CN103368779A

CN103368779A - Method for inspecting network attribute collection

Info

Publication number: CN103368779A
Application number: CN2013103031990A
Authority: CN
Inventors: 战伟; 吴伟湘
Original assignee: BEIJING SUIFANG INFORMATION TECHNOLOGY Co Ltd
Current assignee: Zhan Wei
Priority date: 2013-07-18
Filing date: 2013-07-18
Publication date: 2013-10-23
Anticipated expiration: 2033-07-18
Also published as: CN103368779B

Abstract

The invention relates to a method for inspecting network attribute collection. The method includes the following steps that (1), aiming at given network device information, a data form besides network devices and related facilities is built, and in addition a related attribute data form of a whole network is created; (2), according to the network device information, all kinds of attributes and states of the devices are filled, and meanwhile overall attributes and overall states of the whole network are filled; (3), according to an inspection rule, whether related attributes of the network devices meet the rule or not is inspected, and meanwhile whether related attributes and related states of the whole network meet a norm or not is inspected; (4) a related inspection result report is generated. The method for inspecting the network attribute collection has the advantages of being high in operability and capable of being performed automatically, through the analysis of the network device information, a network overall attribute data set is built and identified and then undergoes compliance inspection, complete inspection carried out on the overall states, the overall attributes and matching of the network are achieved from the macroscopic perspective, and the difficult problems in the automatic inspection industry are solved.

Description

Network attribute collects inspection technique

Technical field

The present invention relates to the network security technology field, relate in particular to the method that realizes Network Check by the marked network integrity attribute.

Background technology

Existing network is checked or the process of upgrading existing network or test New Deal project in, all need reliability and the validity of network are assessed objectively, to reduce the investment risk of networking, make planned network that very high performance be arranged, perhaps make test result can truly reflect the performance of New Deal, legacy network design and planing method are mainly by experience, catenet to complexity, the incessantly main points of network design are grabbed owing to predicting in a lot of places, so industry more and more needs a kind of new Network Check and audit means.

Under present existing trend, research automated network inspection method will be liberated the network security industry for people's dependence, make the inspection behavior reliable, rigorous, and can quantize to pay with batch.The Network Check knowledge of moulding can be better solidified in the standardization of Network Check, automation, standardization, intellectuality, will be in a large number can standardized deterministic process consigns to network and automatically finishes.In the checking process of automation, can remove hand labor from simultaneously, reduce cost, also avoid other people to contact critical data, and then improved the confidentiality of whole audit process, automation tools replaces manual work to become the trend of industry development.

In the process of Network Check automation, the automatic inspection of network equipments configuration is faced with again a large amount of technical barriers, automatic generation report from automatic decision, inspection and the later stage of the configuration of the equipment that automatically recognizes of equipment, all there are more technological difficulties, especially whether automatically from the facility information of magnanimity, differentiating safety, whether close rule, whether meet particularly difficulty of the aspect such as technical need aspect, the product or the method that also do not have at present to address these problems occur.

The present networks inspection method has created and has a kind ofly identified by the attribute of phase-split network facility information to the network equipment, and then carries out the method that compliance checks, solves the industry difficult problem that automation checks.

Summary of the invention

The purpose of this invention is to provide a kind of network attribute and collect inspection technique, adopt brand-new network integrity attribute concept, by the information of the confusing network equipment of magnanimity, by neat, unified be designated measurable, can compare, can judge, discernible normalized network integrity attribute information, be applicable to inspection and the misarrangement of big-and-middle-sized network, to overcome present prior art above shortcomings.

The objective of the invention is to be achieved through the following technical solutions:

A kind of network attribute collects inspection technique, may further comprise the steps:

1) creates a Network Check project, and read the network equipment information that gives, create corresponding data form 1 according to reading the implementor name that filters out in the process, this data form 1 is used for filling the various attributes of corresponding equipment, simultaneously, create an independent data form 2 that is used for the whole association attributes of marked network;

2) again scan the network equipment information that gives, find that the whole association attributes of network of sign is then made mark in the database of correspondence, will be filled in the data form 2 with network whole relevant attribute and state simultaneously; The been scanned then data form 2 of the corresponding attribute of whole network is set up completely, then begins the dissecting needle information relevant to whole network, and these information is converted into accordingly a certain or multiple attribute/state of this network integral body;

3) according to set inspection rule, the association attributes of whole network is checked; The various attributes of every equipment be filled to data form 1 complete after, then can verify attribute and the state of whole network, and then attribute and the state of whole network are examined one by one;

4) generate report: can not arrange out one by one meeting the set clauses and subclauses of rule that check in the checking process, and generate the coherence check report the test.

Beneficial effect of the present invention is: provide network attribute a kind of strong operability, that can automation implement to collect inspection technique, set up network integrity attribute data set by the phase-split network facility information, and it is identified, and then carry out the compliance inspection, realized comprehensively checking from state, attribute and the matching of macroscopic perspective to network integral body, solved the industry difficult problem that automation checks.

Description of drawings

The below is described in further detail the present invention with reference to the accompanying drawings.

Fig. 1 is that the attribute that the described network attribute of the embodiment of the invention collects inspection technique collects and the check process schematic diagram.

Embodiment

As shown in Figure 1, the described a kind of network attribute of the embodiment of the invention collects inspection technique, may further comprise the steps particularly:

1) creates a Network Check project, and read the network equipment information that gives, create corresponding data form 1 according to reading the implementor name that filters out in the process, it is an equipment that the implementor name that occurs is all regarded as, this data form 1 is used for filling the various attributes of corresponding equipment, and the corresponding data list 1 of each equipment or implementor name then has a plurality of data forms 1, simultaneously, create an independent data form 2 that is used for the whole association attributes of marked network;

For example: comprise 8 equipment (each own different device name) in the network equipment information that gives, except 8 equipment for this reason create 8 corresponding data lists 1, create simultaneously a data list 2, the attribute and the state that are used for the integral body of the network that sign is comprised of these 8 network equipments, and one of these 8 equipment attribute that also to be this network integral body in fact have (this network comprises the number of devices attribute: 8).

For example: this network integral body has been used the OSPF Routing Protocol, and comprise 3 ospf areas, do not use the MD5 effect between the ospf router, these information that are decomposed out then, all be can be regarded as a certain or multiple attribute/state of this whole network, and be identified at respectively in the network integrity attribute; According to the network equipment information that provides, various attributes and the state of the network integral body that comprises in this network equipment information are inserted list 2.

3) according to set inspection rule, the association attributes of whole network is checked; The various attributes of every equipment be filled to data form 1 complete after, then can verify attribute and the state of whole network, and then attribute and the state of whole network are examined one by one; The inspection to attribute and the state of overall network is crossed in the service regeulations storehouse, draws check result.

For example: the zone of the OSPF of Cisco should be continuous, and All Ranges all links to each other with area0.As individual areas occurs and do not link area0, then the OSPF Routing Area setting of this network has comprised at least one mistake.

In this patent, the network equipment refers in particular to all hardware units that consist of network principal and be used for network connection, and the non-material object of guarantee network-in-dialing, the object that exists in logic comprises as follows:

1, the various terminal equipments such as PC terminal, private server, printer, portable terminal;

2, router, switch, fire compartment wall, the independent networking isolated plants such as physical function module of pegging graft;

3, the physical circuit that needs in the networking or logic connect, such as network cable, wireless connections;

4, in logic non-entity target, as " local area network (LAN) " this pseudo-entity itself of being formed by each network connection device or " cloud " (pseudo-entity " cloud " is suitable for various application occasions, as: backbone network that is provided by operator etc.).

The present invention adopts brand-new network integrity attribute concept, so that the information of the mixed and disorderly unordered network equipment of the magnanimity of extracting, by neat, be designated uniformly measurable, can compare, can judge, discernible normalization network integrity attribute information, the Network Check means that can only simply check the network unit have been surmounted in the conventional method, realization is from macroscopic perspective, state to network integral body, attribute, matching has had the comprehensive method of inspection, simultaneously this method is specially adapted to the inspection of big-and-middle-sized network and misarrangement a kind of strong operability is provided, the network attribute of can automation implementing collects inspection technique, has solved the industry difficult problem that automation checks.

Above-described embodiment only is for the invention example clearly is described, and is not the restriction to the invention embodiment.For those of ordinary skill in the field, can also make other changes in different forms on the basis of the above description.Here need not also can't give all execution modes exhaustive.All any apparent variations of being extended out within the spirit and principles in the present invention or change still are among the protection range of the invention claim.

Claims

1. a network attribute collects inspection technique, it is characterized in that: may further comprise the steps:

3) according to set inspection rule, the association attributes of whole network is checked; The various attributes of every equipment be filled to data form 1 complete after, then can verify attribute and the state of whole network, and then attribute and the state of whole network are examined one by one; And

2. network attribute according to claim 1 collects inspection technique, it is characterized in that: in described step 2) in, according to the network equipment information that provides, various attributes and the state of the network integral body that comprises in this network equipment information are inserted list 2.

3. network attribute according to claim 1 collects inspection technique, it is characterized in that: in step 3), the inspection to attribute and the state of overall network is crossed in the service regeulations storehouse, draws check result.