Enterprise IP asset identification method and electronic device

Abstract

Embodiments of the present application disclose an enterprise IP asset identification method and an electronic device. A graph is constructed by combining website data and historical data stored in PDNS data; on the basis of the constructed graph, a target search path using a target domain name corresponding to an enterprise to be identified as a source node and an IP as a terminal node is determined; on the basis of a first feature vector of each node in a pre-stored graph, and a pre-trained asset sequence classification model, a target feature vector of each target node in the target search path is inputted into the asset sequence classification model, and whether the IP and the target domain name belong to a same enterprise asset is determined, thereby implementing the identification of an enterprise IP asset. Thus, a plurality of historical data source IPs in a complex network environment are effectively integrated, thereby ensuring the comprehensiveness and accuracy of IP asset identification.

Description

A method and electronic device for identifying enterprise IP assets

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411612647.X, filed on November 13, 2024, entitled "A Method and Electronic Device for Identifying Enterprise IP Assets", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of network asset management technology, and in particular to a method and electronic device for identifying enterprise IP assets. Background Technology

[0004] In the modern competition for network assets, the identification and expansion of corporate IP assets are crucial, directly impacting brand protection and market competitiveness. With the increasing complexity and variability of the network environment, enterprises face ever-growing risks of cyberattacks and information leaks. Therefore, timely and comprehensive identification and management of corporate IP assets has become a vital task for ensuring corporate security and competitive advantage.

[0005] Existing methods for identifying enterprise IP assets primarily rely on website data to search and match enterprise IP assets. Only when the matching information is completely consistent can it be determined whether an IP asset belongs to the enterprise. However, if some historical source IPs on the website belong to the enterprise but do not completely match the search information, it is impossible to accurately identify that the IP asset belongs to the enterprise. Therefore, in complex network environments, this method cannot effectively integrate and utilize multiple historical source IPs on a website, thus affecting the comprehensiveness and accuracy of IP asset identification. Summary of the Invention

[0006] This application provides a method and electronic device for identifying enterprise IP assets, in order to solve the problem of the inability to fully identify enterprise IP assets.

[0007] Firstly, a method for identifying enterprise IP assets is provided, the method comprising:

[0008] Obtain the target identification information of the target enterprise to be identified; determine the target domain name corresponding to the target identification information based on the correspondence between each enterprise identification information in the Internet Content ICP database record and the first domain name;

[0009] Based on the search paths in the pre-constructed graph, a target search path is determined with the target domain name as the source node and the IP address as the termination node; wherein, the graph is constructed based on website data and PDNS data;

[0010] Based on the first feature vector of each node that is saved in advance, the target feature vector of each target node in the target search path is determined; the target feature vector of each target node is input into the pre-trained asset sequence classification model, and the IP and the target domain name are determined based on the asset sequence classification model to determine whether they belong to the same enterprise asset.

[0011] Furthermore, the process of pre-constructing the map includes:

[0012] Based on the enterprise identification information and their corresponding first domain name recorded in the ICP database, as well as the network database and the Domain Name System (DNS) database, determine the website data and PDNS data of each enterprise;

[0013] A graph structure is constructed using the website data and PDNS data of each enterprise as nodes;

[0014] Based on the pre-saved search relationships between nodes in the graph structure, the search path from each source node to the terminal node in the graph structure is determined, and a graph is constructed based on each search path.

[0015] Furthermore, using the website data and PDNS data of each enterprise as nodes, the graph structure is constructed as follows:

[0016] For each of the aforementioned enterprises, using the enterprise's website data and PDNS data as nodes, a subgraph structure for each enterprise is constructed according to preset connection rules.

[0017] For each enterprise's subgraph structure, nodes of type domain name or IP address in the subgraph structure are designated as the first nodes to be connected.

[0018] The graph structure is constructed by connecting different subgraph structures based on the same first node to be connected.

[0019] Furthermore, the PDNS data includes: a second domain name, at least one third domain name corresponding to the second domain name, and a first IP address corresponding to each of the second domain name and the at least one third domain name; the website data includes: a Uniform Resource Locator URL, a fourth domain name, a certificate cert, and a second IP address;

[0020] Constructing the subgraph structure of the enterprise according to preset connection rules includes:

[0021] The second domain name is connected to the at least one third domain name; the second domain name and the at least one third domain name are respectively connected to their corresponding first IP addresses; the Uniform Resource Locator (URL) is connected to the fourth domain name, the certificate (cert), and the second IP address.

[0022] Use data of type domain name or IP in PDNS data and website data as the second node to be connected; connect the same second node to be connected to construct the subgraph structure.

[0023] Furthermore, the process of pre-saving the first feature vector of each node includes:

[0024] Determine the initial feature vector of each node in the graph;

[0025] For each search path in the graph, each sub-search path of the search path is determined according to a preset sliding window;

[0026] For each sub-search path, the initial feature vectors of the nodes in the sub-search path other than the central node are summed to obtain a second feature vector; the second feature vector is input into a vector prediction model, and a predicted feature vector is determined based on the vector prediction model; a first loss value is determined based on the predicted feature vector and the initial feature vector of the central node; the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the central node are updated based on the first loss value and the model parameter update algorithm to obtain a first feature vector of the nodes other than the central node.

[0027] Furthermore, the process of pre-training the asset sequence classification model includes:

[0028] Based on each search path in the pre-constructed graph, determine the sample search path; based on the first feature vector of each node in the pre-saved first feature vector, determine the first feature vector of each sample node in the sample search path;

[0029] The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained. The confidence of the enterprise affiliation of the sample search path is predicted based on the asset sequence classification model. A second loss value is determined based on the enterprise affiliation label and the enterprise affiliation confidence value. The asset sequence classification model is trained based on the second loss value.

[0030] Furthermore, the confidence level of the enterprise affiliation predicted based on the asset sequence classification model for the sample search path includes:

[0031] Based on the asset sequence classification model, the first feature vector of each sample node is averaged and pooled to obtain the third feature vector; the confidence of the enterprise affiliation of the sample search path is predicted based on the third feature vector.

[0032] Furthermore, before training the asset sequence classification model based on the second loss value, the method further includes:

[0033] The type labels of each sample node are input into the asset sequence classification model to be trained. Based on the type extraction subnetwork in the asset sequence classification model, the first feature vector of each sample node is extracted to obtain the first type feature vector of each sample node. The type confidence of each sample node is predicted based on the first type feature vector of each sample node. The third loss value is determined based on the type label and the type confidence of each sample node.

[0034] Training the asset sequence classification model based on the second loss value includes:

[0035] The sum of the second loss value and the third loss value is determined, and the sum is updated to the second loss value. The asset sequence classification model is then trained based on the updated second loss value.

[0036] Further, predicting the type confidence of each sample node based on the first type feature vector of each sample node includes:

[0037] For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain the second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted based on the updated first type feature vector of the sample node.

[0038] Secondly, an apparatus for identifying enterprise IP assets is provided, the apparatus comprising:

[0039] The processing module is used to obtain the target identification information of the target enterprise to be identified;

[0040] The determination module is used to determine the target domain name corresponding to the target identifier information based on the correspondence between each enterprise identifier information in the Internet Content ICP database records and the first domain name; determine the target search path with the target domain name as the source node and the IP as the termination node based on each search path in the pre-constructed graph; wherein, the graph is constructed based on website data and PDNS data; determine the target feature vector of each target node in the target search path based on the first feature vector of each node that is pre-saved; input the target feature vector of each target node into a pre-trained asset sequence classification model, and determine whether the IP and the target domain name belong to the same enterprise asset based on the asset sequence classification model.

[0041] Furthermore, the determining module is specifically used to determine the website data and PDNS data of each enterprise based on the enterprise identification information and their corresponding first domain name recorded in the ICP database, as well as the network database and the Domain Name System (DNS) database.

[0042] The processing module is specifically used to construct a graph structure using the website data and PDNS data of each enterprise as nodes; determine the search path from each source node to the terminal node in the graph structure according to the pre-saved search relationship between each node in the graph structure; and construct a graph based on each search path.

[0043] Furthermore, the processing module is specifically used to construct a subgraph structure for each enterprise, using the enterprise's website data and PDNS data as nodes, according to preset connection rules; for each enterprise's subgraph structure, to take nodes of type domain name or IP in the subgraph structure as first nodes to be connected; and to connect different subgraph structures according to the same first nodes to be connected, thereby constructing the graph structure.

[0044] Further, the processing module is specifically used to connect the second domain name to the at least one third domain name; connect the second domain name and the at least one third domain name to their respective first IP addresses; connect the Uniform Resource Locator (URL) to the fourth domain name, the certificate (cert), and the second IP address; use data of type domain name or IP address from the PDNS data and website data as second nodes to be connected; connect identical second nodes to be connected to construct the subgraph structure.

[0045] Furthermore, the determining module is specifically used to determine the initial feature vector of each node in the graph; and for each search path in the graph, to determine each sub-search path of the search path according to a preset sliding window.

[0046] The processing module is specifically configured to, for each sub-search path, add the initial feature vectors of the nodes other than the central node in the sub-search path to obtain a second feature vector; input the second feature vector into a vector prediction model, and determine a predicted feature vector based on the vector prediction model; determine a first loss value based on the predicted feature vector and the initial feature vector of the central node; and update the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the central node based on the first loss value and a model parameter update algorithm to obtain a first feature vector of the nodes other than the central node.

[0047] Furthermore, the determining module is specifically used to determine the sample search path based on each search path in the pre-constructed graph; and to determine the first feature vector of each sample node in the sample search path based on the first feature vector of each node that is pre-saved.

[0048] The processing module is specifically used to input the first feature vector of each sample node and the enterprise affiliation label of the sample search path into the asset sequence classification model to be trained; predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model; determine the second loss value according to the enterprise affiliation label and the enterprise affiliation confidence; and train the asset sequence classification model according to the second loss value.

[0049] Furthermore, the processing module is specifically used to perform mean pooling on the first feature vector of each sample node based on the asset sequence classification model to obtain a third feature vector; and to predict the confidence level of the enterprise affiliation of the sample search path based on the third feature vector.

[0050] Furthermore, the processing module is also used to input the type labels of each sample node into the asset sequence classification model to be trained, extract features from the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model to obtain the first type feature vector of each sample node; predict the type confidence of each sample node based on the first type feature vector of each sample node; determine the third loss value based on the type label and the type confidence of each sample node; and train the asset sequence classification model based on the second loss value, including: determining the sum of the second loss value and the third loss value, updating the sum to the second loss value, and training the asset sequence classification model based on the updated second loss value.

[0051] Further, the processing module is specifically used to concatenate the first type feature vector of the sample node with the first type feature vector of the previous sample node to obtain a second type feature vector; update the second type feature vector to the first type feature vector of the sample node; and predict the type confidence of the sample node based on the updated first type feature vector of the sample node.

[0052] Thirdly, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0053] The memory is used to store computer programs;

[0054] When the processor executes the program stored in the memory, it implements the method described in any of the above-mentioned embodiments.

[0055] Fourthly, a computer-readable storage medium is provided, wherein a computer program or instructions are stored therein, which, when executed by a communication device, implement the method described in any of the preceding claims.

[0056] Fifthly, a computer program product is provided, the computer program product comprising: computer program code, which, when run on a computer, implements the method described in any of the preceding embodiments.

[0057] In this embodiment, a graph is constructed using website data and PDNS data. Based on this graph, a target search path is determined, with the target domain name corresponding to the enterprise to be identified as the source node and the IP address as the termination node. According to the first feature vector of each node in the pre-saved graph, and based on a pre-trained asset sequence classification model, the target feature vector of each target node in the target search path is input into the asset sequence classification model to determine whether the IP address and the target domain name belong to the same enterprise asset, thereby achieving the identification of the enterprise's IP assets. Compared to searching and matching enterprise IP assets based on website data, where the IP asset can only be determined to belong to the enterprise when the matching information is completely consistent, this application, by combining historical data stored in PDNS data and constructing a graph based on website data, comprehensively obtains the historical source IP addresses of the data in the website data. This effectively integrates multiple historical source IP addresses in complex network environments, thereby ensuring the comprehensiveness and accuracy of IP asset identification. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 is a schematic diagram of an enterprise IP asset identification process provided in an embodiment of this application;

[0060] Figure 2 is a schematic diagram of a process for constructing a map according to an embodiment of this application;

[0061] Figure 3 is a schematic diagram of the spectral structure provided in an embodiment of this application;

[0062] Figure 4 is a schematic diagram of a construction diagram structure provided in an embodiment of this application;

[0063] Figure 5 is a schematic diagram of the process of training the first feature vector of each node according to an embodiment of this application;

[0064] Figure 6 is a schematic diagram of the specific process of training the first feature vector of each node according to an embodiment of this application;

[0065] Figure 7 is one of the schematic diagrams of a process for training an asset sequence classification model according to an embodiment of this application;

[0066] Figure 8 is a schematic diagram of a specific process for training an asset sequence classification model according to an embodiment of this application;

[0067] Figure 9 is a second schematic diagram of the process of training an asset sequence classification model according to an embodiment of this application;

[0068] Figure 10 is a schematic diagram of the overall process of the IP asset identification method provided in the embodiments of this application;

[0069] Figure 11 is a schematic diagram of a device structure for identifying enterprise IP assets provided in an embodiment of this application;

[0070] Figure 12 is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0071] To make the objectives and implementation methods of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the exemplary embodiments described are only some embodiments of this application, and not all embodiments.

[0072] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0073] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0074] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0075] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0077] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be obtained based on the above teachings. The selection and description of the above embodiments are for the purpose of better explaining the principles and practical applications, thereby enabling those skilled in the art to better utilize the described embodiments and various different variations of embodiments suitable for specific use considerations.

[0078] Example 1:

[0079] Figure 1 is a schematic diagram of an enterprise IP asset identification process provided in an embodiment of this application. The process includes the following steps:

[0080] S101: Obtain the target identification information of the target enterprise to be identified.

[0081] The enterprise IP asset identification method provided in this application is applied to electronic devices, such as computers (PCs), servers, etc.

[0082] Electronic devices acquire identification information of the enterprise to be identified, such as the enterprise name and organization code. This application does not limit the process of acquiring the target identification information of the target enterprise to be identified. For example, the target identification information of the target enterprise to be identified may be input by the user.

[0083] S102: Based on the correspondence between each enterprise identification information in the Internet Content ICP database and the first domain name, determine the target domain name corresponding to the target identification information.

[0084] The ICP database records all the information provided by each website during the registration process. Specifically, the ICP database contains all the information of each enterprise during registration, such as the enterprise identifier, enterprise domain name, and enterprise production address. Therefore, based on the ICP database, the domain name corresponding to the target identifier information of the enterprise to be identified can be obtained. The first domain name refers to the main domain name corresponding to the enterprise's target identifier information in the ICP database; therefore, the target domain name is the main domain name corresponding to the target identifier information of the enterprise to be identified.

[0085] A domain name is a unique identifier for a website on the internet, such as xxxx.com. A domain name allows for quick lookup and access to the corresponding website. Users enter the domain name into their browser, and the Domain Name System (DNS) maps the domain name to an IP address, thus opening the website.

[0086] S103: Based on the search paths in the pre-built graph, determine the target search path with the target domain name as the source node and the IP address as the termination node; wherein, the graph is constructed based on website data and PDNS data.

[0087] PDNS data refers to data in the DNS database, including: the second domain name, at least one third domain name corresponding to the second domain name, and the first IP address corresponding to each of the second domain name and at least one third domain name. Specifically, the second domain name refers to the enterprise's main domain name, the at least one third domain name corresponding to the second domain name refers to at least one historical subdomain name corresponding to the main domain name, and the first IP address corresponding to each of the second domain name and at least one third domain name refers to the IP address corresponding to each of the main domain name and at least one historical subdomain name.

[0088] Website data refers to data in a network database, including: Uniform Resource Locator (URL), fourth domain name, certificate (cert), and second IP address.

[0089] In this embodiment, URLs are constructed by adding prefixes to the second and third domain names. Specifically, the second domain name is prefixed with either "http: / / " or "https: / / ", for example, http: / / +second domain name or https: / / +second domain name. Similarly, the third domain name is prefixed with either http: / / or https: / / , for example, http: / / +third domain name or https: / / +third domain name. By performing web crawling on each constructed URL, the fourth domain name, certificate (cert), and second IP address corresponding to each URL in the website data are obtained.

[0090] Using data information such as URL, second domain, third domain, fourth domain, cert, first IP, and second IP as nodes, all nodes in the graph are connected according to preset connection rules, and each search path in the graph is determined according to preset search rules.

[0091] The preset connection rules refer to connection rules such as URL connecting to a fourth domain, URL connecting to cert, URL connecting to a second IP, and second domain connecting to a third domain; the preset lookup rules refer to lookup rules such as domain looking up IP, IP looking up URL, and URL looking up IP.

[0092] A search path refers to the path through which one piece of data can be found.

[0093] The pre-built graph contains nodes composed of data information such as URL, second domain name, third domain name, fourth domain name, cert, first IP, second IP, etc., and multiple search paths composed of search relationships between different nodes.

[0094] In the pre-constructed graph of this application, each search path has a different source node or a different termination node. The source node of each search path is the first node in the search path in the search direction. The termination node of each search path is the last node in the search path in the search direction. The number of nodes contained in each search path can be the same or different.

[0095] Based on the target domain name determined in step 102, which is the main domain name of the enterprise to be identified, a search path is found in the pre-constructed graph that uses the target domain name as the source node and any IP address as the termination node. In this embodiment, the search path for the enterprise to be identified in the pre-constructed graph may be one or multiple. For example, for enterprise a to be identified, if the domain name a corresponding to the target identification information of enterprise a to be identified is connected to termination nodes IP1, IP2, and IP3 respectively in the pre-constructed graph, then enterprise a to be identified has three target search paths: the search path from domain name a to IP1, the search path from domain name a to IP2, and the search path from domain name a to IP3.

[0096] S104: Determine the target feature vector of each target node in the target search path based on the first feature vector of each node that has been saved in advance.

[0097] When identifying enterprise IP assets, a first feature vector is obtained based on the pre-saved data content of each node, serving as the first feature vector for that node. Based on the pre-saved first feature vector of each node, the target feature vector of each target node in the target search path is then obtained.

[0098] S105: Input the target feature vector of each target node into the pre-trained asset sequence classification model, and determine whether the IP and target domain name belong to the same enterprise asset based on the asset sequence classification model.

[0099] The electronic device is pre-deployed with a trained asset sequence classification model. This model can calculate the target feature vector of each target node in the input target search path and output a "yes" or "no" result. Based on the output of the asset sequence classification model, it determines whether the IP address of the terminating node and the target domain name of the source node in the input target search path belong to the same enterprise asset.

[0100] The source node of the target search path is the domain name information of the target enterprise. If the asset sequence classification model outputs "yes", it proves that the IP of the terminal node in the target search path and the target domain name of the source node belong to the same enterprise asset, that is, the IP of the terminal node is the IP asset of the target enterprise. If the asset sequence classification model outputs "no", it means that the IP of the terminal node in the target search path and the target domain name of the source node do not belong to the same enterprise asset, that is, the IP of the terminal node is not the IP asset of the target enterprise.

[0101] In this embodiment, a graph is constructed using website data and PDNS data. Based on this graph, a target search path is determined, with the target domain name corresponding to the enterprise to be identified as the source node and the IP address as the termination node. According to the first feature vector of each node in the pre-saved graph, and based on a pre-trained asset sequence classification model, the target feature vector of each target node in the target search path is input into the asset sequence classification model to determine whether the IP address and the target domain name belong to the same enterprise asset, thereby achieving the identification of the enterprise's IP assets. Compared to searching and matching enterprise IP assets based on website data, where the IP asset can only be determined to belong to the enterprise when the matching information is completely consistent, this application, by combining historical data stored in PDNS data and constructing a graph based on website data, comprehensively obtains the historical source IP addresses of the data in the website data. This effectively integrates multiple historical source IP addresses in complex network environments, thereby ensuring the comprehensiveness and accuracy of IP asset identification.

[0102] Example 2:

[0103] To integrate various historical source IPs in complex network environments and ensure the comprehensiveness of IP asset identification, this application combines historical data stored in PDNS data and pre-constructs a graph based on website data. Figure 2 is a schematic diagram of a graph construction process provided by an embodiment of this application, which includes the following steps:

[0104] S201: Based on the enterprise identification information and their corresponding first domain name recorded in the ICP database, as well as the network database and the Domain Name System (DNS) database, determine the website data and PDNS data of each enterprise.

[0105] Based on the ICP database, the corresponding primary domain name of each enterprise is determined through its identification information; based on the Domain Name System (DNS) database, the multiple historical subdomains corresponding to each primary domain name and the IP addresses corresponding to each domain name are determined through the primary domain name, which is the PDNS data; based on the network database, the website data of each enterprise is obtained through the primary domain name and multiple historical subdomains.

[0106] Specifically, the website data and PDNS data of each enterprise are obtained through the following steps:

[0107] (1) Collect a large amount of corporate identification information, such as company names.

[0108] (2) Input each enterprise identification information into the ICP database to obtain the main domain name registered by each enterprise.

[0109] (3) Input each main domain name into the DNS database to obtain the historical subdomains of each main domain name and the IP address corresponding to each main domain name and each historical subdomain, wherein each main domain name has at least one historical subdomain.

[0110] Specifically, PDNS data includes two types of data information: each enterprise's main domain name, at least one historical subdomain corresponding to the main domain name, and the IP addresses corresponding to the main domain name and the historical subdomains, respectively.

[0111] (4) Construct URLs by adding the prefix http: / / or https: / / to each main domain and each historical subdomain. For example, URLs constructed by http: / / +main domain, URLs constructed by https: / / +main domain, URLs constructed by http: / / +historical subdomains, and URLs constructed by https: / / +historical subdomains.

[0112] (5) Based on the network database, web crawlers are used to obtain website data of various enterprises from the constructed URLs.

[0113] Specifically, website data includes four types of data information: URL, fourth domain, certificate (cert), and second IP.

[0114] S202: Construct a graph structure using the website data and PDNS data of each enterprise as nodes.

[0115] According to the preset connection rules, for each enterprise, four types of data information—website URL, fourth domain, certificate (cert), and second IP—are used as nodes and connected to obtain different edges. Specifically, the URL node is used as the center to connect the other three nodes: the URL connects to the fourth domain, the URL connects to the certificate (cert), and the URL connects to the second IP.

[0116] For each enterprise, PDNS data includes the enterprise's main domain name, at least one historical subdomain corresponding to the main domain name, and the IP addresses corresponding to the main domain name and historical subdomains. These two types of data information are used as nodes and connected to obtain different edges. Specifically, the connection method is as follows: the main domain name is connected to the IP address corresponding to the main domain name; historical subdomains are connected to the IP addresses corresponding to historical subdomains, i.e., the "A / AAAA" IP records of each domain name corresponding to each identifier in a physical sense; the main domain name is connected to historical subdomains, i.e., the pointing relationships between domain names recorded in alias records (CNAME). In one possible implementation, when the IP address corresponding to a historical subdomain is the same as the IP address corresponding to the main domain name, the historical subdomain is connected to the IP address corresponding to the main domain name.

[0117] As shown in the leftmost figure of Figure 3, website data and PDNS data are stored in the same graph structure using different types of nodes and different edges. The graph structure includes four types of nodes: domain name, URL, cert, and IP, as well as different connection edges determined according to different connection methods.

[0118] S203: Based on the pre-saved search relationships between nodes in the graph structure, determine the search path from each source node to the terminal node in the graph structure, and construct the graph based on each search path.

[0119] For different types of nodes, define the lookup relationships between nodes in the graph structure. Specifically: for PDNS data, the main domain is used to find historical subdomains, and each domain is used to find its corresponding IP; for website data, the fourth domain / certificate / second IP is used to find the URL, the URL is used to find the fourth domain / second IP, and the fourth domain is used to find the cert.

[0120] In this embodiment, starting from any node as the source node, the source node may have multiple search paths. For ease of explanation, as shown in the second from the left of Figure 3, after the PDNS data and website data are connected, the search relationships between the main types of nodes in the graph structure are as follows: domain name to domain name, domain name to IP address, domain name / cert / IP address to URL, URL to domain name / IP address, and domain name to cert / IP address.

[0121] In this embodiment, based on the ICP database, the corresponding first domain name of each enterprise is determined through its identification information; based on the Domain Name System (DNS) database, multiple historical subdomains corresponding to each first domain name and the IP addresses corresponding to each domain name are determined through the corresponding first domain name, which constitutes PDNS data; based on the network database, website data of each enterprise is obtained through the first domain name and multiple historical subdomains. Integrating website data and PDNS data into the same graph and establishing lookup relationships between them not only integrates multiple historical source IPs in complex network environments, ensuring the comprehensiveness of IP asset identification, but also makes IP asset lookup simple and fast when using the graph.

[0122] Example 3:

[0123] This application provides a comprehensive and complete graph for enterprise IP asset identification. When constructing the graph structure, website data and PDNS data from multiple enterprises were collected. The embodiments of this application clearly illustrate the connection methods of website data and PDNS data between different enterprises.

[0124] Figure 4 is a schematic diagram of a construction diagram structure provided in an embodiment of this application. The process includes the following steps:

[0125] S401: For each enterprise, using the enterprise's website data and PDNS data as nodes, construct the enterprise's subgraph structure according to preset connection rules.

[0126] The preset connection rules are the same as those in step 202 above, and will not be repeated here.

[0127] A subgraph structure refers to the graph structure of each enterprise, which consists of each enterprise's website data and PDNS data.

[0128] S402: For each enterprise's subgraph structure, select the node of type domain name or IP address in the subgraph structure as the first node to be connected.

[0129] The subgraph structure contains website data and PDNS data from the same company. Based on the data types in the website data and PDNS data from the same company, four types of nodes are identified: domain name, IP address, URL, and cert. Connection edges are determined based on the connection rules between different types of nodes.

[0130] The first node to be connected refers to a node in the subgraph structure that is of type either a domain name or an IP address. In other words, the first node to be connected can be either a domain name or an IP address.

[0131] S403: Connect different subgraph structures based on the same first node to be connected to construct a graph structure.

[0132] For every two subgraph structures, identify the first node to be connected that has the same data content in the two subgraph structures, and connect the first node to be connected that has the same data content respectively, so that the subgraph structures of different enterprises are stored in the same graph structure.

[0133] For example, (1) For subgraph structure a of enterprise A and subgraph structure b of enterprise B, it is identified that domain name 1 and domain name 2 exist in subgraph structure a, and domain name 1 and domain name 2 also exist in subgraph structure b. Then, these two domain name 1 and two domain name 2 are the same first nodes to be connected in these two subgraph structures. At this time, the two domain name 1 will be connected and the two domain name 2 will be connected to obtain a constructed graph structure. (2) For subgraph structure a of enterprise A and subgraph structure b of enterprise B, it is identified that IP1 and IP2 exist in subgraph structure a, and IP1 and IP2 also exist in subgraph structure b. Then, these two IP1 and two IP2 are the same first nodes to be connected in these two subgraph structures. At this time, the two IP1 will be connected and the two IP2 will be connected to obtain a constructed graph structure. (3) For subgraph structure a of enterprise A and subgraph structure b of enterprise B, it is found that domain name 1 and IP 2 exist in subgraph structure a, and domain name 1 and IP 2 also exist in subgraph structure b. Then, these two domain name 1 and two IP 2 are the same first nodes to be connected in these two subgraph structures. At this time, the two domain name 1 will be connected and the two IP 2 will be connected to obtain a constructed graph structure.

[0134] In one possible implementation, in order to make the constructed graph structure data simple and clear, when connecting the subgraph structures between different enterprises, this application retains only one of the two first nodes to be connected that have the same identified data content, and then connects the subgraph structures of different enterprises.

[0135] Example 4:

[0136] This application provides a comprehensive and complete graph for enterprise IP asset identification. When constructing the graph structure, website data and PDNS data of the same enterprise are collected. This application's embodiments illustrate how website data and PDNS data among enterprises can be connected and used to construct sub-graph structures.

[0137] As can be seen from step 201 above, PDNS data includes: the second domain name, at least one third domain name corresponding to the second domain name, and the first IP address corresponding to each of the second domain name and at least one third domain name. Website data includes: Uniform Resource Locator (URL), fourth domain name, certificate (cert), and second IP address.

[0138] As can be seen from step 202 above, the preset connection rules include: the second domain name is connected to at least one third domain name; the second domain name and at least one third domain name are respectively connected to the corresponding first IP; the Uniform Resource Locator (URL) is respectively connected to the fourth domain name, the certificate (cert), and the second IP.

[0139] For the same enterprise, data of type domain name or IP in PDNS data and website data are used as the second nodes to be connected; the same second nodes to be connected are connected to construct the subgraph structure.

[0140] In other words, for PDNS data and website data of the same enterprise, you can choose to first connect the PDNS data according to preset connection rules to obtain a PDNS data graph; and then connect the website data according to preset connection rules to obtain a website data graph. Based on these two data graphs, identify the second nodes to be connected that have the same data content in the PDNS data graph and the website data graph, and connect these second nodes with the same data content respectively, so that the PDNS data graph and the website data graph of the same enterprise are stored in the same subgraph structure.

[0141] For example, (1) For the PDNS data graph and website data graph of enterprise A, it is found that domain name 1 and domain name 2 exist in the PDNS data graph and the website data graph. Then, these two domain name 1 and two domain name 2 are the same second nodes to be connected in the PDNS data graph and the website data graph. At this time, the two domain name 1 will be connected and the two domain name 2 will be connected to obtain the subgraph structure constructed by enterprise A. (2) For the PDNS data graph and website data graph of enterprise A, it is found that IP1 and IP2 exist in the PDNS data graph and the website data graph. Then, these two IP1 and two IP2 are the same second nodes to be connected in the PDNS data graph and the website data graph. At this time, the two IP1 will be connected and the two IP2 will be connected to obtain the subgraph structure constructed by enterprise A. (3) For the PDNS data graph and website data graph of enterprise A, it is found that there are domain name 1 and IP 2 in the PDNS data graph and there are also domain name 1 and IP 2 in the website data graph. Then, these two domain name 1 and two IP 2 are the same second nodes to be connected in the PDNS data graph and the website data graph. At this time, the two domain name 1 will be connected and the two IP 2 will be connected to obtain the subgraph structure constructed by enterprise A.

[0142] In one possible implementation, to make the constructed graph structure data simple and clear, when making graph structure connections between the same enterprise, this application retains only one of the two second nodes to be connected that have the same identified data content, and then connects the PDNS data and website data of the same enterprise to obtain the sub-graph structure of that enterprise.

[0143] Example 5:

[0144] To address the challenge of effectively integrating and utilizing multiple data source IPs within a website in complex network environments, this application integrates PDNS data and website data into a graph, and trains the feature vector of each node in the graph based on the co-occurrence of nodes. Figure 5 is a schematic diagram illustrating the process of training the first feature vector of each node according to an embodiment of this application. This process includes the following steps:

[0145] S501: Determine the initial feature vectors of each node in the graph.

[0146] The feature vectors of all nodes in the constructed graph are randomly initialized to obtain the initial feature vectors of each node in the graph.

[0147] S502: For each search path in the graph, determine each sub-search path of the search path according to the preset sliding window.

[0148] Combining the graph constructed in step 203 with the connection rules and search relationships in step 202, the search path is obtained, as shown in the third from the left in Figure 3. The graph structure contains a search path of domain name—domain name—cert—URL—IP—URL—cert. The co-occurrence of each node in this search path is used for modeling.

[0149] When determining the sub-search paths of the search path, the size of the sliding window is fixed, for example, the sliding window is 5, the sliding window is 3, etc.

[0150] For the obtained search path, multiple sub-search paths are determined based on a preset sliding window. For example, if the search path contains 7 nodes named abcdefg, and the preset sliding window is 5, then the sub-search paths are abcde, bcdef, and cdefg.

[0151] S503: For each sub-search path, add the initial feature vectors of the nodes in the sub-search path except for the central node to obtain the second feature vector.

[0152] The central node is the node at the very center of a search path. The central node is hidden in each sliding window. Figure 6 illustrates a specific process for training the first feature vector of each node, as provided in this embodiment. For sub-search paths within the same search path, the position of the removed central node in each sub-search path should be consistent. For example, if search path A contains 7 nodes (abcdefg) and the preset sliding window is 5, then the sub-search paths are abcde, bcdef, and cdefg. For sub-search paths abcde, bcdef, and cdefg, the initial feature vectors of the intermediate node c, d, and e are removed respectively. After removing the initial feature vector of the central node, the initial feature vectors of the remaining nodes are summed to obtain the second feature vector.

[0153] In one possible implementation, the central node can also be a non-central node. In this case, for sub-search paths within the same search path, the position of the removed central node should also be consistent in each sub-search path. For example, if search path A contains 7 nodes named abcdefg, and the preset sliding window is 5, then the sub-search paths are abcde, bcdef, and cdefg. If sub-search path abcde removes the initial feature vector of the second node 'b' when removing the initial feature vector of the middle node, then sub-search path bcdef also removes the initial feature vector of the second node 'c' when removing the initial feature vector of the middle node. Similarly, sub-search path cdefg also removes the initial feature vector of the second node 'd' when removing the initial feature vector of the middle node. After removing the initial feature vectors of the non-central nodes, the initial feature vectors of the remaining nodes are added together to obtain the second feature vector.

[0154] S504: Input the second feature vector into the vector prediction model, and determine the predicted feature vector based on the vector prediction model.

[0155] The second feature vector is input into the fully connected layer of the vector prediction model for feature extraction to obtain the predicted feature vector.

[0156] S505: Determine the first loss value based on the predicted feature vector and the initial feature vector of the center node.

[0157] Based on the predicted feature vector obtained in step 404 and the initial feature vector of the hidden node within the sliding window, a first loss value is calculated using the cross-entropy loss function. This first loss value represents the difference between the predicted feature vector and the initial feature vector of the center node.

[0158] S506: Based on the first loss value and the model parameter update algorithm, update the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the center node to obtain the first feature vectors of the nodes other than the center node.

[0159] The model parameter update algorithm can be gradient descent, Newton's method, etc., and the specific model parameter update algorithm used is not limited here.

[0160] Gradient descent is performed using the cross-entropy loss function to update the model parameters of the vector prediction model and the initial feature vectors of nodes other than the center node, resulting in the first feature vectors of the nodes other than the center node. Based on the first sliding window, the updated model parameters and the first feature vectors of the nodes other than the center node are adjusted. When updating in the second sliding window, the updated first feature vectors of the nodes in the second sliding window are used as the initial feature vectors to execute step 503 and subsequent steps.

[0161] In one possible implementation, for each sliding window, the model parameters are adjusted and updated based on the initial feature vector of each node, and the first feature vector of each node is updated.

[0162] Based on a preset target value of loss, this application's embodiments update the initial feature vector of each node in the constructed graph through iterative training, thereby obtaining the first feature vector of all nodes in the graph.

[0163] In this embodiment, the data of nodes in the graph is initialized, and a sliding window is set for each search path in the graph to determine sub-search paths. A loss value is calculated based on the predicted feature vectors of surrounding nodes in the sub-search paths and the feature vector of the hidden center node. The model parameters are adjusted and the first feature vectors of nodes other than the center node are updated according to the loss value and the model parameter update algorithm. The first feature vector of each node in the graph is obtained through iterative training. The first feature vector of each node in the graph effectively integrates the problem of various historical source IPs from the website.

[0164] Example 6:

[0165] To facilitate rapid identification of an enterprise's IP assets, this application also pre-trains an asset sequence classification model that can be directly identified. Figure 7 is a schematic diagram of one of the processes for training an asset sequence classification model provided in an embodiment of this application, which includes the following steps:

[0166] S701: Determine the sample search path based on the search paths in the pre-constructed map.

[0167] The sample search path includes positive sample search paths and negative sample search paths. A positive sample search path is one that uses the domain name of the company to be identified as the source node and the company's IP address as the termination node. A negative sample search path is one that uses the domain name of the company to be identified as the source node and an IP address that is not the company as the termination node. Optionally, the number of positive sample search paths obtained in this application is greater than the number of negative sample search paths.

[0168] By using the ICP database, we obtain the company's domain name information and known company IPs. Based on these domain names and known company IPs, we determine positive sample search paths in the constructed graph, with the company's domain name as the source node and the company's IP as the termination node. Similarly, based on the domain name and known company IPs that are not belonging to the company, we determine negative sample search paths in the constructed graph, with the company's domain name as the source node and other company IPs as termination nodes.

[0169] S702: Determine the first feature vector of each sample node in the sample search path based on the first feature vector of each node that has been saved in advance.

[0170] Based on the first feature vector of each node in the graph, the first feature vector of each sample node in each sample search path is obtained. The above embodiment has already described the process of determining the first feature vector of each node in the graph, and will not be repeated here.

[0171] S703: Input the first feature vector of each sample node and the enterprise affiliation label of the sample search path into the asset sequence classification model to be trained, and predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model.

[0172] The enterprise affiliation label for the sample search path is 0 or 1. When the input sample search path is a positive sample search path, the enterprise affiliation label is 1; when the input sample search path is a negative sample search path, the enterprise affiliation label is 0.

[0173] The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained. For each input sample search path, the asset sequence classification model outputs the predicted enterprise affiliation confidence score of that sample search path. The predicted enterprise affiliation confidence score of the sample search path is a value between 0 and 1.

[0174] S704: Determine the second loss value based on the enterprise affiliation label and the enterprise affiliation confidence level; train the asset sequence classification model based on the second loss value.

[0175] Based on the enterprise affiliation labels and confidence levels, a second loss value is calculated using the cross-entropy loss function. The model parameters of the asset sequence classification model are then adjusted according to this second loss value. The asset sequence classification model is iteratively trained by inputting the first feature vectors of each node along the search path using multiple samples. The trained asset sequence classification model is obtained when the loss value reaches a preset target loss value, or when the number of training iterations meets a preset target value.

[0176] In this embodiment, the trained asset sequence classification model (AssetSeqNet) can directly determine whether the IP assets of the enterprise to be identified belong to that enterprise. Compared to searching first and then matching information, this method is faster and simpler, improving the speed of enterprise IP asset identification.

[0177] Example 7:

[0178] This application embodiment fully illustrates the process of predicting the enterprise affiliation confidence of the sample search path based on the asset sequence classification model in the above embodiment.

[0179] The confidence level for predicting enterprise affiliation relationships in sample lookup paths based on asset sequence classification models includes:

[0180] Based on the asset sequence classification model, the first feature vector of each sample node is averaged and pooled to obtain the third feature vector; the confidence of the enterprise affiliation of the sample search path is predicted based on the third feature vector.

[0181] As shown in Figure 8, the input to the asset sequence classification model is the first feature vector of each sample node in the sample search path. The asset sequence classification model performs mean pooling on the output of the first feature vector of each node in the sample search path to obtain the third feature vector.

[0182] The third feature vector represents the feature vector of the entire sample search path. This feature vector obtains its logit value through the fully connected layer of the neural network in the asset sequence classification model and the sigmoid activation function. This refers to the confidence level of the enterprise affiliation in the predicted sample search path.

[0183] Using the confidence level of enterprise affiliation And the label y, determine the cross-entropy loss function, the specific formula is: Based on this cross-loss function, the second loss value Lcls in step 704 of the above embodiment is calculated.

[0184] Example 8:

[0185] To better integrate the acquired PDNS data and network data, this application also performs relationship modeling on the node type of each node. Figure 9 is a second schematic diagram of a process for training an asset sequence classification model provided in an embodiment of this application, which includes the following steps:

[0186] S901: Input the type label of each sample node into the asset sequence classification model to be trained, and extract features from the first feature vector of each sample node based on the type extraction sub-network in the asset sequence classification model to obtain the first type feature vector of each sample node.

[0187] Labels "0" and "1" are assigned to different sample node types. For example, when calculating the type loss value of a node type of domain name, the label for domain name is "1", and the label for other types is "0"; when calculating the type loss value of a node type of IP address, the label for IP address is "1", and the label for other types is "0"; when calculating the type loss value of a node type of URL, the label for URL address is "1", and the label for other types is "0"; when calculating the type loss value of a node type of cert, the label for cert address is "1", and the label for other types is "0".

[0188] The first feature vector of each node in the sample search path is input into the asset sequence classification model. Based on the type extraction sub-network in the asset sequence classification model, features are extracted from the first feature vector of each sample node to obtain the first type feature vector of each sample node. The type extraction sub-network can be either a recurrent neural network (RNN) or a convolutional neural network (CNN), with no limitation on which.

[0189] The first type of feature vector is a feature vector related to the type of each sample node.

[0190] S902: Predict the type confidence of each sample node based on the first type feature vector of each sample node.

[0191] The first-type feature vector of each sample node is predicted using an asset sequence classification model. The confidence level of the predicted type for each sample node is then calculated. () is a value between 0 and 1.

[0192] S903: Determine the third loss value based on the type label and type confidence of each sample node.

[0193] Based on the type labels of each sample node input in step 901 and the type confidence of each sample node predicted in step 902. Based on cross-entropy loss function Calculate the third loss value Lpos for each type in each sample node.

[0194] S904: Training the asset sequence classification model based on the second loss value includes: determining the sum of the second loss value and the third loss value, updating the sum as the second loss value, and training the asset sequence classification model based on the updated second loss value.

[0195] Step 704 above, training the asset sequence classification model based on the second loss value, includes: adding the second loss value Lcls and the third loss value Lpos for the type of each sample node in the sample search path to obtain a new second loss value L. all Specifically Where i represents the i-th sample search path, N is the total number of sample search paths, and j represents the j-th node of the i-th sample search path, which has L nodes. The asset sequence classification model is trained using the updated second loss value.

[0196] In this embodiment, when training the asset sequence classification model, the relationship between the source and terminal nodes in the search path is modeled, and the type of each node in the search path is modeled. By extracting the type feature vector of each node in the sample search path, a third loss value is calculated for the type feature vector of each node. By calculating and summing the double loss values ​​of the first feature vector and the first type feature vector of each sample node, the model parameters of the asset sequence classification model are adjusted based on the summed loss value. This ensures both the modeling of the overall features of each sample node and the modeling of the type features of each sample node, effectively capturing the dependencies between the types of each sample node in the sample search path, thereby enhancing the robustness and predictive ability of the asset sequence classification model.

[0197] Example 9:

[0198] This application embodiment fully illustrates the process of predicting the type confidence of each sample node based on the first type feature vector of each sample node in the above embodiment 8.

[0199] For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain the second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted based on the updated first type feature vector of the sample node.

[0200] In this embodiment, the types of each node in the sample search path influence each other, and the asset sequence classification model models the type of each node in the sample search path. The asset sequence classification model concatenates the first type feature vector of the current position with the first type feature vector of the previous position, and uses the new type feature vector obtained after concatenation as the first type feature vector of the current position.

[0201] For example, as shown in Figure 8, the sample lookup path is Domain Name → Domain Name → cert → URL → IP. When modeling the type of each node, the type of each sample node in the sample lookup path is only related to the type of the previous sample node. That is, the asset sequence classification model first initializes a type feature vector. When modeling the type of each node, the asset sequence classification model concatenates the initialized type feature vector with the first type feature vector of the first position node "domain name" to obtain a concatenated first type feature vector, and updates this concatenated first type feature vector as the first type feature vector of the first position node "domain name"; it concatenates the first type feature vector of the second position node "domain name" with the first type feature vector of the first position node "domain name" to obtain a concatenated first type feature vector, and updates this concatenated first type feature vector as the first type feature vector of the second position node "domain name"; and it concatenates the first type feature vector of the third position node "cert" with the first type feature vector of the second position node "domain name". The first type feature vectors of the third position node "cert" are concatenated to obtain a concatenated first type feature vector, which is then updated to the first type feature vector of the third position node "cert". The first type feature vectors of the fourth position node "URL" and the third position node "cert" are concatenated to obtain a concatenated first type feature vector, which is then updated to the first type feature vector of the fourth position node "URL". The first type feature vectors of the fifth position node "IP" and the fourth position node "URL" are concatenated to obtain a concatenated first type feature vector, which is then updated to the first type feature vector of the fifth position node "IP".

[0202] When updating the first-type feature vector at each node in the sample search path, the electronic device performs concatenation calculations based on the first-type feature vector extracted by the type extraction sub-network in the asset sequence classification model. In one possible implementation, the electronic device may perform concatenation calculations based on the first-type feature vector updated at the previous node.

[0203] The updated first-type feature vectors of the sample nodes are input into the fully connected layer and sigmoid activation function of the asset sequence classification model to obtain the logit value. This refers to the type confidence of the predicted sample nodes. The type confidence of the predicted sample nodes is classified into 4 categories to obtain the type confidence of each sample node. For example, the type confidence of the label being a domain name, the type confidence of the label being an IP address, the type confidence of the label being a URL, and the type confidence of the label being cert.

[0204] Based on the confidence level and label of each type, the cross-entropy loss function is determined, and the specific formula is as follows: The cross-entropy loss function is used to calculate the third loss value in step 903 above.

[0205] Example 10:

[0206] Figure 10 is a schematic diagram of the overall process of the IP asset identification method provided in the embodiments of this application.

[0207] (1) Data acquisition process, which is step 201 above.

[0208] Specifically: 1) Company Name Collection: Collect a large amount of company identification information, such as company names. 2) ICP Data Acquisition of Main Domains: Input each company's identification information into the ICP database to obtain the main domain name registered by each company. 3) DNS-Based Acquisition of Historical Subdomains: Input each main domain name into the DNS database to obtain the historical subdomains of each main domain name and the corresponding IP addresses for each main domain name and each historical subdomain. Each main domain name has at least one historical subdomain. 4) Website Crawling: Based on the web database, perform web crawling on the constructed URLs to obtain website data for each company.

[0209] (2) The map training process, namely steps 202, 203 and Example 5 above.

[0210] Specifically: 1) Decompose website data and DNS data into multiple features, each feature corresponding to a node. This is step 202 in the above embodiment, and will not be repeated here. 2) Construct a graph using the nodes. This is step 203 in the above embodiment, and will not be repeated here. 3) Select paths based on a rule-based random walk strategy: Determine the search path from each source node to the terminal node in the graph structure according to the pre-saved search relationships between nodes in the graph structure. 4) Construct a classification model based on the co-occurrence of nodes. 5) Complete the training of nodes in the graph database. This is embodiment 5 above, and will not be repeated here.

[0211] (3) IP asset expansion process, namely steps 701, 704 and Example 8 above.

[0212] Specifically: 1) Obtain the enterprise's main domain name based on ICP data and enterprise name. This is step 701 in the above embodiment and will not be repeated here. 2) Multiple paths can be selected using the enterprise domain name as the source node and the IP address as the termination node (positive samples). This is step 701 in the above embodiment and will not be repeated here. 3) Multiple paths can be selected using any node as the source node and the IP address as the termination node (negative samples). This is step 701 in the above embodiment and will not be repeated here. 4) Model the relationship between the source and termination nodes in the sequence using the node feature vectors in the graph. This is step 704 in the above embodiment and will not be repeated here. 5) Simultaneously, the type of each node in the sequence is also modeled. This is embodiment 8 above and will not be repeated here.

[0213] In practice, this application can be implemented and applied in multiple scenarios, and specific embodiments are listed below:

[0214] 1. Enterprise network asset management and visualization

[0215] Step 1: Collect domain name, ICP data, PDNS data, and website crawler data.

[0216] Step 2: Construct a graph using PDNS data and website data, and train the feature vector for each node in the graph; use the graph eigenvectors to train AssetSeqNet.

[0217] Step 3: Input any company name and obtain the company's domain name based on ICP data. Find the node of this domain name in the graph, using this domain name node as the source node and the IP nodes that can be connected as the termination node. Input the paths of the source node and the termination node into AssetSeqNet. AssetSeqNet outputs whether the termination node and the source node belong to the same company's assets.

[0218] Step 4: Provide the identified IP assets to the company's security experts. The security experts will then manage the IP assets and visualize their connectivity. This will allow the company to understand the status and distribution of network assets in real time, improving the efficiency of security monitoring.

[0219] One important application of enterprise IP asset identification technology in cybersecurity is enterprise network asset management and visualization. By using this technology, enterprises can comprehensively discover and identify their various IP assets within the network. This technology supports the classification and tagging of assets, helping enterprises distinguish between important and less important assets and assess their exposed risks. This process can reveal potential vulnerabilities and threats, supporting enterprises in developing more precise and effective security strategies. Simultaneously, through visualization, enterprises can understand the status and distribution of network assets in real time, improving the efficiency of security monitoring.

[0220] 2. Compliance Audit

[0221] Step 1: Collect domain name, ICP data, PDNS data, and website crawler data.

[0222] Step 2: Construct a graph using PDNS data and website data, and train the feature vector for each node in the graph; use the graph eigenvectors to train AssetSeqNet.

[0223] Step 3: Input any company name and obtain the company's domain name based on ICP data. Find the node of this domain name in the graph, using this domain name node as the source node and the IP nodes that can be connected as the termination node. Input the paths of the source node and the termination node into AssetSeqNet. AssetSeqNet outputs whether the termination node and the source node belong to the same company's assets.

[0224] Step 4: By identifying IP assets, promptly discover unauthorized or high-risk devices to ensure that all network assets operate within compliance limits and reduce potential legal and financial risks due to violations.

[0225] In compliance audits, enterprise IP asset identification technology can be used to enhance the effectiveness of risk control and compliance audits. This technology can automatically scan the enterprise network, promptly identifying unauthorized or high-risk devices, ensuring all network assets operate within compliance limits. This timely detection and identification helps enterprises proactively identify issues during the audit process, reducing human error and mitigating compliance risks arising from the failure to detect non-compliant devices in a timely manner. Furthermore, continuous asset discovery and monitoring ensures that the enterprise remains compliant, reducing potential legal and financial risks associated with violations.

[0226] Example 11:

[0227] Based on the same application concept, this application provides an apparatus for identifying enterprise IP assets. Figure 11 is a schematic diagram of the structure of an enterprise IP asset identification apparatus provided in this application. Referring to Figure 11, the apparatus includes:

[0228] Processing module 1101 is used to obtain target identification information of the target enterprise to be identified;

[0229] The determination module 1102 is used to determine the target domain name corresponding to the target identification information based on the correspondence between each enterprise identification information in the Internet Content ICP database record and the first domain name; to determine the target search path with the target domain name as the source node and the IP as the termination node based on each search path in the pre-constructed graph; wherein, the graph is constructed based on website data and PDNS data; to determine the target feature vector of each target node in the target search path based on the first feature vector of each node that is pre-saved; and to input the target feature vector of each target node into a pre-trained asset sequence classification model, and to determine whether the IP and the target domain name belong to the same enterprise asset based on the asset sequence classification model.

[0230] Furthermore, the determining module 1102 is specifically used to determine the website data and PDNS data of each enterprise based on the enterprise identification information and their corresponding first domain name recorded in the ICP database, as well as the network database and the Domain Name System (DNS) database.

[0231] The processing module 1101 is specifically used to construct a graph structure using the website data and PDNS data of each enterprise as nodes; determine the search path from each source node to the terminal node in the graph structure according to the pre-saved search relationship between each node in the graph structure, and construct a graph based on each search path.

[0232] Furthermore, the processing module 1101 is specifically used to construct a subgraph structure for each enterprise, using the enterprise's website data and PDNS data as nodes, according to preset connection rules; for each enterprise's subgraph structure, to take nodes of type domain name or IP in the subgraph structure as first nodes to be connected; and to connect different subgraph structures according to the same first nodes to be connected, thereby constructing the graph structure.

[0233] Further, the processing module 1101 is specifically used to connect the second domain name to the at least one third domain name; connect the second domain name and the at least one third domain name to their respective first IP addresses; connect the Uniform Resource Locator (URL) to the fourth domain name, the certificate (cert), and the second IP address; use data of type domain name or IP address from the PDNS data and website data as second nodes to be connected; connect identical second nodes to be connected to construct the subgraph structure.

[0234] Furthermore, the determining module 1102 is specifically used to determine the initial feature vector of each node in the graph; and for each search path in the graph, to determine each sub-search path of the search path according to a preset sliding window.

[0235] The processing module 1101 is specifically configured to, for each sub-search path, add the initial feature vectors of the nodes other than the central node in the sub-search path to obtain a second feature vector; input the second feature vector into a vector prediction model, and determine a predicted feature vector based on the vector prediction model; determine a first loss value based on the predicted feature vector and the initial feature vector of the central node; and update the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the central node based on the first loss value and the model parameter update algorithm to obtain a first feature vector of the nodes other than the central node.

[0236] Further, the determining module 1102 is specifically used to determine the sample search path according to each search path in the pre-constructed graph; and to determine the first feature vector of each sample node in the sample search path according to the first feature vector of each node that is pre-saved.

[0237] The processing module 1101 is specifically used to input the first feature vector of each sample node and the enterprise affiliation label of the sample search path into the asset sequence classification model to be trained; predict the enterprise affiliation confidence of the sample search path based on the asset sequence classification model; determine a second loss value based on the enterprise affiliation label and the enterprise affiliation confidence; and train the asset sequence classification model based on the second loss value.

[0238] Further, the processing module 1101 is specifically used to perform mean pooling on the first feature vector of each sample node based on the asset sequence classification model to obtain a third feature vector; and to predict the confidence level of the enterprise affiliation of the sample search path based on the third feature vector.

[0239] Further, the processing module 1101 is also used to input the type labels of each sample node into the asset sequence classification model to be trained, extract features from the first feature vector of each sample node based on the type extraction subnetwork in the asset sequence classification model to obtain the first type feature vector of each sample node; predict the type confidence of each sample node based on the first type feature vector of each sample node; determine the third loss value based on the type label and the type confidence of each sample node; and train the asset sequence classification model based on the second loss value, including: determining the sum of the second loss value and the third loss value, updating the sum to the second loss value, and training the asset sequence classification model based on the updated second loss value.

[0240] Further, the processing module 1101 is specifically used to, for each sample node, concatenate the first type feature vector of the sample node with the first type feature vector of the previous sample node to obtain a second type feature vector; update the second type feature vector to the first type feature vector of the sample node; and predict the type confidence of the sample node based on the updated first type feature vector of the sample node.

[0241] Example 12:

[0242] Based on the same application concept, this application provides an electronic device that can implement the steps of the enterprise IP asset identification method described above. Figure 12 is a schematic diagram of the structure of an electronic device provided in this application. As shown in Figure 12, it includes: a processor 1201, a communication interface 1202, a memory 1203, and a communication bus 1204. The processor 1201, the communication interface 1202, and the memory 1203 communicate with each other through the communication bus 1204.

[0243] The memory 1203 stores a computer program. When the program is executed by the processor 1201, the processor 1201 performs the following steps:

[0244] Obtain the target identification information of the target enterprise to be identified; determine the target domain name corresponding to the target identification information based on the correspondence between each enterprise identification information in the Internet Content ICP database record and the first domain name;

[0245] Based on the search paths in the pre-constructed graph, a target search path is determined with the target domain name as the source node and the IP address as the termination node; wherein, the graph is constructed based on website data and PDNS data;

[0246] Based on the first feature vector of each node that is saved in advance, the target feature vector of each target node in the target search path is determined; the target feature vector of each target node is input into the pre-trained asset sequence classification model, and the IP and the target domain name are determined based on the asset sequence classification model to determine whether they belong to the same enterprise asset.

[0247] Furthermore, the processor 1201 is also used for the process of pre-constructing the map, which includes:

[0248] Based on the enterprise identification information and their corresponding first domain name recorded in the ICP database, as well as the network database and the Domain Name System (DNS) database, determine the website data and PDNS data of each enterprise;

[0249] A graph structure is constructed using the website data and PDNS data of each enterprise as nodes;

[0250] Based on the pre-saved search relationships between nodes in the graph structure, the search path from each source node to the terminal node in the graph structure is determined, and a graph is constructed based on each search path.

[0251] Furthermore, the processor 1201 is also configured to construct a graph structure using the website data and PDNS data of each enterprise as nodes, including:

[0252] For each of the aforementioned enterprises, using the enterprise's website data and PDNS data as nodes, a subgraph structure for each enterprise is constructed according to preset connection rules.

[0253] For each enterprise's subgraph structure, nodes of type domain name or IP address in the subgraph structure are designated as the first nodes to be connected.

[0254] The graph structure is constructed by connecting different subgraph structures based on the same first node to be connected.

[0255] Furthermore, the processor 1201 is also configured to include the following in the PDNS data: a second domain name, at least one third domain name corresponding to the second domain name, and a first IP address corresponding to each of the second domain name and the at least one third domain name; the website data includes: a Uniform Resource Locator URL, a fourth domain name, a certificate cert, and a second IP address;

[0256] Constructing the subgraph structure of the enterprise according to preset connection rules includes:

[0257] The second domain name is connected to the at least one third domain name; the second domain name and the at least one third domain name are respectively connected to their corresponding first IP addresses; the Uniform Resource Locator (URL) is connected to the fourth domain name, the certificate (cert), and the second IP address.

[0258] Use data of type domain name or IP in PDNS data and website data as the second node to be connected; connect the same second node to be connected to construct the subgraph structure.

[0259] Furthermore, the processor 1201 is also used to pre-save the first feature vector of each node, including:

[0260] Determine the initial feature vector of each node in the graph;

[0261] For each search path in the graph, each sub-search path of the search path is determined according to a preset sliding window;

[0262] For each sub-search path, the initial feature vectors of the nodes in the sub-search path other than the central node are summed to obtain a second feature vector; the second feature vector is input into a vector prediction model, and a predicted feature vector is determined based on the vector prediction model; a first loss value is determined based on the predicted feature vector and the initial feature vector of the central node; the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the central node are updated based on the first loss value and the model parameter update algorithm to obtain a first feature vector of the nodes other than the central node.

[0263] Furthermore, the processor 1201 is also used for the process of pre-training the asset sequence classification model, which includes:

[0264] Based on each search path in the pre-constructed graph, determine the sample search path; based on the first feature vector of each node in the pre-saved first feature vector, determine the first feature vector of each sample node in the sample search path;

[0265] The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained. The confidence of the enterprise affiliation of the sample search path is predicted based on the asset sequence classification model. A second loss value is determined based on the enterprise affiliation label and the enterprise affiliation confidence value. The asset sequence classification model is trained based on the second loss value.

[0266] Furthermore, the processor 1201 is also used to predict the enterprise affiliation confidence level of the sample search path based on the asset sequence classification model, including:

[0267] Based on the asset sequence classification model, the first feature vector of each sample node is averaged and pooled to obtain the third feature vector; the confidence of the enterprise affiliation of the sample search path is predicted based on the third feature vector.

[0268] Furthermore, before the processor 1201 trains the asset sequence classification model based on the second loss value, the method further includes:

[0269] The type labels of each sample node are input into the asset sequence classification model to be trained. Based on the type extraction subnetwork in the asset sequence classification model, the first feature vector of each sample node is extracted to obtain the first type feature vector of each sample node. The type confidence of each sample node is predicted based on the first type feature vector of each sample node. The third loss value is determined based on the type label and the type confidence of each sample node.

[0270] Training the asset sequence classification model based on the second loss value includes:

[0271] The sum of the second loss value and the third loss value is determined, and the sum is updated to the second loss value. The asset sequence classification model is then trained based on the updated second loss value.

[0272] Furthermore, the processor 1201 is also configured to predict the type confidence of each sample node based on the first type feature vector of each sample node, including:

[0273] For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain the second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted based on the updated first type feature vector of the sample node.

[0274] The communication bus mentioned in the aforementioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. The communication interface 702 is used for communication between the aforementioned electronic device and other devices. The memory can include Random Access Memory (RAM), or Non-Volatile Memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0275] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0276] Example 13:

[0277] Based on the same concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, it causes the processor to execute any of the enterprise IP asset identification methods discussed above. Since the principle by which the above-described computer-readable storage medium solves the problem is similar to that of the enterprise IP asset identification method, the implementation of the above-described computer-readable storage medium can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0278] Based on the same concept, this application also provides a computer program product, which includes computer program code that, when run on a computer, causes the computer to execute any of the enterprise IP asset identification methods discussed above. Since the principle by which the above computer program product solves the problem is similar to that of the enterprise IP asset identification method, the implementation of the above computer program product can refer to the implementation of the method, and repeated details will not be elaborated further.

[0279] The aforementioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in an electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, MO (magneto-optical disks), optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, NAND flash (non-volatile memory), SSDs (solid-state drives), etc.

[0280] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0281] Computer programs used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing status information from the computer-readable program instructions to implement various aspects of this disclosure.

[0282] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0283] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely application embodiment, or an embodiment combining application and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0284] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0285] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0286] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0287] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0288] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for identifying enterprise IP assets, characterized in that, The method includes: Obtain the target identification information of the target enterprise to be identified; determine the target domain name corresponding to the target identification information based on the correspondence between each enterprise identification information in the Internet Content ICP database record and the first domain name; Based on the search paths in the pre-constructed graph, a target search path is determined with the target domain name as the source node and the IP address as the termination node; wherein, the graph is constructed based on website data and PDNS data; Based on the first feature vector of each node that is saved in advance, the target feature vector of each target node in the target search path is determined; the target feature vector of each target node is input into a pre-trained asset sequence classification model, and the IP and the target domain name are determined based on the asset sequence classification model to determine whether they belong to the same enterprise asset; The process of pre-saving the first feature vector of each node includes: Determine the initial feature vector of each node in the graph; For each search path in the graph, each sub-search path of the search path is determined according to a preset sliding window; For each sub-search path, the initial feature vectors of the nodes in the sub-search path other than the central node are summed to obtain a second feature vector; the second feature vector is input into a vector prediction model, and a predicted feature vector is determined based on the vector prediction model; a first loss value is determined based on the predicted feature vector and the initial feature vector of the central node; the model parameters of the vector prediction model and the initial feature vectors of the nodes other than the central node are updated based on the first loss value and the model parameter update algorithm to obtain a first feature vector of the nodes other than the central node.

2. The method according to claim 1, characterized in that, The process of pre-constructing the map includes: Based on the enterprise identification information and their corresponding first domain name recorded in the ICP database, as well as the network database and the Domain Name System (DNS) database, determine the website data and PDNS data of each enterprise; A graph structure is constructed using the website data and PDNS data of each enterprise as nodes; Based on the pre-saved search relationships between nodes in the graph structure, the search path from each source node to the terminal node in the graph structure is determined, and a graph is constructed based on each search path.

3. The method according to claim 2, characterized in that, Using the website data and PDNS data of each enterprise as nodes, the graph structure is constructed as follows: For each of the aforementioned enterprises, using the enterprise's website data and PDNS data as nodes, a subgraph structure for each enterprise is constructed according to preset connection rules. For each enterprise's subgraph structure, nodes of type domain name or IP address in the subgraph structure are designated as the first nodes to be connected. The graph structure is constructed by connecting different subgraph structures based on the same first node to be connected.

4. The method according to claim 3, characterized in that, The PDNS data includes: a second domain name, at least one third domain name corresponding to the second domain name, and a first IP address corresponding to each of the second domain name and the at least one third domain name; the website data includes: a Uniform Resource Locator URL, a fourth domain name, a certificate cert, and a second IP address. Constructing the enterprise's subgraph structure according to preset connection rules includes: The second domain name is connected to the at least one third domain name; the second domain name and the at least one third domain name are respectively connected to their corresponding first IP addresses; the Uniform Resource Locator (URL) is connected to the fourth domain name, the certificate (cert), and the second IP address respectively. Use data of type domain name or IP in PDNS data and website data as the second node to be connected; connect the same second node to be connected to construct the subgraph structure.

5. The method according to claim 1, characterized in that, The process of pre-training the asset sequence classification model includes: Based on each search path in the pre-constructed graph, determine the sample search path; based on the first feature vector of each node in the pre-saved first feature vector, determine the first feature vector of each sample node in the sample search path; The first feature vector of each sample node and the enterprise affiliation label of the sample search path are input into the asset sequence classification model to be trained. The confidence of the enterprise affiliation of the sample search path is predicted based on the asset sequence classification model. A second loss value is determined based on the enterprise affiliation label and the enterprise affiliation confidence value. The asset sequence classification model is trained based on the second loss value.

6. The method according to claim 5, characterized in that, The confidence level for predicting the enterprise affiliation of the sample search path based on the asset sequence classification model includes: Based on the asset sequence classification model, the first feature vector of each sample node is averaged and pooled to obtain the third feature vector; the confidence of the enterprise affiliation of the sample search path is predicted based on the third feature vector.

7. The method according to claim 5, characterized in that, Before training the asset sequence classification model based on the second loss value, the method further includes: The type labels of each sample node are input into the asset sequence classification model to be trained. Based on the type extraction subnetwork in the asset sequence classification model, the first feature vector of each sample node is extracted to obtain the first type feature vector of each sample node. The type confidence of each sample node is predicted based on the first type feature vector of each sample node. The third loss value is determined based on the type label and the type confidence of each sample node. Training the asset sequence classification model based on the second loss value includes: The sum of the second loss value and the third loss value is determined, and the sum is updated to the second loss value. The asset sequence classification model is then trained based on the updated second loss value.

8. The method according to claim 7, characterized in that, The confidence level of the type of each sample node is predicted based on the first type feature vector of each sample node, including: For each sample node, the first type feature vector of the sample node is concatenated with the first type feature vector of the previous sample node to obtain the second type feature vector; the second type feature vector is updated to the first type feature vector of the sample node, and the type confidence of the sample node is predicted based on the updated first type feature vector of the sample node.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-8.

Images