and availability caused by its exploitation, the higher the corresponding weight value. Key services are mostly high-risk types such as remote login, databases, and caching services, whose security risks are higher than ordinary open ports; therefore, they are typically assigned a weight of 5. Medium-risk weight... Based on the potential risks of unknown services, there is a positive correlation between the potential risk level and the unknown service's risk level: unknown services have hidden attack surfaces and uncontrollable risks, but the degree of harm and attack paths are not yet clear, and the overall risk level is lower than that of key focus services, so it is usually set to 2. Nodes are divided into three risk levels: high-risk, medium-risk, and low-risk based on the scoring results.

[0125] Then, maintenance window event identification is performed. Based on the MAC address table timestamp data in the multi-source liveness evidence information, a pattern of concentrated timestamp updates of a large number of devices within a short period of time is detected. When a preset threshold is detected that the MAC learning timestamps of more than a certain number of devices are updated within a similar time range, a maintenance window event is determined to have occurred. The threshold is determined proportionally to the total number of devices in the target network, specifically the larger of 1% of the total number of devices and a fixed lower limit of 5 devices. In this embodiment, a network of 1000 devices is used as an example, and the threshold is set to 10 devices. The time concentration range is twice the interval between two MAC table reads.

[0126] Furthermore, a dual-condition judgment and scan downgrading process is implemented for zombie IPs. The system maintains a continuous unresponsive count for each network node. After each scan, if the node does not identify any valid service, the count is incremented by 1; if a valid service is identified, the count is reset to 0. During the maintenance window, the unresponsive count of affected devices is exempted and not accumulated. Zombie IP judgment uses a dual-condition approach; meeting either condition determines the IP as a zombie IP: Condition 1 is that the continuous unresponsive count reaches the continuous unresponsive threshold, which is set according to the scanning cycle and asset idleness judgment criteria, typically set to 30 times; Condition 2 is that the overall survival reliability is continuously lower than the survival minimum threshold for more than 30 days, with the survival minimum threshold typically set to 0.20. Nodes identified as zombie IPs automatically undergo scan downgrading, with the scan level reduced to the lowest level (Level 1), and the scan frequency reduced from once daily to once weekly. Service identification and deep probing are no longer initiated.

[0127] Finally, asset change comparison and baseline update are performed. The port status, service information, liveness level, risk level, and zombie IP marking data obtained from this scan are compared line by line with the existing asset baseline. Asset change events such as new devices, IP changes, MAC changes, and network location changes are identified, and the corresponding records are updated before the final updated asset baseline is output. The connection timeout, observation window duration, weighting coefficient, quantity threshold, and no-response threshold parameters mentioned in this embodiment are merely examples. Those skilled in the art can set these parameters according to the actual network environment and business needs; this embodiment does not impose any limitations on them.

[0128] This embodiment achieves high-precision identification of port status and service attributes through a port two-factor authentication mechanism combining TCP three-way handshake and half-closed state, a two-level admission and differentiated timeout scheduling mechanism driven by liveness hierarchy, a service precision identification mechanism through port probe mapping and fingerprint matching, and a zombie IP precision judgment mechanism through deep probing risk quantification and maintenance window exemption. This improves the accuracy and reliability of asset scanning results, reduces the resource overhead caused by misjudgment and invalid probes, and ensures the timeliness and accuracy of dynamic updates to the asset baseline.

[0129] Furthermore, this embodiment provides a step for obtaining scan-optimized configurations by generating typical port open patterns of network nodes through unsupervised density clustering based on the updated asset baseline, including:

[0130] Based on the updated asset baseline, the open port vector dataset of all network nodes is obtained by extracting the open port set of each network node.

[0131] Based on the port open vector dataset, the similarity of port open patterns between each pair of nodes is calculated using the Jaccard similarity coefficient to obtain a similarity matrix;

[0132] Based on the similarity matrix, unsupervised density clustering is used to obtain the category affiliation and noise point label of each network node;

[0133] Based on the category affiliation of each network node, the open ratio of each port in each category is statistically analyzed to generate a category-center port set and category semantic labels, thus obtaining the optimized scanning configuration.

[0134] The open port set is a collection of all port numbers confirmed to be open on a single network node, extracted from the updated asset baseline; the port open vector dataset of all network nodes is a dataset formed by summing the open port sets of all surviving network nodes, serving as the input basis for subsequent clustering analysis.

[0135] The Jaccard similarity coefficient is a standard statistical indicator used to measure the similarity between two sets, quantifying the similarity of the port opening patterns of two network nodes. A node pair is any pair of network nodes in the dataset. The intersection size is the number of ports commonly contained in the open port sets of the two nodes. The union size is the total number of ports opened by at least one node in the open port sets of the two nodes. The Jaccard similarity coefficient between node pairs is the ratio of the intersection size to the union size of the open port sets of the corresponding two nodes, ranging from 0 to 1. A higher value indicates that the port opening features of the two nodes are more similar. The port opening pattern similarity is the degree of similarity of the port opening features between nodes obtained based on the Jaccard similarity coefficient. The similarity matrix of all network nodes is a matrix formed by organizing the Jaccard similarity coefficients of all node pairs in a symmetrical structure. The rows and columns of the matrix correspond to each network node, and the intersection of the rows and columns represents the similarity coefficient of the corresponding node pair.

[0136] Unsupervised density clustering is an unsupervised clustering method based on density reachability. Referencing the standard logic implementation of the DBSCAN algorithm, it is used to classify network nodes and label nodes with abnormal patterns, without needing to pre-define the number of categories. Neighborhood definition involves delineating the range of similar nodes for each node based on a similarity threshold, used to determine the local density boundary of a node. Core node identification is the process of determining whether a node is a cluster core based on the minimum number of neighborhood points, used to filter core nodes with cluster expansion capabilities. The labeling result of core nodes is the set of labels for all nodes that meet the core node determination criteria. The density expansion algorithm recursively expands the cluster range starting from the core nodes. The algorithm logic is used to complete the division of the complete categories; unvisited core nodes are core nodes that have not yet been marked and processed by the clustering traversal process, and are determined based on the marking results of the core nodes and the node access status; recursive merging is a process of classifying all nodes in the neighborhood of a core node and the neighborhood nodes of its neighboring core nodes into the same category, which is used to gradually expand the coverage of the clusters; all nodes in the neighborhood are all network nodes that fall within the neighborhood range of a certain node; the category of network nodes and noise point marking are the category information or noise point markings corresponding to each node after clustering, where noise points are nodes with unique port opening patterns that cannot be classified into any existing category.

[0137] The port open ratio is the ratio of the number of nodes with open specified ports within a certain category to the total number of nodes in that category, calculated by statistically analyzing the number of open nodes for each port within the category and the total number of nodes in the category. The category-center port set is the set of ports within a certain category whose open ratio exceeds a preset threshold. The typical port open mode of network nodes is the common port open characteristic of assets in the corresponding category, represented by the category-center port set. The MAC address OUI vendor information is the device manufacturer information obtained by matching the organization unique identifier prefix of the MAC address, queried according to the OUI registration information allocated by IEEE. The well-known port service semantics is the meaning of the service type corresponding to the standard well-known port number, obtained according to the correspondence between the general port number and the service. The category semantic label is a human-readable category description generated by combining vendor information and service semantics, used to identify the asset attributes of the corresponding category. The scan optimization configuration is the policy configuration formed by writing the category-center port set and the corresponding semantic label into the asset category and port list mapping table, which can be returned to the pre-scan stage for dynamic pruning of the port list in subsequent scan tasks.

[0138] Specifically, such as Figure 5 As shown, the process begins by extracting port open data from all surviving nodes in the updated asset baseline to construct a port open vector dataset. All network nodes confirmed to be alive in the asset baseline are selected, and for each node, all port numbers determined to be open are extracted to form the node's open port set, i.e., the port open vector. The open status includes open ports confirmed in the first scan and open ports confirmed in the second verification. The port open vectors of all surviving nodes are then aggregated and organized to form a port open vector dataset for all network nodes, serving as the input data source for subsequent similarity calculations and cluster analysis.

[0139] Then, based on the port open vector dataset, the Jaccard similarity coefficient is calculated for each node pair, and a similarity matrix is ​​constructed. Iterate through all pairwise network nodes in the dataset, and for each pair, calculate the intersection and union of their open port sets: the intersection represents the number of ports shared by both nodes, and the union represents the total number of ports opened by at least one node. The Jaccard similarity coefficient is used to calculate the port open pattern similarity between the two nodes. This coefficient is a standard method for measuring set similarity, and the calculation formula is as follows: ;in For nodes With nodes The Jaccard similarity coefficient between them For nodes The set of open ports For nodes The set of open ports is defined by the numerator being the size of the intersection of the two sets and the denominator being the size of the union of the two sets. The Jaccard similarity coefficient ranges from 0 to 1, with a higher value indicating a higher similarity in the port opening patterns of the two nodes. After calculating the similarity coefficients for each node pair in the dataset, all similarity coefficients are organized into a symmetric matrix structure. Line 1 Column element corresponds to the first The node and the first The Jaccard similarity coefficients of each node are used to obtain the similarity matrix of all network nodes.

[0140] Then, unsupervised density clustering is performed based on the similarity matrix to obtain the category affiliation and noise point labeling of each network node. The clustering process is implemented based on the standard density reachability logic of the DBSCAN algorithm, without the need to preset the number of categories. Specifically, it includes: presetting a similarity threshold, which is used to determine whether nodes have a density reachability similarity basis, with a value ranging from 0.20 to 0.40, typically 0.30; for each network node, its neighborhood is defined as the set of all other nodes whose Jaccard similarity coefficient with that node is greater than or equal to the similarity threshold; then, core point identification is performed, with a preset minimum neighborhood number of points, which is used to determine whether a node has the density condition for clustering cores, with a value ranging from 2. The minimum value is 3, with a maximum of 5. If the number of nodes in a node's neighborhood is greater than or equal to the minimum neighborhood number, then that node is marked as a core node. After traversing all nodes, the marking results of the core nodes are obtained. Further, all nodes are initialized to an unvisited state. Starting from any unvisited core node, all nodes in its neighborhood are assigned to the same category. Then, the core nodes in these nodes are recursively traversed, and all nodes in their neighborhoods are also assigned to the same category. This recursive expansion continues until the category cannot be expanded further. The above process is repeated to traverse all unvisited core nodes until all core nodes have been processed. Finally, all nodes assigned to a category receive their corresponding category classification, and nodes not assigned to any category are marked as noise points. This yields the category classification and noise point labeling for each network node.

[0141] Based on the category affiliation of each network node, a set of category-centric ports and category semantic labels are generated to ultimately obtain the optimized scanning configuration. First, the port open ratio for each category is statistically analyzed to determine the category-centric port set. For each asset category generated by clustering, the proportion of nodes with open ports within that category relative to the total number of nodes in that category is calculated; this is the port open ratio. A majority voting principle is used to select category-centric ports. If the open ratio of a port exceeds 50%, it is included in the category-centric port set, which represents the typical port open pattern for the corresponding category of network nodes. Second, the MAC address OUI prefixes of all nodes within a category are queried, and the vendor information corresponding to the most frequent OUI is statistically analyzed to obtain the MAC address OUI vendor information. Simultaneously, well-known ports included in the category-centric port set are analyzed and matched with corresponding standard service types to obtain the service semantics of well-known ports. For example, ports 80 and 443 correspond to web services, port 22 corresponds to SSH remote login services, port 9100 corresponds to printing services, and port 554 corresponds to RTSP video services. Combining vendor information and service semantics, human-readable category semantic labels are generated, such as "a certain brand of web server cluster" or "printer cluster." Finally, the semantic labels of each category and the corresponding set of central ports for each category are written into the asset category and port list mapping table, i.e., the first mapping table, to form a complete scan optimization configuration. This configuration can be transmitted back to the port pruning stage before scanning. In subsequent scanning tasks, nodes that have already been classified can directly use the central port set of the corresponding category to replace the global port list. Newly discovered nodes are automatically assigned to the category with the highest similarity after the first scan. Noise points continue to accumulate and can form new categories as the amount of data grows, thereby realizing a self-optimizing closed loop of the scanning strategy. Among them, the similarity threshold, minimum number of neighboring points, and other parameters mentioned in this embodiment are only examples. Those skilled in the art can set them according to the actual network scale and asset characteristics. This embodiment does not impose any restrictions on them.

[0142] This embodiment achieves automatic identification of asset types and adaptive pruning of the scanning port list through port open vector extraction and standardized dataset construction mechanism, node similarity measurement mechanism driven by Jaccard similarity coefficient, automatic asset classification and noise identification mechanism through unsupervised density clustering, and closed-loop optimization mechanism through category typical pattern extraction and scanning strategy feedback. This improves the adaptability of the scanning strategy to dynamic changes in the network environment, reduces the network and computing resource overhead caused by redundant port detection, and constructs a continuously self-evolving scanning strategy optimization closed loop.

[0143] Example 2

[0144] like Figure 6 As shown, this embodiment provides a multi-level port layered scanning detection system, including:

[0145] Scan configuration module: Based on preset multi-level scanning rules and the range of network nodes to be scanned, the module obtains an initial set of scanning ports through matching the port list by level and cropping the customized ports by category.

[0146] Survival determination module: Based on the initial scan port set and multi-source survival evidence information, through multi-source survival evidence hierarchical processing and differentiated timeout scanning, the survival level classification result of network nodes and the set of ports to be verified a second time are obtained;

[0147] Service identification module: Based on the survival level classification results and the set of ports to be verified, the updated asset baseline is obtained through port secondary verification, service identification and deep probing.

[0148] Clustering optimization module: Based on the updated asset baseline, it generates typical port open patterns of network nodes through unsupervised density clustering to obtain scan optimization configuration.

[0149] The scanning configuration module, liveness determination module, service identification module, and clustering optimization module are all located on the server. The server receives data transmitted from the acquisition devices and performs further analysis and processing. The acquisition devices include network switches supporting the Simple Network Management Protocol (SMMP) and port scanning probe nodes. The network switches provide raw operational data such as port traffic statistics, MAC address entries, and ARP entries for the target network. The port scanning probe nodes send port probe packets to the target network nodes and receive response data, completing port status detection and protocol interaction. The scanning configuration module, as the system's policy entry point, is responsible for receiving user-input parameters such as scan level and target node range, completing global port list matching and category-customized port pruning, generating an initial scan port set, and sending it to the liveness determination module. Simultaneously, the scanning configuration module receives scan optimization configurations returned by the clustering optimization module, dynamically updating the asset category and port list mapping table to achieve continuous optimization of the scanning strategy.

[0150] The liveness determination module is responsible for collecting liveness evidence and performing tiered port scanning. It acquires multi-source liveness evidence information from network switches in the collection device, combines it with the initial scanned port set to perform multi-source evidence fusion, liveness tier classification, and differentiated timeout scanning, outputting the liveness tier classification results of network nodes and the set of ports to be re-verified, which is then passed to the service identification module. The service identification module is responsible for secondary port status confirmation, service attribute identification, and asset baseline maintenance. Based on the liveness tier classification results, it performs admission decisions, performs TCP handshakes and half-closed state verification on the set of ports to be re-verified, completes port service fingerprint matching, deep protocol detection, and risk level calculation, and simultaneously performs maintenance window identification, zombie IP identification, and asset change comparison, ultimately outputting the updated asset baseline. The updated asset baseline serves as the system asset ledger output and is also synchronized to the clustering optimization module for strategy iteration. The clustering optimization module extracts port open vectors from the updated asset baseline, generates typical port open patterns and semantic labels for various assets through Jaccard similarity coefficient calculation and unsupervised density clustering, forms the scan optimization configuration, and sends it back to the scan configuration module, thus constructing a self-optimizing closed loop.

[0151] In summary, this invention achieves refined scheduling and adaptive adjustment of port scanning resources at the system level through a pre-screening mechanism combining multi-level hierarchical scanning rules with customized port pruning for asset categories, a layered scanning mechanism combining multi-source evidence fusion for survival level determination with dynamic timeout of sliding windows, a precise status confirmation mechanism combining TCP half-closed secondary verification and deep probing, and a self-optimizing closed-loop mechanism for scanning strategies driven by unsupervised density clustering. This effectively balances scanning efficiency and detection accuracy, enhances the adaptability of port scanning in complex network environments, reduces network bandwidth and computational resource overhead caused by invalid probes, and ensures the accuracy of port status determination and the continuity of dynamic updates to asset baselines. It can continuously adapt to changes in network environment and asset structure, demonstrating good feasibility and scalability.

[0152] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0154] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0155] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A multi-position port layered scanning detection method, characterized in that, include: Based on the preset multi-level scanning rules and the range of network nodes to be scanned, an initial set of scanning ports is obtained by matching the port list by level and cropping the customized ports by category. Based on the initial scan port set and multi-source survival evidence information, through multi-source survival evidence hierarchical processing and differentiated timeout scanning, the survival level division result of network nodes and the port set to be verified a second time are obtained. Based on the survival level classification results and the set of ports to be verified, the updated asset baseline is obtained through port secondary verification, service identification and deep probing. Based on the updated asset baseline, a typical port open pattern of network nodes is generated through unsupervised density clustering to obtain the scan-optimized configuration.

2. The multi-position port layered scanning detection method according to claim 1, characterized in that, Based on preset multi-level scanning rules and the range of network nodes to be scanned, an initial set of scanning ports is obtained through matching the port list by level and cropping the ports by category, including: Based on the preset multi-level scanning rules and the range of network nodes to be scanned, the initial global port list of the network nodes is obtained by matching the global port list corresponding to the level. The raw dataset is obtained based on the SNMP protocol and target switch information, and multi-source survival evidence information is obtained through preprocessing. Based on the initial global port list and the first mapping table, the tailored port set is obtained by querying the target node category and replacing the global list with a customized list; Based on the clipped port set, the initial scan port set of the network node is obtained by confirming whether the size of the clipped list is less than or equal to the preset upper limit.

3. The multi-position port layered scanning detection method according to claim 1, characterized in that, Based on the initial scan port set and multi-source survival evidence information, through multi-source survival evidence hierarchical processing and differentiated timeout scanning, the survival level classification result of network nodes and the set of ports to be verified a second time are obtained, including: Based on the multi-source survival evidence information, the preliminary survival level classification result of network nodes is obtained through multi-source evidence fusion and hierarchical determination; Based on the preliminary survival level classification results and the initial scan port set, the preliminary state classification results of the ports and the set of ports to be verified a second time are obtained through differentiated timeout scanning. Based on the preliminary status classification results of the ports, the preliminary survival level of the network nodes is verified and corrected by counting the number of ports confirmed to be open in the network nodes, thus obtaining the survival level classification results of the network nodes.

4. The multi-position port layered scanning detection method according to claim 3, characterized in that, Based on the preliminary survival level classification results and the initial scan port set, preliminary port status classification results and a set of ports to be verified secondaryly are obtained through differentiated timeout scanning, including: Based on the preliminary survival level division results and the initial scan port set, a hierarchical differentiation strategy is used to allocate scan port queues to the hierarchical nodes to obtain the actual scan port queues of the network nodes. Based on port round-trip time samples, the estimated value of the current network transmission delay is obtained by estimating the mean value in a sliding window. Based on the estimated current network transmission delay and the preset security factor, the timeout threshold of the port is obtained by calculating the upper bound of the expected response time. By waiting for a response according to the timeout threshold and terminating immediately upon timeout and marking the port, a preliminary state classification result of the port and a set of ports to be verified a second time are obtained.

5. The multi-position port layered scanning detection method according to claim 1, characterized in that, Based on the survival level classification results and the set of ports to be re-verified, an updated asset baseline is obtained through port re-verification, service identification, and deep probing, including: Based on the set of ports to be verified a second time, the final state and service activity level of the ports are obtained through TCP handshake and half-closed state verification. Based on the survival level classification results and the final state and service activity level of the port, the scanning target queue for entering the service identification layer is obtained through admission decision and differentiated timeout strategy. Based on the scan target queue, the asset fingerprint table of the network node is obtained through port and probe mapping and service fingerprint matching; Based on the asset fingerprint table, the updated asset baseline is obtained by combining service depth detection and risk scoring with maintenance window event identification, asset change comparison and zombie IP dual condition judgment.

6. The multi-position port layered scanning detection method according to claim 5, characterized in that, Based on the asset fingerprint table, through service depth probing and risk scoring, combined with maintenance window event identification, asset change comparison, and zombie IP dual-condition judgment, an updated asset baseline is obtained, including: Based on the asset fingerprint table, ports that hit the preset list of key services are selected as deep probing targets to obtain a probing target queue. Based on the target queue, deep service information is obtained by performing deep protocol interaction. The risk level score of the network node is obtained by weighted calculation of the number of open ports, the number of services hit in the list, and the number of unknown services. Based on the multi-source survival evidence information, the maintenance window event identification result is obtained by detecting the pattern of a large number of devices refreshing their timestamps in a short period of time. Based on the risk level score and maintenance window event identification results, the non-response count of the corresponding device is exempted during the maintenance window. The zombie IP is determined by combining the continuous non-response count and the comprehensive survival credibility and automatically downgraded to obtain the updated asset baseline.

7. The multi-position port layered scanning detection method according to claim 1, characterized in that, Based on the updated asset baseline, typical port open patterns of network nodes are generated through unsupervised density clustering to obtain scan-optimized configurations, including: Based on the updated asset baseline, the open port set of each network node is extracted to obtain the port open vector dataset of all network nodes. Based on the port open vector dataset, the similarity of port open patterns between each pair of nodes is calculated using the Jaccard similarity coefficient to obtain a similarity matrix; Based on the similarity matrix, unsupervised density clustering is used to obtain the category affiliation and noise point label of each network node; Based on the category affiliation of each network node, a category-center port set and semantic labels are generated by statistically analyzing the open ratio of each port in each category, thus obtaining the optimized scanning configuration.

8. The multi-position port layered scanning detection method according to claim 7, characterized in that, Based on the aforementioned port open vector dataset, the port open pattern similarity between each pair of nodes is calculated using the Jaccard similarity coefficient, resulting in a similarity matrix, including: Based on the open port sets of any two network nodes, the Jaccard similarity coefficient between each pair of nodes is obtained by calculating the ratio of the intersection size to the union size. Based on the Jaccard similarity coefficients of the node pairs, the similarity matrix of all network nodes is obtained by organizing them into a symmetric matrix form.

9. The multi-position port layered scanning detection method according to claim 8, characterized in that, Based on the similarity matrix, unsupervised density clustering is used to obtain the category assignment and noise point label of each network node, including: Based on the similarity matrix, the labeling results of the core nodes are obtained through neighborhood definition and core point identification; Based on the labeling results of the core nodes, the density expansion algorithm is used to recursively merge all nodes in the neighborhood of any unvisited core node to obtain the category and noise point label of each network node.

10. The multi-position port layered scanning detection method according to claim 9, characterized in that, Based on the category affiliation of each network node, a category-centric port set and semantic labels are generated by statistically analyzing the open ratio of each port in each category, resulting in an optimized scanning configuration, including: Based on the category affiliation of the network nodes, the set of category center ports is determined by statistically analyzing the open ratio, thus obtaining the typical port open mode of the network nodes; Based on the typical port opening patterns of the network nodes, category semantic tags are automatically generated by matching MAC address OUI vendor information with well-known port service semantics. Based on the category semantic tags and the category center port set, the scanning optimization configuration is obtained.

11. A multi-level port layered scanning detection system, used to implement the multi-level port layered scanning detection method according to any one of claims 1-10, characterized in that, The system includes: The scanning configuration module, based on preset multi-level scanning rules and the range of network nodes to be scanned, obtains an initial set of scanning ports through matching the port list by level and cropping the customized ports by category. The survival determination module, based on the initial scan port set and multi-source survival evidence information, obtains the survival level classification result of network nodes and the port set to be verified a second time through multi-source survival evidence hierarchical processing and differentiated timeout scanning. The service identification module, based on the survival level classification results and the set of ports to be verified, obtains the updated asset baseline through port secondary verification, service identification and deep probing processing; The clustering optimization module, based on the updated asset baseline, generates typical port open patterns of network nodes through unsupervised density clustering to obtain the scan optimization configuration.

Images