Information determination method, apparatus and device, computer storage medium and computer program product

Abstract

Disclosed in the embodiments of the present application is an information determination method, comprising: acquiring historical operation data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for a target access request; on the basis of the historical operation data, the first data and the second data, generating target detection information for a service provided by the asset; and acquiring target data of the asset for an access request to be processed, and, on the basis of the target data and the target detection information, determining from a target database a target service of the asset for said access request. Further disclosed in the embodiments of the present application are an information determination apparatus and device, a computer storage medium, and a computer program product.

Description

Information determination method, device, equipment, computer storage medium and computer program product

[0001] Cross-reference to related applications

[0002] The present application is based on the Chinese patent application No. 202411066885.5, filed on August 5, 2024, and claims the priority of the Chinese patent application No. 202411066885.5, the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the information determination technology in the field of computer, in particular to an information determination method, device, equipment, computer storage medium and computer program product. BACKGROUND

[0004] With the popularity of the network and the progress of technology, the security threat to the assets in the network system is also increasingly serious. Based on this, how to improve the security of the assets in the network system becomes increasingly important. However, since the open source framework is used when deploying applications on assets, there are serious security vulnerabilities in the assets themselves, which requires detecting the services provided by the assets in the network system in advance, and monitoring asset information in real time according to the detection results, so as to foresee possible risk events against the assets in time, and then improve the security of the assets in the network system. At present, in the related technology, the specific services corresponding to the assets are detected by using the regular expression and keyword matching method in a specific scenario. However, the service detection method in the related technology has the problem of low accuracy of service detection. SUMMARY

[0005] To solve the above technical problems, the embodiments of the present application expect to provide an information determination method, device, equipment, storage medium and computer program product, which solve the problem of low accuracy of service detection in the related technology when detecting services.

[0006] An information determination method, the method comprising:

[0007] obtaining historical running data of an asset in a network system, first data of the asset for a historical access request, and second data of the asset for a target access request;

[0008] generating target detection information for a service based on the historical running data, the first data and the second data, wherein the service is a service provided by the asset;

[0009] obtaining target data of the asset for a to-be-processed access request, and determining a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information.

[0010] An information determining apparatus, the apparatus comprising:

[0011] An obtaining unit, configured to obtain historical running data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests;

[0012] A processing unit, configured to generate target detection information for a service based on the historical running data, the first data, and the second data, wherein the service is a service provided by the asset;

[0013] A determining unit, configured to obtain target data of the asset for a to-be-processed access request, and determine a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information.

[0014] An information determining device, the device comprising a processor, a memory, and a communication bus;

[0015] The communication bus is configured to realize communication connection between the processor and the memory;

[0016] The processor is configured to execute an information determining program in the memory to realize the operation of the above-mentioned information determining method.

[0017] A computer readable storage medium, the computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to realize the operation of the above-mentioned information determining method.

[0018] A computer program product, the computer program product comprising a computer program, the computer program realizing the information determining method according to the above-mentioned information determining method when executed by a processor.

[0019] The information determination method, device, equipment, computer storage medium and computer program product provided by the embodiments of the present application can obtain historical running data of an asset in a network system, first data of the asset for a historical access request and second data of the asset for a target access request, generate target detection information of a service provided by the asset based on the historical running data, the first data and the second data, obtain target data of the asset for a to-be-processed access request, and determine a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information. In this way, the target detection information of all services provided by the asset can be generated according to the data of multiple dimensions of the asset, and the target service of the asset for the to-be-processed access request is determined in combination with the target detection information and the target data of the asset for the to-be-processed access request, so that the data of each dimension of the asset is considered when the target detection information of the service is generated, which makes the generated target detection information capable of detecting different services in different scenarios, instead of only detecting specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection in the related art. BRIEF DESCRIPTION OF DRAWINGS

[0020] FIG. 1 is a flow diagram of an information determination method provided by an embodiment of the present application;

[0021] FIG. 2 is a flow diagram of another information determination method provided by an embodiment of the present application;

[0022] FIG. 3 is a schematic diagram of a system structure corresponding to an information determination method provided by an embodiment of the present application;

[0023] FIG. 4 is a flow diagram of a risk access strategy generation method in an information determination method provided by an embodiment of the present application;

[0024] FIG. 5 is a flow diagram of a risk assessment method in an information determination method provided by an embodiment of the present application;

[0025] FIG. 6 is a schematic diagram of the structure of an information determination device provided by an embodiment of the present application;

[0026] FIG. 7 is a schematic diagram of the structure of an information determination device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0028] It should be understood that the "embodiments of the present application" or "the foregoing embodiments" mentioned throughout the specification mean that the specific features, structures or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, "in the embodiments of the present application" or "in the foregoing embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. In various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The sequence number of the above embodiments of the present application is only for description, not representing the advantages and disadvantages of the embodiments.

[0029] Unless otherwise specified, the electronic device performs any operation in the embodiments of the present application, which can be performed by the processor of the electronic device. It is also worth noting that the embodiments of the present application do not limit the order of the operations performed by the electronic device. In addition, the way of processing data in different embodiments can be the same method or different method. It should be noted that any operation in the embodiments of the present application can be independently executed by the electronic device, that is, the electronic device can execute any operation in the following embodiments without depending on the execution of other operations.

[0030] It should be understood that the specific embodiments described herein are merely intended to explain the present application and not to limit the present application.

[0031] The embodiments of the present application provide an information determination method, which can be applied to an information determination device. Referring to FIG. 1, the method can include the following operations:

[0032] Operation 101, obtaining historical running data of assets in a network system, first data of the assets for historical access requests and second data of the assets for target access requests.

[0033] In the embodiments of the present application, the asset can refer to a network device deployed in a network system, the historical running data can refer to a historical security log of the network device, the first data can refer to historical data of the network device in the network system collected for various service access requests, and the second data can refer to response data of the network device in the network system collected for a specific access request. It should be noted that the network device can include a physical device and a virtual device; the historical running log can be obtained through network detection and response (NDR) technology and a web application level firewall (WAF), and the historical security log includes related data of an attack behavior on the asset and related data of a service provided by the asset.

[0034] Operation 102, generating target detection information for the service based on the historical running data, the first data and the second data.

[0035] The service is a service that can be provided by the asset. In an implementable manner, the service can refer to a service that can be provided by an open source framework, middleware and application component corresponding to an application deployed on the asset.

[0036] In the embodiments of the present application, the target detection information can be used to detect a specified service from a plurality of services of the asset. In an implementable manner, the target detection information can include detection parameters required for detecting the service, a specific detection manner and a type of data that can be detected.

[0037] In the embodiments of the present application, initial detection information can be determined according to the historical running data and the first data of the asset for the historical access request, and the initial detection information can be adjusted according to the second data of the asset for the target access request to obtain final target detection information.

[0038] In the embodiments of the present application, by obtaining the historical running data of the asset, the first data of the asset for the historical access request and the second data of the asset for the target access request, target detection information for a service provided by an open source framework corresponding to an application, a service provided by middleware and a service provided by an application component can be generated. In this way, the target detection information can be used to detect the service provided by the open source framework, the middleware and the like corresponding to the application, and the coverage of service detection is significantly improved.

[0039] Operation 103, obtaining target data of the asset for a to-be-processed access request, and determining a target service of the asset for the to-be-processed access request from the target database based on the target data and the target detection information.

[0040] The target data can refer to response data of the asset to the to-be-processed access request. The target database can be a preset database, and the target database includes related data of various services provided by the asset. In an implementable manner, the related data of the various services can include service name, service corresponding port, and specific description of the service, and the like.

[0041] In the embodiment of the present application, after the target data is obtained, the target data can be matched with each data in the target database according to the pre-generated target detection information, and the target service of the asset to the to-be-processed access request can be determined according to the obtained multiple matching results.

[0042] In other embodiments of the present application, by obtaining the data of each dimension of the asset, the target detection information for all services provided by the asset can be generated, and then the target detection information can be used to detect various services in various scenarios, thereby improving the accuracy and efficiency of service detection.

[0043] The information determination method provided by the embodiments of the present application can generate target detection information for all services provided by the asset according to the data of multiple dimensions of the asset, and determine the target service of the asset to the to-be-processed access request in combination with the target detection information and the target data of the asset to the to-be-processed access request. The data of each dimension of the asset is considered when generating the target detection information for the service, so that the generated target detection information can detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in the related art. The problem of low accuracy of service detection in the related art is solved.

[0044] Based on the foregoing embodiments, the embodiments of the present application provide an information determination method, which can include the following operations with reference to FIG. 2:

[0045] Operation 201, an information determination device obtains historical running data of an asset in a network system, first data of the asset to a historical access request, and second data of the asset to a target access request.

[0046] In the embodiment of the present application, as shown in FIG. 3, the system corresponding to the information determination device can include a source data unit and an auxiliary unit. The source data unit includes initial running data, first initial data and second initial data. In some embodiments, the initial running data of the asset, the first initial data of the asset for a historical access request, and the second initial data of the asset for a target access request can be obtained from the source data unit in the system corresponding to the information determination device. Then, the service-related information such as service name, service version and operating system corresponding to the service in the initial running data and the first initial data is marked to obtain the historical running data and the first data carrying the mark.

[0047] It should be noted that the system corresponding to the information determination device shown in FIG. 3 further includes an auxiliary unit, and the auxiliary unit includes a request response module, a traffic collection module and a log synchronization module. The traffic collection module is configured to receive the first initial data of the asset for a historical access request and the second initial data for a target access request. The log synchronization module is configured to receive the security log (i.e., the historical running data) of the asset.

[0048] Operation 202: The information determination device generates initial detection information for the service based on the historical running data and the first data.

[0049] In the embodiment of the present application, the information determination device processes the historical running data and the first data to obtain detection parameters for the service, and determines the detection mode and the detection type for the service. Then, the initial detection information is generated in combination with the detection parameters, the detection mode and the detection type. The detection parameters can refer to the detection fields required when detecting the service.

[0050] It should be noted that the asset can provide a plurality of different services through open source frameworks, middleware and application components, and an initial detection information can be generated for each service, i.e., one service corresponds to one initial detection information.

[0051] In the embodiment of the present application, operation 202 can be implemented through operations 202a-202c.

[0052] Operation 202a: The information determination device determines target detection parameters for the service based on the historical running data and the first data.

[0053] In the embodiment of the present application, the information determination device can process the historical running data and the first data to obtain a plurality of characteristic parameters of the service, and screen the plurality of characteristic parameters to obtain the target detection parameters. In one implementable manner, the plurality of characteristic parameters of the service can refer to service name, operating system corresponding to the service, port information corresponding to the service, basic information of middleware, application plug-ins and application components providing the service, etc.

[0054] In the embodiments of the present application, operation 202a can be implemented through operations 202a1-202a2.

[0055] Operation 202a1, the information determining device processes the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service.

[0056] In the embodiments of the present application, as shown in FIG. 3, the system corresponding to the information determining device further includes a data processing unit, and the data processing unit includes a data initialization module and a data cleaning module. In some embodiments, the data initialization module is configured to perform format processing on the obtained historical data or real-time data; and the data cleaning module is configured to perform screening on part of the abnormal data in the data obtained through the data initialization module.

[0057] In the embodiments of the present application, the historical operation data and the first data can be first converted in format to convert the historical operation data and the first data into data in a specified format, and then the data after the format conversion is processed to obtain the transmission data corresponding to the service, and then the transmission data is processed to obtain the plurality of different characteristic parameters of the service. In some embodiments, the information determining device can first perform format processing on the historical operation data and the first data through the data initialization module in the data processing unit, and then perform screening on the abnormal data in the data after the format processing through the data cleaning module, and then the data after the screening can be processed through the data processing tool to obtain the transmission data corresponding to the service. The transmission data can refer to specific data of a transmission protocol used by the asset to provide the service.

[0058] In an implementable manner, the data processing tool can refer to Wireshark software or a network data acquisition and analysis tool; and the transmission protocol can include Hypertext Transfer Protocol (HTTP) and Transmission Control Protocol (TCP).

[0059] For example, if the transport protocol is HTTP, the transmitted data can be as follows: POST / login.php HTTP / 1.1\r\n#Name of the transport protocol Expert Info (Chat / Sequence): POST / login.php HTTP / 1.1\r\n POST / hacker.php HTTP / 1.1\r\n Severity level: Chat Request Method: POST#HTTP request method (HTTP Method) Request URI: / hacker.php Request Version: HTTP / 1.1 #HTTP header (HTTP header) User-Agent: Java / 1.8.0_112\r\n Host: 192.168.193.129:8080\r\n Accept: text / html, image / gif, image / jpeg, *; q=.2, * / *; q=.2\r\n Connection: keep-alive\r\n #HTTP body (HTTP body) Content-type: application / x-www-form-urlencoded\r\n#Payload information Content-Length: 633\r\n Content length: 633 Full request URI: http: / / 192.168.193.129 / hacker.php#URL address of the request HTTP request 1 / 1

[0060] Further, a session identifier carried in the transmission data can be taken as a reference, and a clustering algorithm can be used to group the obtained transmission data, i.e., data belonging to the same session in the transmission data is grouped into a group, and repeated data in each request group data is processed for deduplication according to attribute information of the network data, and then, data in each group of transmission data is arranged according to IP addresses and time sequence information to obtain a group of transmission data with context association, and then, a data analysis tool is used to process the obtained transmission data to obtain multiple different feature parameters corresponding to different services. It should be noted that the attribute information of the network data can include a source IP address, a destination IP address, a source port number, a destination port number, and a name of a transmission protocol, and the data analysis tool can refer to a PyShark module in Python. In an implementable manner, if the protocol corresponding to the service is the hypertext transfer protocol, the repeated data in each group of data needs to be deduplicated according to the attribute information of the network data, payload information in the HTTP header, and data in the HTTP body.

[0061] In the embodiments of the present application, different services and feature parameters corresponding thereto can be combined to form data for different services, and multiple data can be sent to a feature library in the knowledge base unit for storage.

[0062] Operation 202a2: The information determination device determines a target detection parameter for the service from multiple different feature parameters.

[0063] In the embodiments of the present application, the frequency of each feature parameter of the service in the transmission data can be counted, and the frequency of each feature parameter is compared with a preset threshold, and then, according to the comparison result, a feature parameter with a frequency higher than the preset threshold is selected from the multiple different feature parameters. In some embodiments, the feature parameter with the frequency higher than the preset threshold can be taken as the final detection parameter (i.e., the target detection parameter) for the service, and the feature parameter with the frequency lower than the preset threshold is directly discarded. It should be noted that the target detection parameter determined for different services can be different.

[0064] Operation 202b: The information determination device determines a target detection manner and a target detection type for the service.

[0065] The target detection type represents the type of data that can be detected.

[0066] In the embodiments of the present application, the target detection manner can refer to a manner of matching the target data and the data in the target database. In an implementable manner, the target detection manner can include a manner of matching by a regular expression, a manner of matching by global matching, and / or a manner of matching by a uniform resource locator (URL). The target detection type can include a string type and a text type.

[0067] It should be noted that the target detection manner also includes other matching manners, which are not limited here.

[0068] Operation 202c: The information determination device generates initial detection information based on the target detection parameter, the target detection manner, and the target detection type.

[0069] In an implementable manner, the initial detection information can be as shown in Table 1:

[0070] Table 1

[0071] In Table 1, the detection parameter is the target detection parameter, and includes a service name, a service version, a service description, and reference information of the service. The detection manner is the target detection manner, and includes three manners of a regular expression, global matching, and URL matching. The detection type is the target detection type, and includes a string type and a text type. It should be noted that the fields in the initial detection information can be increased or reduced according to different application scenarios, that is, the specific contents in the detection parameter, the detection manner, and the detection type can be increased or reduced accordingly, and the fields in the initial detection information can also be changed according to the user's demand.

[0072] For example, the specific code program of the initial detection information can be as follows:

[0073] matches[{:regexp=> / Development mode, devMode, enables extra\s+debugging behaviors and reports to assist developers. To disable this mode, set:\s+ <pre>\s+struts.devMode=false,:string=> "DevelopmentMode"}, {:search => "all", :version => 1, :text => 'org.apache.struts.'}, {:url => ' / ?actionErrors=notfoundnotfound', :regexp => / (Struts Problem Report|org.apache.struts2|struts.devMode|struts-tags|There is no Action mapped for namespace) / }]#detection mode (i.e., target detection mode) and detection type (i.e., target detection type)

[0074] Operation 203, the information determination device corrects the initial detection information based on the second data to obtain the target detection information.

[0075] In the embodiments of the present application, the second data can be first converted into second data in a specified format, and then the initial detection information is corrected according to the second data in the specified format to obtain the target detection information. In some embodiments, the information determination device can use the second data to verify the validity of the plurality of initial detection information generated, and determine the final target detection information according to the verification result. In some embodiments, the second data can be first processed by a data processing tool and a data analysis tool to obtain processed second data, and then the processed second data is matched with the data in the feature library according to the initial detection information, and the initial detection information is adjusted according to the matching result to obtain the final plurality of target detection information. It should be noted that the processed second data can include feature parameters of a plurality of different services, that is, when matching, the information determination device can match the processed second data with a plurality of different data in the feature library according to different initial detection information to determine a plurality of services.

[0076] In some embodiments, for the initial detection information with high matching frequency and high recognition rate, the detection parameters and detection methods in the initial detection information can be adjusted, and the adjusted initial detection information can be used as the target detection information. In an implementable manner, the initial detection information can be adjusted by reducing the extra wildcard characters in the regular expression. It should be noted that the matching frequency can refer to the ratio of the number of times a certain initial detection information is used in the matching process to the total number of times all initial detection information is used; the recognition rate can refer to the ratio of the number of initial detection information that can finally detect the service to the number of all initial detection information used in the matching process, and the high recognition rate can refer to the recognition rate being greater than 95%.

[0077] Correspondingly, for the initial detection information with high matching frequency and low recognition rate, the initial detection information can be merged or directly deleted; for the initial detection information with low matching frequency and high recognition rate, the initial detection information does not need to be changed and can be directly used as the target detection information; and for other initial detection information that is not used in the matching process, the initial detection information is directly deleted.

[0078] Operation 204, the information determining device obtains target data of the asset for the to-be-processed access request, and processes the target data to obtain processed target data.

[0079] In the embodiments of the present application, as shown in FIG. 3, the auxiliary unit can further include a request response module. In some embodiments, the information determining device can receive response data (i.e., target data) of the asset for the to-be-processed access request through the request response module in the auxiliary unit. Then, the target data obtained is formatted through the data initialization module, and the abnormal data in the formatted target data is filtered through the data cleaning module in the data processing unit. Then, the filtered target data is processed through the data processing tool and the data parsing tool to obtain processed target data with different characteristic parameters.

[0080] Operation 205, the information determining device performs matching processing on the processed target data and the data in the target database based on the target detection information.

[0081] In the embodiments of the present application, as shown in FIG. 3, the system corresponding to the information determining device can further include a knowledge base unit, and the knowledge base unit includes a feature library, a historical research and judgment library, and a classification knowledge base. The feature library is used to store data of different characteristic parameters of different services provided by different assets. The classification knowledge base is used to store service data indexed by each characteristic parameter of the service. The historical research and judgment library is used to analyze the target data that does not match the data in the target database, and store the analysis result.

[0082] In the embodiment of the present application, the target database can refer to the knowledge base unit in the system corresponding to the information determination device as shown in FIG. 3. Specifically, the information determination device can perform matching processing on the feature parameters of the processed target data and the feature parameters of the data in the feature library in the knowledge base unit (i.e., the target database) according to the target detection information through the service matching module in the data processing unit, and then determine the target service of the asset for the to-be-processed access request according to the matching result.

[0083] In the embodiment of the present application, operation 205 can be followed by operation 206 or operations 207-209.

[0084] Operation 206: If there is first matching data that matches all the different feature parameters of the processed target data in the target database, the information determination device determines the service corresponding to the first matching data as the target service.

[0085] In the embodiment of the present application, the data processing unit as shown in FIG. 3 can further include a service matching module. In some embodiments, the service matching module is configured to match the target data of the to-be-processed access request and the data in the target database. In some embodiments, if it is determined through the service matching module that the multiple feature parameters of the processed target data match the multiple feature parameters of a certain data in the feature library in the target database, the data is the matching data (i.e., the first matching data) that completely matches the target data, and the service corresponding to the first matching data can be determined as the target service. In an implementable manner, if the multiple feature parameters of the processed target data match the multiple feature parameters of multiple data in the target database, the service corresponding to each matching data can be determined as multiple target services of the to-be-processed access request.

[0086] Operation 207: If there is no matching data in the target database, the information determination device determines the number of feature parameters that do not match each feature parameter of the data in the target database among the different feature parameters.

[0087] In the embodiment of the present application, if there is no matching data in the feature library in the target database, the number of feature parameters that do not match the feature parameters of the data in the feature library can be determined from the multiple different feature parameters of the target data. In some embodiments, if there is no matching data that matches the multiple feature parameters of the processed target data in the feature library, i.e., the processed target data conflicts with the data in the feature library, the information determination device can divide the target data according to different feature parameters through the data classification module in the data processing unit as shown in FIG. 3 to obtain data corresponding to each feature parameter, and then determine the feature parameters that do not match the feature parameters of the data in the target database from the multiple feature parameters and determine the number of the feature parameters that do not match.

[0088] Operation 208, the information determining device determines a target value based on the number.

[0089] In the embodiments of the present application, the target value can refer to a conflict coefficient. In some embodiments, the information determining device can determine the number of target detection information used in the matching process, and then determine the target value according to the number of unmatched feature parameters and the number of target detection information used in the matching process. It should be noted that the conflict coefficient can represent the matching degree of the processed target data and the data in the target database.

[0090] In the embodiments of the present application, operation 208 can be followed by operation 209 or operations 210-211.

[0091] Operation 209, if the target value is less than or equal to a target threshold, the information determining device determines first to-be-matched data from the target database, and determines the service corresponding to the first to-be-matched data as the target service.

[0092] In the embodiments of the present application, after determining the target value, the target value can be compared with the target threshold. If the target value is less than or equal to the target threshold (i.e., the conflict coefficient is small), the information determining device can determine the data (i.e., the first to-be-matched data) indexed by the matched feature parameters from the classified knowledge base in the knowledge base unit (i.e., the target database), then calculate the similarity between the plurality of first to-be-matched data and the processed target data, and take the data with a similarity satisfying a threshold as the final first to-be-matched data, and finally take the service corresponding to the screened first to-be-matched data as the final target service to be determined. It should be noted that the target threshold is set according to historical data and actual application scenarios.

[0093] In one implementable manner, if the processed target data includes three feature parameters of service version, service port and service corresponding operating system, and there is no data matching the service version in the data of the feature library, the data indexed by the service port and the service corresponding operating system can be respectively screened from the classified knowledge base in the target database as shown in FIG. 3 as the first to-be-matched data, and the service corresponding to the first to-be-matched data is taken as the final target service. The data indexed by the service port not only includes the specific data of the service port, but also includes the specific data of the service version and the specific data of the service corresponding operating system. The data indexed by the service corresponding operating system also includes the specific data of the service corresponding operating system, the specific data of the service version and the specific data of the service port.

[0094] Operation 210, if the target value is greater than the target threshold, the information determining device determines second to-be-matched data from the target database based on the target value.

[0095] In the embodiment of the present application, if the target value is greater than the target threshold (i.e., the conflict coefficient is larger), it indicates that there is no first matching data in the classified knowledge base in the target database that matches the target data. At this time, the information determining device can select data with a target value close to the target value of the processed target data from the historical research and judgment base of the knowledge base unit (i.e., the target database) as second to-be-matched data according to the target value corresponding to each data in the historical research and judgment base. It should be noted that the second to-be-matched data can be multiple.

[0096] Operation 211, the information determining device matches the second to-be-matched data and the processed target data based on the target detection information.

[0097] In the embodiment of the present application, the service matching module in the data processing unit can match the characteristic parameters of the processed target data and the characteristic parameters of the second to-be-matched data according to the target detection information, and then determine the target service for the to-be-processed access request according to the matching result.

[0098] In the embodiment of the present application, operation 211 can be followed by operation 212 or operation 213.

[0099] Operation 212, if there is second matching data in the second to-be-matched data that matches the different characteristic parameters of the processed target data, the information determining device determines the service corresponding to the second matching data as the target service.

[0100] In the embodiment of the present application, if the characteristic parameters of a certain data in the second to-be-matched data match the different characteristic parameters of the processed target data, the information determining device will determine the service corresponding to the data (i.e., the second matching data) as the target service for the to-be-processed access request.

[0101] Operation 213, if there is no second matching data in the second to-be-matched data, the information determining device processes the processed target data using a target self-learning algorithm, obtains target characteristic information of the processed target data, and stores the target characteristic information into the target database.

[0102] In the embodiment of the present application, if there is still no second matching data in the second to-be-matched data that completely matches the characteristic parameters of the processed target data, the information determining device will use a self-learning algorithm to extract and learn the characteristics of the processed target data through the characteristic self-learning module in the data processing unit as shown in FIG. 3, that is, to mine the characteristics of the target service, obtain the target characteristic information of the processed target data, and store the target characteristic information in the characteristic library in the target database, to provide better data support for subsequent service detection.

[0103] In the embodiment of the present application, in the detection process of the service, if there is no service in the target database that matches the target data, the target data is detected again by calculating the target value, which significantly improves the accuracy of the detection of the target service.

[0104] In other embodiments of the present application, the operation 213 can be followed by the following operations:

[0105] Operation 214, the information determining device predicts the target access data of the asset based on the target data using a target time series model.

[0106] In the embodiment of the present application, the target time series model can be used to predict the access data of the asset in the future period (i.e., the target access data), the target access data can be data generated after the target access operation on the asset, and the target access data can include the access times of the asset, the login data of the user corresponding to the target access operation, and the address of the terminal corresponding to the target access operation. In one possible implementation manner, the target time series model can refer to an Auto-Regression and Moving Average (ARMA) model.

[0107] In the embodiment of the present application, the initial time series model can be trained to obtain the target time series model, and then the information determining device can input the target data into the target time series model. The target time series model can obtain the target access data of the asset after processing the target data for real-time access requests.

[0108] In the embodiment of the present application, as shown in FIG. 4, the target time series model can be obtained in the manner of A1-A4:

[0109] A1, obtain threat intelligence data and security information and event management (SIEM) logs of the asset. The SIEM logs can be collected by a SIEM system. The threat intelligence data can refer to potential or ongoing threat information to the asset. It should be noted that the information determination device can also obtain other information sources that obtain security information related to the asset from other channels.

[0110] In an implementable manner, the threat intelligence data of the asset can be as shown in Table 2:

[0111] Table 2

[0112] It should be noted that the threat intelligence data shown in Table 2 can include specific data of number, IP address, IP home location, reverse domain name information, label, intelligence data and request parameter, wherein the number can refer to the number of the threat event; the IP address can refer to the IP address of the threat event; the IP home location can refer to the specific home location of the IP address corresponding to the threat event; the reverse domain name information can refer to the domain name information of the physical device corresponding to the threat event; the label can refer to the type of the threat event; the intelligence data can refer to the time of the threat event, etc. The request data can refer to the information of the request message sent to the asset.

[0113] In an implementable manner, the SIEM logs of the asset can be as shown in Table 3:

[0114] Table 3

[0115] It should be noted that the SIEM logs shown in Table 3 include related data of the attack event to the asset. The number can refer to the number of the attack event; the attack time can refer to the time of the attack event; the attack source can refer to the IP address of the attack event; the attacked domain name can refer to the domain name information of the asset attacked by the attack event; the attack type can refer to the type of the attack event; the URL can refer to the website address corresponding to the attack event; the request parameter can refer to the region where the IP address corresponding to the attack event is located; the danger level can refer to the severity of the attack event; the processing action can refer to the processing manner of the asset to the attack event.

[0116] A2, process the historical running data to obtain an access list of the asset; in an implementable manner, the access list of the asset can be as shown in Table 4:

[0117] Table 4

[0118] It should be noted that the access list of the asset shown in Table 4 can refer to access data when the access operation is performed on the asset, wherein the access list can include the location of the asset, the name of the accessed application, the type of access data (data classification), the access information corresponding to the access data (sensitive information description), the importance of the access data (sensitive level), and the IP address of the terminal corresponding to the access operation.

[0119] A3, data formatting is performed on the access list, the SIEM log and the threat intelligence data to obtain formatted data in a unified format, and clustering operation and association operation are performed on the formatted data to associate the formatted data according to time sequence information of the data, to obtain sample data.

[0120] The sample data is data used for training the initial time sequence estimation model, and in some embodiments, the sample data can include the number of access operations performed on the asset in the past period of time, login data of the user performing the access operation on the asset, and the address of the terminal corresponding to the access operation.

[0121] A4, the initial time sequence model is trained using the sample data to obtain a target time sequence model.

[0122] In the embodiments of the present application, historical data in a pre-set database can be obtained, and the data is pre-processed to obtain processed data meeting the pre-set format requirements, and then the processed data is checked for sequence stationarity, if the processed data is stationary, an initial time sequence model meeting the expectation is constructed through autocorrelation function and partial autocorrelation function, combined with Akaike information criterion (AIC) and Bayesian Information Criterion (BIC), and if the processed data is not stationary, the processed data needs to be differentiated first, if the data obtained after the operation is stationary, the initial time sequence model can be directly constructed through autocorrelation, partial autocorrelation function, AIC criterion and BIC criterion, if the data obtained after the operation is still not stationary, the data needs to be differentiated continuously until the stationary data is obtained, and then the model can be constructed according to the stationary data, and then the initial time sequence model can be trained using the sample data to obtain a target time sequence model.

[0123] Operation 215, the information determination device generates a risk access policy of the asset for the to-be-processed access request based on the target access data.

[0124] In the embodiments of the present application, as shown in FIG. 4, the information determining device can generate an initial risk access strategy for the to-be-processed access request after determining the target access data of the asset, and then adjust the initial risk access strategy according to the existing historical access strategy to obtain the final risk access strategy. In an implementable manner, the initial risk access strategy can also be adjusted by combining the experience of experts at the same time.

[0125] Operation 216: The information determining device determines a risk evaluation result of the asset for the to-be-processed access request based on the risk access strategy, the target access data, and different characteristic parameters of the target service.

[0126] In the embodiments of the present application, as shown in FIG. 5, the information determining device can first determine a target risk value of the to-be-processed access request according to the target risk library, the target access data, and different characteristic parameters of the target service, and then determine a target trust degree of the to-be-processed access request, and then determine the final risk evaluation result by combining the target risk value, the target trust degree, and the generated risk access strategy.

[0127] In the embodiments of the present application, operation 216 can be implemented through operations 216a-216c.

[0128] Operation 216a: The information determining device determines a target risk value of the to-be-processed access request based on the target access data, different characteristic parameters of the target service, and the target risk library.

[0129] In the embodiments of the present application, the information determining device can determine a first risk value of a user corresponding to the target access operation and a second risk value of a terminal corresponding to the target access operation according to the target access data and the target risk library, and then determine a third risk value of the target service according to different characteristic parameters of the target service and the target risk library, and finally multiply the first risk value, the second risk value, and the third risk value by corresponding weights respectively to obtain the final target risk value of the to-be-processed access request. It should be noted that the target risk library is set in advance according to an actual application scenario; and the weights can be set according to historical data and an actual application scenario.

[0130] Operation 216b: The information determining device determines a target trust degree of the to-be-processed access request.

[0131] The target trust degree can refer to a degree of trust of the asset for the to-be-processed access request.

[0132] In the embodiments of the present application, the information determining device can determine a target trust degree of the asset for the to-be-processed access request from the target information library. It should be noted that the target information library is set in advance according to an actual application scenario.

[0133] The operation 216c is that the information determination device determines a risk evaluation result of the asset for the to-be-processed access request based on the risk access policy, the target risk value and the target trust degree.

[0134] In the embodiment of the present application, the information determination device can determine the risk evaluation result of the asset for the to-be-processed access request in combination with the generated risk access policy, the target risk value of the to-be-processed access request and the target trust degree of the to-be-processed access request.

[0135] The information determination method provided by the embodiment of the present application can generate target detection information for all services provided by the asset according to the data of multiple dimensions of the asset, and the target service of the asset for the to-be-processed access request is determined in combination with the target detection information and the target data of the asset for the to-be-processed access request, which realizes that the data of each dimension of the asset is considered when the target detection information for the service is generated, so that the generated target detection information can detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection in the related art.

[0136] Based on the foregoing embodiment, the embodiment of the present application provides an information determination device, which can be applied to the information determination method provided by the embodiments corresponding to FIGS. 1-2. Referring to FIG. 6, the information determination device 3 can include an acquisition unit 31, a processing unit 32 and a determination unit 33, wherein:

[0137] The acquisition unit 31 is configured to acquire historical running data of an asset in a network system, first data of the asset for historical access requests and second data of the asset for a target access request.

[0138] The processing unit 32 is configured to generate target detection information for a service based on the historical running data, the first data and the second data, wherein the service is a service provided by the asset.

[0139] The determination unit 33 is configured to acquire target data of the asset for a to-be-processed access request, and determine a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information.

[0140] In other embodiments of the present application, the processing unit 32 is further configured to perform the following operations:

[0141] Generate initial detection information for the service based on the historical running data and the first data.

[0142] Correct the initial detection information based on the second data to obtain the target detection information.

[0143] In other embodiments of the present application, the processing unit 32 is further configured to perform the following operations:

[0144] determine a target detection parameter for the service based on the historical operation data and the first data;

[0145] determine a target detection manner and a target detection type for the service; wherein the target detection type represents a type of data that can be detected;

[0146] generate initial detection information based on the target detection parameter, the target detection manner and the target detection type.

[0147] In other embodiments of the present application, the processing unit 32 is further configured to perform the following operations:

[0148] process the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service;

[0149] determine a target detection parameter for the service from the plurality of different characteristic parameters.

[0150] In other embodiments of the present application, the determining unit 33 is further configured to perform the following operations:

[0151] process the target data to obtain processed target data;

[0152] match the processed target data with data in the target database based on the target detection information;

[0153] if there is first matching data in the target database that matches each characteristic parameter of the processed target data, determine that the service corresponding to the first matching data is the target service.

[0154] In other embodiments of the present application, the determining unit 33 is further configured to perform the following operations:

[0155] if there is no matching data in the target database, determine the number of characteristic parameters in the different characteristic parameters that do not match each characteristic parameter of the data in the target database;

[0156] determine a target value based on the number;

[0157] if the target value is less than or equal to a target threshold, determine first to-be-matched data from the target database, and determine that the service corresponding to the first to-be-matched data is the target service.

[0158] In other embodiments of the present application, the determining unit 33 is further configured to perform the following operations:

[0159] if the target value is greater than the target threshold, determine second to-be-matched data from the target database based on the target value;

[0160] based on the target detection information, performing matching processing on the second to-be-matched data and the processed target data;

[0161] If there is second matching data that matches the different characteristic parameters in the second to-be-matched data, it is determined that the service corresponding to the second matching data is the target service.

[0162] If there is no second matching data in the second to-be-matched data, the target self-learning algorithm is used to process the processed target data, to obtain target characteristic information of the processed target data and store the target characteristic information into the target database.

[0163] In other embodiments of the present application, the determining unit 33 is further configured to perform the following operations:

[0164] based on the target data, using a target time series model to predict target access data of the asset;

[0165] generating a risk access strategy of the asset for the to-be-processed access request based on the target access data;

[0166] based on the risk access strategy, the target access data, and the different characteristic parameters of the target service, determining a risk assessment result of the asset for the to-be-processed access request.

[0167] In other embodiments of the present application, the determining unit 33 is further configured to perform the following operations:

[0168] based on the target access data, the different characteristic parameters of the target service, and the target risk library, determining a target risk value of the to-be-processed access request;

[0169] determining a target trust degree of the to-be-processed access request;

[0170] based on the risk access strategy, the target risk value, and the target trust degree, determining a risk assessment result of the asset for the to-be-processed access request.

[0171] It should be noted that the specific description of the operations performed by each unit can refer to the information determination method provided in the corresponding embodiments of FIGS. 1-2, and will not be described here.

[0172] The information determination apparatus provided by the embodiments of the present application can generate target detection information for all services provided by the asset according to the data of multiple dimensions of the asset, and the target service of the asset for the to-be-processed access request is determined in combination with the target detection information and the target data of the asset for the to-be-processed access request, so that the data of each dimension of the asset is considered when the target detection information for the service is generated, so that the generated target detection information can detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection in the related art.

[0173] Based on the foregoing embodiments, the embodiments of the present application provide an information determination device, which can be applied to the information determination method provided by the embodiments corresponding to FIGS. 1-2. Referring to FIG. 7, the information determination device 4 can include a processor 41, a memory 42, and a communication bus 43, wherein:

[0174] The communication bus 43 is configured to realize the communication connection between the processor 41 and the memory 42;

[0175] The processor 41 is configured to execute an information determination program in the memory 42 to realize the following operations:

[0176] Obtain historical running data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests;

[0177] Generate target detection information for a service based on the historical running data, the first data, and the second data, wherein the service is a service provided by the asset;

[0178] Obtain target data of the asset for a to-be-processed access request, and determine a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information.

[0179] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to generate target detection information for a service based on historical running data, first data, and second data, to realize the following operations:

[0180] Generate initial detection information for the service based on the historical running data and the first data;

[0181] Correct the initial detection information based on the second data to obtain the target detection information.

[0182] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to determine the target detection parameter for the service based on the historical running data and the first data, to generate the initial detection information for the service, so as to achieve the following operations:

[0183] determine the target detection parameter for the service based on the historical running data and the first data;

[0184] determine the target detection mode and the target detection type for the service; wherein the target detection type represents the type of the data that can be detected;

[0185] generate the initial detection information based on the target detection parameter, the target detection mode and the target detection type.

[0186] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to determine the target detection parameter for the service based on the historical running data and the first data, to generate the initial detection information for the service, so as to achieve the following operations:

[0187] process the historical running data and the first data to obtain a plurality of different characteristic parameters of the service;

[0188] determine the target detection parameter for the service from the plurality of different characteristic parameters.

[0189] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to determine the target service for the asset to the to-be-processed access request from the target database based on the target data and the target detection information, so as to achieve the following operations:

[0190] process the target data to obtain processed target data;

[0191] match the processed target data with the data in the target database based on the target detection information;

[0192] if there is first matching data in the target database that matches the different characteristic parameters of the processed target data, determine the service corresponding to the first matching data as the target service.

[0193] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42, so as to achieve the following operations:

[0194] if there is no matching data in the target database, determine the number of characteristic parameters that do not match each characteristic parameter of the data in the target database from the different characteristic parameters;

[0195] determine the target value based on the number;

[0196] If the target value is less than or equal to the target threshold, the first to-be-matched data is determined from the target database, and the service corresponding to the first to-be-matched data is determined as the target service.

[0197] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to implement the following operations:

[0198] If the target value is greater than the target threshold, the second to-be-matched data is determined from the target database based on the target value;

[0199] Based on the target detection information, the second to-be-matched data and the processed target data are matched;

[0200] If there is second matching data that matches different characteristic parameters in the second to-be-matched data, the service corresponding to the second matching data is determined as the target service;

[0201] If there is no second matching data in the second to-be-matched data, the target self-learning algorithm is used to process the processed target data, and the target characteristic information of the processed target data is obtained and stored in the target database.

[0202] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to implement the following operations:

[0203] Based on the target data, the target time series model is used to predict the target access data of the asset;

[0204] Based on the target access data, the risk access strategy of the asset for the to-be-processed access request is generated;

[0205] Based on the risk access strategy, the target access data, and different characteristic parameters of the target service, the risk assessment result of the asset for the to-be-processed access request is determined.

[0206] In other embodiments of the present application, the processor 41 is configured to execute the information determination program in the memory 42 to implement the following operations:

[0207] Based on the target access data, different characteristic parameters of the target service, and the target risk library, the target risk value of the to-be-processed access request is determined;

[0208] The target trust degree of the to-be-processed access request is determined;

[0209] Based on the risk access strategy, the target risk value, and the target trust degree, the risk assessment result of the asset for the to-be-processed access request is determined.

[0210] It should be noted that the specific description of the operations performed by the processor can refer to the information determination method provided in the corresponding embodiments of FIGS. 1-2, which will not be described here.

[0211] The information determination device provided by the embodiments of the present application can generate target detection information for all services provided by the asset according to data of multiple dimensions of the asset, and the target service of the asset for the to-be-processed access request is determined in combination with the target detection information and target data of the asset for the to-be-processed access request, so that the data of each dimension of the asset is considered when the target detection information for the service is generated, so that the generated target detection information can detect different services in different scenarios, rather than only detecting specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection in the related art when performing service detection.

[0212] Based on the foregoing embodiments, the embodiments of the present application provide a computer readable storage medium storing one or more programs, which can be executed by one or more processors to implement the operations of the information determination method provided by the embodiments corresponding to FIGS. 1-2.

[0213] Based on the foregoing embodiments, the embodiments of the present application provide a computer program product including a computer program that, when executed by a processor 41, implements the operations of the information determination method provided by the embodiments corresponding to FIGS. 1-2.

[0214] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the present application can be in the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer usable program code.

[0215] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more flows in the flowcharts and / or one or more blocks in the block diagrams.

[0216] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0217] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0218] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.< / pre>

Claims

1. An information determination method comprising: obtaining historical running data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests; generating target detection information for a service based on the historical running data, the first data, and the second data, wherein the service is a service provided by the asset; obtaining target data of the asset for a to-be-processed access request, and determining a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information.

2. The method of claim 1, wherein, The generating of the target detection information for the service based on the historical running data, the first data, and the second data comprises: generating initial detection information for the service based on the historical running data and the first data; correcting the initial detection information based on the second data to obtain the target detection information.

3. The method of claim 2, wherein, The generating of the initial detection information for the service based on the historical running data and the first data comprises: determining a target detection parameter for the service based on the historical running data and the first data; determining a target detection manner and a target detection type for the service, wherein the target detection type represents a type of data that can be detected; generating the initial detection information based on the target detection parameter, the target detection manner, and the target detection type.

4. The method of claim 3, wherein, The determining of the target detection parameter for the service based on the historical running data and the first data comprises: processing the historical running data and the first data to obtain a plurality of different characteristic parameters of the service; determining the target detection parameter for the service from the plurality of different characteristic parameters.

5. The method of claim 1, wherein, The determining of the target service of the asset for the to-be-processed access request from the target database based on the target data and the target detection information comprises: processing the target data to obtain processed target data; performing matching processing on the processed target data and data in the target database based on the target detection information; if there is first matching data in the target database that matches different characteristic parameters of the processed target data, determining a service corresponding to the first matching data as the target service.

6. The method of claim 5, wherein, The method further comprises: if there is no matching data in the target database, determining a number of characteristic parameters in the different characteristic parameters that do not match each characteristic parameter of data in the target database; determining a target value based on the number; if the target value is less than or equal to a target threshold, determining first to-be-matched data from the target database, and determining a service corresponding to the first to-be-matched data as the target service.

7. The method of claim 6, wherein, The method further comprises: if the target value is greater than the target threshold, determining second to-be-matched data from the target database based on the target value; performing matching processing on the second to-be-matched data and the processed target data based on the target detection information; If the second matching data matching the different characteristic parameters exist in the second to-be-matched data, it is determined that the service corresponding to the second matching data is the target service; If the second matching data do not exist in the second to-be-matched data, a target self-learning algorithm is used to process the processed target data, to obtain target characteristic information of the processed target data and store the target characteristic information into the target database.

8. The method of claim 1, wherein, The method further comprises: Based on the target data, a target time sequence model is used to predict target access data of the asset; Based on the target access data, a risk access strategy of the asset for the to-be-processed access request is generated; Based on the risk access strategy, the target access data and different characteristic parameters of the target service, a risk assessment result of the asset for the to-be-processed access request is determined.

9. The method of claim 8, wherein, The determination of the risk assessment result of the asset for the to-be-processed access request based on the risk access strategy, the target access data and different characteristic parameters of the target service comprises: Based on the target access data, different characteristic parameters of the target service and a target risk library, a target risk value of the to-be-processed access request is determined; A target trust degree of the to-be-processed access request is determined; Based on the risk access strategy, the target risk value and the target trust degree, the risk assessment result of the asset for the to-be-processed access request is determined.

10. The method of claim 2, wherein, The correction of the initial detection information based on the second data to obtain the target detection information comprises: The second data is format-converted to convert the second data into second data in a specified format; The initial detection information is corrected based on the second data in the specified format to obtain the target detection information.

11. The method of claim 4, wherein, The processing of the historical running data and the first data to obtain a plurality of different characteristic parameters of the service comprises: The historical running data and the first data are format-converted to convert the historical running data and the first data into data in a specified format; The format-converted data is processed to obtain transmission data corresponding to the service; The transmission data is processed to obtain a plurality of different characteristic parameters of the service.

12. The method of claim 4, wherein, The determination of the target detection parameter for the service from the plurality of different characteristic parameters comprises: The frequency of occurrence of each characteristic parameter of the service in the transmission data is counted; The frequency of each characteristic parameter is compared with a preset threshold value; Based on the comparison result, a characteristic parameter with a frequency higher than the preset threshold value is selected from the plurality of different characteristic parameters.

13. The method of claim 4, wherein, The plurality of characteristic parameters of the service comprise a service name, an operating system corresponding to the service, port information corresponding to the service, middleware providing the service, application plug-ins and basic information of application components.

14. The method of claim 1, wherein, The to-be-processed access request comprises a real-time access request for a network device, and the target data comprises response data of the asset for the to-be-processed access request.

15. The method of claim 1, wherein, The asset includes a network device deployed in a network system, the historical operation data includes historical security logs of the network device, the first data includes historical data of the network device in the network system collected for various service access requests, and the second data includes response data of the network device in the network system collected for specific access requests.

16. The method of claim 1, wherein, The target detection information includes detection parameters, specific detection manners, and types of detectable data required for detecting the service. 17.An information determination apparatus, comprising: an acquisition unit configured to acquire historical operation data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests; a processing unit configured to generate target detection information for a service based on the historical operation data, the first data, and the second data, wherein the service is a service provided by the asset; a determination unit configured to acquire target data of the asset for a to-be-processed access request, and determine a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information.

18. An information determining apparatus comprising: a processor, a memory, and a communication bus; the communication bus is configured to realize communication connection between the processor and the memory; the processor is configured to execute an information determination program in the memory to realize the operation of the information determination method in any one of claims 1-16. 19.A computer-readable storage medium storing one or more programs executable by one or more processors to perform operations of the information determination method in any one of claims 1-16.

20. A computer program product comprising a computer program, wherein, The computer program, when executed by a processor, realizes the information determination method according to any one of claims 1-16.

Images