CN107733581B - Rapid internet asset feature detection method and device based on whole network environment - Google Patents

Abstract

The method and device for fast Internet asset feature detection based on the whole network environment provided by the embodiments of the present invention belong to the field of network security. A sequence number value is generated according to the target IP and the target port number, thereby generating a TCP packet based on the sequence number value, and then the TCP packet is concurrently sent to the target port for scanning and detection, thereby effectively improving the transmission efficiency. The target server corresponding to the target port parses the response message based on the response message returned by the TCP message to determine whether the target IP corresponding to the serial number value is the same as the returned IP The address matches and whether the target port number corresponding to the serial number value matches the return port number. When matching, the service type corresponding to the response data is finally identified, enabling users to quickly identify Internet assets, effectively helping users Users make effective security risk assessments in the entire network environment.

Description

Method and device for fast Internet asset feature detection based on the whole network environment

technical field

The present invention relates to the field of network security, and in particular, to a method and device for detecting characteristics of fast Internet assets based on an entire network environment.

Background technique

In the Internet environment with the rapid development of information globalization, individuals can quickly deploy websites, and enterprises can quickly deploy various servers in the network, such as WEB servers, DNS servers, etc. At the same time, hackers in the network (this article refers to those who illegally collect and steal relatively valuable information) will attack the server to steal corporate information and sensitive information. This leads to the generation of network security risks. At the same time, with the rapid development of big data, it is easier for hackers to use big data attack methods to attack different servers.

In enterprise network security, network asset statistics are the basis of information security. Only by knowing your own network assets can you further plan for information security and deploy security equipment. Usually, users perform manual asset statistics on the intranet, and use scanners to perform asset statistics on servers, PCs, and ports. Traditional network scanning usually uses the SYN packet SYN (synchronous) is a handshake signal used by TCP/IP to establish a connection. When a normal TCP (Transmission Control Protocol) network connection is established between the client and the server, the client first sends a SYN message, the server responds with SYN+ACK to indicate that it has received the message, and finally the client responds with an ACK message. In this way, a reliable TCP connection can be established between the client and the server, and data can be transmitted between the client and the server. However, there is a technical problem in the prior art that it is impossible to quickly scan and detect assets for the entire network.

SUMMARY OF THE INVENTION

The present invention provides a method and device for fast Internet asset feature detection based on the whole network environment, aiming at improving the above technical problems.

The method for detecting characteristics of fast Internet assets based on the whole network environment provided by the present invention includes: generating a sequence number value according to a target IP and a target port number; generating a TCP message based on the sequence number value; sending the TCP message to the target port corresponding to the target port number; obtain the response message returned by the target server corresponding to the target port based on the TCP message; obtain the return IP address and the return port number carried by the response message ; Judge whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number; Response data carried; identify the service type corresponding to the response data.

Preferably, the generating a sequence number value according to the target IP and the target port number includes: the sequence number value satisfies: SEQ value=target IP+target port, wherein the SEQ (Sequence Number) value represents the sequence number value.

Preferably, the acquiring the return IP address and the return port number carried in the response packet includes: acquiring the confirmation value corresponding to the confirmation character carried in the response packet; performing a reverse operation on the confirmation value , to obtain the return IP address and return port number corresponding to the confirmation value.

Preferably, the identifying the service type corresponding to the response data includes: acquiring characteristic characters carried by the response data; searching for the service type corresponding to the characteristic characters.

Preferably, the identifying the service type corresponding to the response data further includes: storing the response data locally.

The device for detecting the characteristics of fast Internet assets based on the whole network environment provided by the present invention includes: a first data acquisition unit, which is used to generate a serial number value according to the target IP and the target port number; The number value generates a TCP message; the message sending unit is used to send the TCP message to the target port corresponding to the target port number; the message acquisition unit is used to obtain the target server corresponding to the target port number Based on the response message returned by the TCP message; the second data acquisition unit is used to acquire the return IP address and the return port number carried in the response message; the data processing unit is used to determine the serial number value Whether the corresponding target IP matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number; the execution unit is configured to, if so, obtain the response message The response data carried by the text; the identification unit is used to identify the service type corresponding to the response data.

Preferably, the first data acquisition unit is specifically configured to: the sequence number value satisfies: SEQ value=target IP+target port, wherein the SEQ (Sequence Number) value represents the sequence number value.

Preferably, the second data acquisition unit is specifically configured to: acquire the confirmation value corresponding to the confirmation character carried in the response message; perform a reverse operation on the confirmation value to obtain the return corresponding to the confirmation value IP address and return port number.

Preferably, the identifying unit is specifically configured to: acquire the characteristic characters carried by the response data; and find the service type corresponding to the characteristic characters.

Preferably, after the identification unit, it further includes: a storage unit, configured to store the response data locally.

The above-mentioned method and device for detecting the characteristics of fast Internet assets based on the whole network environment provided by the present invention generate a serial number value according to the target IP and the target port number, thereby generating a TCP message based on the serial number value, and then converting the message Concurrently to the target port for scanning and detection, thereby effectively improving the sending efficiency, by obtaining the response message returned by the target server corresponding to the target port based on the TCP message, the response message is parsed , to determine whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number, when matching, finally respond by identifying The type of service corresponding to the data enables users to quickly identify Internet assets and effectively help users make effective security risk assessments in the entire network environment.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the embodiments. It should be understood that the following drawings only show some embodiments of the present invention, and therefore do not It should be regarded as a limitation of the scope, and for those of ordinary skill in the art, other related drawings can also be obtained according to these drawings without any creative effort.

1 is a structural block diagram of an electronic device according to an embodiment of the present invention;

FIG. 2 is a flowchart of a method for detecting characteristics of fast Internet assets based on a network-wide environment provided by the first embodiment of the present invention;

3 is a schematic diagram of sending a TCP message in the method for detecting characteristics of fast Internet assets based on the entire network environment shown in FIG. 2;

FIG. 4 is a schematic diagram of the response message returned by the target server in the fast Internet asset feature detection method based on the whole network environment shown in FIG. 2;

Fig. 5 is the service type identification schematic diagram in the fast Internet asset feature detection method based on the whole network environment shown in Fig. 2;

FIG. 6 is a flowchart of a method for detecting characteristics of fast Internet assets based on a network-wide environment provided by the second embodiment of the present invention;

7 is a schematic diagram of functional modules of a device for detecting characteristics of fast Internet assets based on a network-wide environment provided by a third embodiment of the present invention;

FIG. 8 is a schematic diagram of functional modules of a device for detecting characteristics of fast Internet assets based on an entire network environment provided by a fourth embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention. Thus, the following detailed description of the embodiments of the invention provided in the accompanying drawings are not intended to limit the scope of the invention as claimed, but are merely representative of selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

As shown in FIG. 1 , it is a structural block diagram of an electronic device provided by an embodiment of the present invention. The electronic device 300 includes a fast Internet asset feature detection device based on an entire network environment, a memory 302 , a storage controller 303 , a processor 304 and a peripheral interface 305 .

The elements of the memory 302 , the storage controller 303 , the processor 304 and the peripheral interface 305 are directly or indirectly electrically connected to each other to realize data transmission or interaction. For example, these elements may be electrically connected to each other through one or more communication buses or signal lines. The device for detecting characteristics of fast Internet assets based on the entire network environment includes at least one operating system (operating system, OS) that can be stored in the memory 302 or solidified in the electronic device 300 in the form of software or firmware (firmware). software function modules in . The processor 304 is configured to execute executable modules stored in the memory 302, for example, software function modules or computer programs included in the apparatus for detecting characteristics of fast Internet assets based on a whole network environment.

Wherein, the memory 302 may be, but not limited to, random access memory (Random Access Memory, RAM), read only memory (Read Only Memory, ROM), programmable read only memory (Programmable Read-Only Memory, PROM), or Erasable Programmable Read-Only Memory (EPROM), Electrical Erasable Programmable Read-Only Memory (EEPROM), etc. The memory 302 is used to store a program, and the processor 304 executes the program after receiving the execution instruction. The method executed by the server 100 for stream process definition disclosed in any of the foregoing embodiments of the present invention can be applied to in the processor 304 or implemented by the processor 304 .

The processor 304 may be an integrated circuit chip with signal processing capability. The above-mentioned processor 304 may be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component. Various methods, steps, and logical block diagrams disclosed in the embodiments of the present invention can be implemented or executed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The peripherals interface 305 couples various input/input devices to the processor 304 and the memory 302 . In some embodiments, peripheral interface 305, processor 304, and memory controller 303 may be implemented in a single chip. In other instances, they may be implemented by separate chips.

Please refer to FIG. 2 , which is a flowchart of a method for fast Internet asset feature detection based on an entire network environment provided by the first embodiment of the present invention. The specific flow shown in FIG. 2 will be described in detail below.

Step S101, generating a serial number value according to the target IP and the target port number.

As an implementation manner, in a network-wide environment, a target IP and a target port number are constructed locally, so as to generate a serial number value according to the target IP and the target port number. Specifically, the sequence number value satisfies: SEQ value=target IP+target port. The SEQ (Sequence Number) value represents the sequence number value. The target IP represents the address of the target IP, and the target port represents the port number of the target port. For example, if a target IP is arbitrarily constructed locally as 1.1.1.1, and the target port number is 1, at this time, the SEQ value=(1.1.1.1+1)=123456. For another example, if a target IP is arbitrarily constructed locally as 253.253.253.253, and the target port number is 65533, at this time, the SEQ value=(253.253.253.253+65533)=56789. Wherein, according to a preset rule, the target IP plus the target port is a numerical value.

The serial number value refers to a value corresponding to the serial number in the TCP (Transmission Control Protocol) protocol.

Step S102, generating a TCP packet based on the sequence number value.

The TCP message refers to a message containing the sequence number value and based on the Transmission Control Protocol.

As an implementation manner, the sequence number value is inserted into the TCP packet header to generate the TCP packet.

Step S103, sending the TCP packet to the target port corresponding to the target port number.

In this embodiment, preferably, the TCP packet is sent to the target port corresponding to the target port number in a concurrent manner, as shown in FIG. 3 .

In this embodiment, in order to quickly improve the sending efficiency, instead of waiting for a return packet alone, preferably, a separate port is opened to wait for the target server to continue to report back.

In this embodiment, preferably, after step S103, the method further includes continuously waiting for the target server to return data.

Step S104: Obtain a response message returned by the target server corresponding to the target port based on the TCP message.

The TCP packet is used as a detection packet to detect the target IP port, as shown in FIG. 4 .

Step S105: Obtain the return IP address and return port number carried in the response packet.

The returned IP address refers to the IP address carried in the response packet. The return port number refers to the port number carried in the response packet.

As an implementation manner, the confirmation value corresponding to the confirmation character carried in the response packet is obtained; the reverse operation is performed on the confirmation value to obtain the return IP address and return port number corresponding to the confirmation value.

Wherein, the confirmation character refers to the ACK (Acknowledgement) carried in the response message. By performing a reverse operation on the ACK, the return IP address and return port number corresponding to the ACK are obtained.

Step S106, judging whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number.

In this embodiment, for example, the IP address carried in the response packet is 10.0.0.1, and the port is 80. The SEQ value is obtained by subtracting 1 from the ACK value, that is, the SEQ value=ACK value-1, and the target IP and target port number corresponding to the ACK value are restored through a reverse algorithm. The target IP is compared with the return IP address carried in the response message, and the target port number is compared with the return port number carried in the response message. Thus, it is judged whether the target IP is the same as the return IP address carried in the response packet and whether the target port number is the same as the return port number carried in the response packet.

Step S107, if yes, obtain the response data carried in the response message.

In this embodiment, if they are the same, it means that the target server has correctly responded to the TCP message, and it can be determined that the target port is open. and acquiring the response data carried in the response message.

If they are different, it means that the packet replied by the target server is not the TCP packet, and the data is discarded.

Step S108, identifying the service type corresponding to the response data.

Wherein, the service type may be http service, ftp service, telnet service and/or SMTP service. Here, no specific limitation is made.

As an implementation manner, the characteristic characters carried by the response data are acquired; the service type corresponding to the characteristic characters is searched. As shown in Figure 5, different service types returned by different servers.

Wherein, the characteristic character refers to a character string carried in the response data. For example, in the http service, the string "HTTP/1.1 200Forbidden" is carried in the returned response data. For another example, the ftp service carries the string ""data" in the returned packet: "220－－－－－－－－－－Welcometo Pure-FTPd[privsep]", which is not specifically limited here.

The searching for the service type corresponding to the characteristic character means that if the header of the response data carries "HTTP/1.1 200", it is determined that the service whose target IP and target port number are open is the HTTP service.

Please refer to FIG. 6 , which is a flowchart of a method for fast Internet asset feature detection based on a network-wide environment provided by the second embodiment of the present invention. The specific flow shown in FIG. 6 will be described in detail below.

Step S201, generating a serial number value according to the target IP and the target port number.

Step S202, generating a TCP packet based on the sequence number value.

Step S203, sending the TCP packet to the target port corresponding to the target port number.

Step S204: Acquire a response message returned by the target server corresponding to the target port based on the TCP message.

Step S205: Obtain the return IP address and return port number carried in the response packet.

Step S206, judging whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number.

Step S207, if yes, obtain the response data carried in the response message.

Step S208, identifying the service type corresponding to the response data.

For specific implementation manners of steps S201 to S208, please refer to the corresponding steps in the first embodiment, which are not repeated here.

Step S209, the response data is stored locally.

In this embodiment, the response data carried in the response message satisfying step S206 and the response data having identified the service type is stored locally.

Please refer to FIG. 7 , which is a schematic diagram of functional modules of a device for detecting characteristics of fast Internet assets based on a whole network environment provided by a third embodiment of the present invention. The fast Internet asset feature detection device 400 includes: a first data acquisition unit 410, a message generation unit 420, a message transmission unit 430, a message acquisition unit 440, a second data acquisition unit 450, a data processing unit 460, and an execution unit 470 and identification unit 480.

The first data acquisition unit 410 is configured to generate a serial number value according to the target IP and the target port number.

The first data acquisition unit 410 is specifically configured to: the sequence number value satisfies: SEQ value=target IP+target port, wherein the SEQ (Sequence Number) value represents the sequence number value.

The message generating unit 420 is configured to generate a TCP message based on the sequence number value.

The message sending unit 430 is configured to send the TCP message to the target port corresponding to the target port number.

The message obtaining unit 440 is configured to obtain the response message returned by the target server corresponding to the target port based on the TCP message.

The second data obtaining unit 450 is configured to obtain the return IP address and return port number carried in the response message.

The second data acquisition unit 450 is specifically configured to: acquire the confirmation value corresponding to the confirmation character carried in the response message; perform a reverse operation on the confirmation value to acquire the return corresponding to the confirmation value IP address and return port number.

The data processing unit 460 is configured to determine whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number.

The executing unit 470 is configured to obtain the response data carried in the response packet if yes.

The identifying unit 480 is configured to identify the service type corresponding to the response data.

Please refer to FIG. 8 , which is a schematic diagram of functional modules of a device for detecting characteristics of fast Internet assets based on a network-wide environment provided by the fourth embodiment of the present invention. The fast Internet asset feature detection device 500 includes: a first data acquisition unit 510, a message generation unit 520, a message transmission unit 530, a message acquisition unit 540, a second data acquisition unit 550, a data processing unit 560, and an execution unit 570 , an identification unit 580 and a storage unit 590 .

The first data acquisition unit 510 is configured to generate a serial number value according to the target IP and the target port number.

The first data acquisition unit 510 is specifically configured to: the sequence number value satisfies: SEQ value=target IP+target port, wherein the SEQ (Sequence Number) value represents the sequence number value.

The message generating unit 520 is configured to generate a TCP message based on the sequence number value.

The message sending unit 530 is configured to send the TCP message to the target port corresponding to the target port number.

The message obtaining unit 540 is configured to obtain the response message returned by the target server corresponding to the target port based on the TCP message.

The second data obtaining unit 550 is configured to obtain the return IP address and return port number carried in the response message.

Wherein, the second data acquisition unit 550 is specifically configured to: acquire the confirmation value corresponding to the confirmation character carried in the response message; perform a reverse operation on the confirmation value to acquire the return corresponding to the confirmation value IP address and return port number.

The data processing unit 560 is configured to determine whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number.

The execution unit 570 is configured to obtain the response data carried in the response packet if yes.

The identifying unit 580 is configured to identify the service type corresponding to the response data.

The storage unit 590 is configured to store the response data locally.

To sum up, the method and device for fast Internet asset feature detection based on the whole network environment provided by the present invention generate a serial number value according to the target IP and the target port number, so as to generate a TCP message based on the serial number value, and then The message is concurrently sent to the target port for scanning and detection, thereby effectively improving the sending efficiency. By obtaining the response message returned by the target server corresponding to the target port based on the TCP message, the response The message is parsed to determine whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number. When matching, Finally, by identifying the service type corresponding to the response data, users can quickly identify Internet assets and effectively help users make effective security risk assessments in the entire network environment.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may also be implemented in other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality and possible implementations of apparatuses, methods and computer program products according to various embodiments of the present invention. operate. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or actions , or can be implemented in a combination of dedicated hardware and computer instructions.

In addition, each functional module in each embodiment of the present invention may be integrated to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

If the functions are implemented in the form of software function modules and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes . It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention. It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further definition and explanation in subsequent figures.

Claims (10)

1. based on the fast Internet asset feature detection method under the whole network environment, it is characterized in that, comprising: Generate serial number value based on target IP and target port number; generating a TCP message based on the sequence number value; sending the TCP message to the target port corresponding to the target port number; Obtain the response message returned by the target server corresponding to the target port based on the TCP message; Obtain the return IP address and return port number carried by the response message; Determine whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number; If so, obtain the response data carried by the response message; Identify the service type corresponding to the response data, where the service type is http service, ftp service, telnet service and/or SMTP service. 2. method according to claim 1, is characterized in that, described generating serial number value according to target IP and target port number, comprises: The sequence number value satisfies: SEQ value=target IP+target port, wherein the SEQ (Sequence Number) value represents the sequence number value. 3. method according to claim 1, is characterized in that, described obtaining the return IP address and return port number that described response message carries, comprise: Obtain the confirmation value corresponding to the confirmation character carried by the response message; Perform a reverse operation on the confirmation value to obtain the return IP address and return port number corresponding to the confirmation value. 4. The method according to claim 1, wherein the identifying the service type corresponding to the response data comprises: Obtain the characteristic characters carried by the response data; Find the service type corresponding to the characteristic character. 5. The method according to claim 1, wherein the identifying the service type corresponding to the response data further comprises: Store the response data locally. 6. A device for detecting features of fast Internet assets based on an entire network environment, characterized in that, comprising: The first data acquisition unit is used to generate the serial number value according to the target IP and the target port number; a message generating unit, configured to generate a TCP message based on the sequence number value; a message sending unit, configured to send the TCP message to the target port corresponding to the target port number; a message obtaining unit, configured to obtain the response message returned by the target server corresponding to the target port based on the TCP message; A second data acquisition unit, configured to acquire the return IP address and the return port number carried by the response message; a data processing unit, configured to determine whether the target IP corresponding to the serial number value matches the return IP address and whether the target port number corresponding to the serial number value matches the return port number; an execution unit, configured to obtain the response data carried by the response message if it is; An identification unit, configured to identify a service type corresponding to the response data, where the service type is http service, ftp service, telnet service and/or SMTP service. 7. The device according to claim 6, wherein the first data acquisition unit is specifically used for: The sequence number value satisfies: SEQ value=target IP+target port, wherein the SEQ (Sequence Number) value represents the sequence number value. 8. The device according to claim 6, wherein the second data acquisition unit is specifically used for: Obtain the confirmation value corresponding to the confirmation character carried by the response message; Perform a reverse operation on the confirmation value to obtain the return IP address and return port number corresponding to the confirmation value. 9. The device according to claim 6, wherein the identification unit is specifically used for: Obtain the characteristic characters carried by the response data; Find the service type corresponding to the characteristic character. 10. The device according to claim 6, characterized in that, after the identifying unit, further comprising: The storage unit is used to store the response data locally.

Images