KR101880705B1 - System for collecting device information using internet and method thereof - Google Patents

Abstract

The purpose of the present invention is to provide a method for collecting device information, which operates more quickly than a conventional device. According to an embodiment of the present invention, the present invention is to provide the method for collecting device information, which comprises: a packet generation step of generating a plurality of Internet protocol (IP) addresses, and transmitting packets to the generated plurality of IP addresses; a response information calculation step of receiving response packets corresponding to the transmitted packets, and calculating response information which integrates the response packets received respectively by the IP addresses; a division processing step of dividing the calculated response information by the number of preset processes, and performing a dividing process on the divided response information through a plurality of threads included in each process; and a device information identification step of identifying device information of each device which receives the response packet based on a result that the division-processed response information is processed through a plurality of fingerprinting processes.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system and method for collecting device information using the Internet,

The present invention relates to a system and method for collecting device information using the Internet, and more particularly, to a system and method for rapidly collecting information of an Internet device (IoT device) connected to the Internet .

(Internet Internet service terminal), which is connected to the Internet, has been widely popularized, so that the risk of hacking to the Internet device is also increasing.

In order to maintain the security of the Internet devices, if the security weaknesses of the Internet devices are periodically checked, it is necessary to update the security patches so that the Internet devices can provide stable services .

In order to respond quickly to evolving security threats, it is necessary to collect information related to the security of the Internet devices in a short period of time. In other words, it has to collect information of 3.7 billion Internet devices actually available in the IPv4 space including 4.2 billion Internet Protocol addresses at a very high speed.

1 is a diagram schematically illustrating a method of collecting information of a conventional Internet device.

The conventional apparatus for collecting device information transmits a packet for each IP address and receives a response packet for the transmitted packet. The response packet includes operating system information of the object Internet device, version information of the security update patch, and the like. The received information forms a single data file called an IP scan result file before its contents are grasped. The IP scan result file is processed through a plurality of fingerprinting processes and finally collects device information Which is the information of the Internet device.

More specifically, a fingerprinting process in an existing structure parses data from a scan result of an IP address, converts the parsing result into a single long string variable, and stores a pre-stored rule It is a process of searching whether or not there is a part matching with a string variable in a file (Rule File). At this time, a performance bottleneck occurs in the apparatus for collecting device information in the process of parsing the data and searching the rule file. The bottleneck of the performance of the device collecting the device information generated in this process is that the scan result of the IP address is parsed and converted into a string in the same way as the field order defined in the rule file, This is a problem that occurs because the content and string comparison operations are performed.

For this reason, there is a need for an apparatus for collecting device information that overcomes the bottleneck of the performance of a conventional apparatus, as well as capable of quickly collecting information of the object Internet apparatus.

Korean Patent No. 10-1767454 (Published May 27, 2017)

Electronics and Telecommunications Trends. Vol. 30, No. 2, April 2015, pp. 87-94, Senior Researcher and 1 other author (14-000-05-001, Core Technology Development for Smart Networking).

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method for collecting device information that operates more quickly than a conventional device.

According to an aspect of the present invention, there is provided a method for collecting device information using the Internet, the method comprising: generating a plurality of Internet protocol (IP) addresses; Generating a packet for transmission; A response information calculation step of receiving a response packet corresponding to the transmitted packet and calculating response information combining response packets received for each IP address; A division processing step of dividing the calculated response information according to the number of predetermined processes and dividing the divided response information through a plurality of threads included in each process; And a device information grasping step of grasping device information of each device that has transmitted the response packet based on a result of processing the divided response information through a plurality of fingerprinting processes.

According to another aspect of the present invention, there is provided a system for collecting device information using the Internet, the method comprising: generating a plurality of internet protocol (IP) addresses; A packet generating unit for transmitting the packet; A response information calculation unit for receiving a response packet corresponding to the transmitted packet and calculating response information combining response packets received for each IP address; A division processing unit for dividing the calculated response information according to the number of predetermined processes and dividing the divided response information through a plurality of threads included in each process; And a device information acquisition unit for acquiring device information of each device that has transmitted the response packet based on a result of processing the divided response information through a plurality of fingerprinting processes.

An embodiment of the present invention provides a computer-readable recording medium storing a program for executing a method of collecting device information using the Internet.

According to the present invention, performance bottlenecks do not occur in the process of processing the result of the IP address scan of the object Internet devices as well as rapidly collecting information of the object Internet apparatuses.

1 is a diagram schematically illustrating a method of collecting information of a conventional Internet device.
Fig. 2 is a schematic diagram showing the overall configuration of a system according to the present invention.
Figure 3 is a block diagram of an example of a system for collecting device information in accordance with the present invention.
4 is a diagram schematically illustrating an example in which the packet generator generates an IP address using an equation that permits an IP address as a permutation and a preset prime number as a variable.
5 is a diagram schematically showing that the response information calculation unit passes the response packet through the kernel area and processes it at the user end.
6 is a diagram showing a structure in which a plurality of threads generated in a plurality of processes divide and process response information.
7 is a diagram illustrating a process in which response information is assigned to a thread to be processed in a thread created in a process in a fast parallel structure.
FIG. 8 is a diagram illustrating a process in which information stored in a queue is processed in parallel through a plurality of fingerprinting processes.
9 is a flowchart illustrating an example of a method of collecting device information using the Internet according to the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. The effects and features of the present invention and methods of achieving them will be apparent with reference to the embodiments described in detail below with reference to the drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, wherein like reference numerals refer to like or corresponding components throughout the drawings, and a duplicate description thereof will be omitted .

In the following embodiments, the terms first, second, and the like are used for the purpose of distinguishing one element from another element, not the limitative meaning.

In the following examples, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise.

In the following embodiments, terms such as inclusive or possessed mean that a feature or element described in the specification is present, and does not exclude the possibility that one or more other features or components are added in advance.

If certain embodiments are otherwise feasible, the particular process sequence may be performed differently from the sequence described. For example, two processes that are described in succession may be performed substantially concurrently, and may be performed in the reverse order of the order described.

Fig. 2 is a schematic diagram showing the overall configuration of a system according to the present invention.

2, a system 10 for collecting device information includes a camera 200, a refrigerator 300, an air conditioner 400, and a drones (not shown) via a communication network 600, 500) and various information are transmitted and received.

First, a system 100 for collecting device information transmits a packet to a camera 200, a refrigerator 300, an air conditioner 400 and a drone 500, receives a response packet corresponding to the packet, The device information of the refrigerator 300, the air conditioner 400, and the drones 500, and determines whether or not there is a security weak point.

The camera 200, the refrigerator 300, the air conditioner 400, and the drones 500 are all objects Internet devices. When a packet is received from the system 100 for collecting device information, a response packet is generated and transmitted Communication devices. 2 further includes other devices capable of transmitting and receiving various information through the communication network 600 in addition to the camera 200, the refrigerator 300, the air conditioner 400 and the drones 500 shown in FIG. 2 .

The communication network 600 performs a function of connecting the system 100 for collecting device information and the object Internet devices, and includes various wireless communication networks such as a data network, a mobile communication network, and the Internet.

Figure 3 is a block diagram of an example of a system for collecting device information in accordance with the present invention.

3, a system 100 for collecting device information according to the present invention includes a packet generator 110, a response information calculator 130, a division processor 150, and a device information acquisition unit 170 . Hereinafter, the system 100 for collecting the apparatus information of FIG. 3 is regarded as the same apparatus as the system 100 for collecting the apparatus information of FIG. 2, and will be described with reference to FIG. 2 for convenience of description .

The packet generating unit 110 generates a plurality of IP (Internet Protocol) addresses and transmits the packets to the generated plurality of IP addresses.

First, the packet generating unit 110 generates a plurality of IP addresses. The IP address generated by the packet generation unit 110 is an address generated by the packet generation unit 110 to send a packet to a destination Internet device having the IP address. According to currently used IPv4 (Internet Protocol version 4), the effective IP address is about 3.7 billion, and the packet generation unit 110 generates IP addresses in a predetermined range and number among 3.7 billion valid addresses , And transmits the packet to the generated IP address.

As an alternative embodiment, the packet generator 110 may generate an IP address through a mathematical expression using a plurality of IP addresses as permutations and predetermined prime numbers as variables.

4 is a diagram schematically illustrating an example in which the packet generator generates an IP address using an equation that permits an IP address as a permutation and a preset prime number as a variable.

The total number of IP addresses that can be defined under IPv4 is approximately 4.2 billion (the value computed by the power of 2 squared), and the effective address is about 3.7 billion. The packet generator 110 may generate a different IP address each time based on a formula using a circulation and a preset prime number as shown in FIG. Are not overlapped according to the permutation and the characteristics of the mathematical expression.

Equation (1) shows an example of a mathematical expression used by the packet generation unit 110 to generate an IP address. In Equation (1), g denotes a permutation factor constituting a permutation, and p denotes a prime number closest to the total number of IP addresses that can be defined in the currently used Internet Protocol version. For convenience of explanation, hereinafter, g is referred to as a permutation determining factor and p is referred to as a decimal fraction.

For example, under IPv4, p may be 4294967311 (the 32 th power of 2 plus 15), which is the closest prime to the 32nd power of 2, and the permutation factor g may be 6 according to FIG.

와

는 각각 i번째 10진수 및 i+1번째 10진수로서, 1부터 인터넷프로토콜 버전에서 정의될 수 있는 IP 주소의 전체 개수와 같은 수 중 어느 하나의 수가 될 수 있다. 예를 들어, IPv4하에서

는 1에서 4294967296(2의 32제곱) 중 어느 하나의 수가 될 수 있다. 즉, i+1번째 10진수는 i번째 10진수에 순열결정인자 g를 곱한 값을 결정소수 p로 나눈 나머지로 정의된다.In Equation 1,

Wow

Is an i-th decimal number and an (i + 1) -th decimal number, and can be any one of a number equal to the total number of IP addresses that can be defined in the Internet Protocol version from one. For example, under IPv4

Can be any number from 1 to 4294967296 (2 to the power of 2). That is, the (i + 1) -th decimal number is defined as the remainder obtained by dividing the i-th decimal number by the permutation determination factor g divided by the decimation factor p.

이 1로 선택되면,

는 수학식 1에 따라 5가 된다. 위와 같은 과정을 반복하면,

는 5,

는 4,

는 6,

은 2,

은 3,

은

과 같은 1이 산출된다. 즉,

과

이 같은 값을 같은 것은 결정소수가 7이기 때문이며, 결정소수가 달라지면 그만큼 최초의

과 같은 값이 산출되기 위해서 앞선 과정보다 더 많은 반복과정이 필요하다. 도 4에 따르면, 결정소수가 7이므로, 결정소수보다 더 작은 수가 나머지값들로 산출된 것을 알 수 있다.Referring to Equation 1, FIG. 4 will be described in order. First, the permutation decision factor g constituting the permutation by the packet generation unit 110 is selected as an arbitrary value 5,

Is selected as 1,

Becomes 5 according to Equation (1). By repeating the above procedure,

5,

4,

6,

2,

3,

silver

1 " is calculated. In other words,

and

The same value is because the decimal number is 7, and if the decimal number is different,

It is necessary to repeat the process more than the previous process. According to FIG. 4, since the number of crystal decimals is 7, it can be seen that the number smaller than the number of crystal decimals is calculated as the remaining values.

Hereinafter, a process in which the packet generator 110 generates another IP address every time through Equation (1) will be described in more detail. First, the packet generation unit 110 determines the permutation determination factor g to be 3, and determines the decimal fraction to be 4294967311 (the second power of 2 multiplied by 15), and the first decimal number is 2598. Then the second decimal number is 7794, the remainder of dividing 2598 by 3 times 4294967311. The packet generation unit 110 converts the decimal number 7794 into the IPv4 address, and generates the IP address 0.0.30.114. That is, the first IP address generated by the packet generation unit 110 is 0.0.30.114. In this embodiment, a description of how the packet generation unit 110 converts a decimal number into a dot-decimal IP address is a well-known method in the related art, and a description thereof will be omitted.

Then, the packet generation unit 110 converts 23382, which is the third decimal number, and 70146, which is the fourth decimal, into IP addresses, and generates 0.0.91.86 and 0.1.18.2, respectively. If the above process is continuously repeated, the decimal equivalent to 2598, which is the first decimal number, is calculated as the left side value of Equation 1. The packet generation unit 110 regards all the IP addresses that can be generated as being generated, Stop generating IP addresses for permutations.

It is possible to generate an IP address that can be generated in the IPv4 address space in order and to scan the IP address in the same manner as in the prior art, which may cause an overload of the destination network and a possibility that the scanning result is inconsistent due to a temporary network error However, if an IP address is generated through a random circulation scheme according to this alternative embodiment, the above-described problem is minimized. This optional embodiment can be performed by an address generating thread defined in the process executed by the packet generating unit 110. [

The packet generating unit 110 generates and transmits a packet to a plurality of IP addresses generated through the above process. The packet generator 110 removes a check sum of an Ethernet header that is not changed while scanning device information of a device located at each IP address when generating and transmitting a packet with each IP address This reduces the overhead of the Linux kernel by preventing the Linux kernel from performing unnecessary checks on every packet. The packet generation unit 110 performs an operation of removing the checksum of the Ethernet header through a thread separate from the address generation thread described above.

The response information calculation unit 130 receives the response packet corresponding to the packet transmitted to the plurality of IP addresses, and calculates the response information combining the response packets received for each IP address. The response packet includes the device information of the object Internet devices corresponding to the IP address, and the response information includes the device information of the object Internet devices corresponding to all the IP addresses generated by the packet generation unit 110.

According to the embodiment, unlike the above, the response packet transmitted from the object Internet devices may contain only confirmation information for establishing the communication system prior to transmitting the device information. In this case, the response type scan thread requests the object Internet device to send the device information again once more.

In general, the transmission and reception of packets between remote devices is based on a transmission control protocol (TCP). Therefore, when the packet generating unit 110 generates a packet and transmits it to each IP address (SYN). ≪ / RTI > The object Internet apparatus corresponding to each IP address that receives the synchronization request message SYN generates a synchronization acknowledgment message (SYN-ACK) and transmits it to the response information calculation unit 130. [ The packet generating unit 110 or the response information calculating unit 130 must send an acknowledgment message (ACK) to each of the object Internet devices in accordance with 3-way handshaking. In the present invention, The communication for synchronization is terminated, which enables verification of the response of the object Internet device by a minimum packet exchange.

In an alternative embodiment, the response information calculation unit 130 may calculate the response information through a method of processing a response packet through a kernel area and processing at a user end. According to this alternative embodiment, the process of copying every time to process the response packet is omitted, and the overhead of the response information calculation unit 130 can be reduced.

5 is a diagram schematically showing that the response information calculation unit passes the response packet through the kernel area and processes it at the user end.

Referring to FIG. 5, it can be seen that the response packet passes through the hardware 510 and the kernel area 530 as it is and is processed at the user terminal 570 immediately via the library 550. Here, the user terminal 570 includes at least one application that receives the response packet through the library and shares the data processing result of the response packet.

In FIG. 5, the library 550 may be a DPA library according to Data Plane Acceleration (DPA) technology. An example of the data plane acceleration technique is variously described in the already-disclosed documents (the documents listed in the table of the non-patent literatures in the prior art documents), so a detailed description thereof will be omitted.

Hereinafter, description on Fig. 3 will be described.

The division processing unit 150 divides the response information calculated by the response information calculation unit 130 according to the number of processes set in advance and divides the divided response information through a plurality of threads included in each process.

First, the division processing unit 150 receives the response information from the response information calculation unit 130, and divides the response information according to the number of processes. The number of processes may be a predetermined value and may be changed to an optimum value at a specific time by the administrator of the system according to the present invention. Based on the size, the number of processes suitable for dividing and processing the response information may be arbitrarily determined.

When a response information processing program stored in advance in the partitioning processing unit 150 is executed, at least one process is generated and performed according to the code or script of the program. The division processing unit 150 determines how many processes are included and divides the response information according to the number of processes. For example, if the size of the response information is 1 gigabyte, and there are four processes, the size of the divided response information that each process is responsible for can be 250 megabytes. Each process is independent and takes up a separate memory, so you can allocate different workloads depending on the characteristics of each process.

Subsequently, the division processing unit 150 causes the divided response information to be processed through a plurality of threads included in each process. At least one thread is included in the process. A thread is a set of executable code that exists inside a process. When a process is created, one main thread is created to handle most of the work, and when the main thread ends, the process is terminated. In the present invention, the response information is processed through a multi-thread method. Unlike the multi-thread process, the multi-thread can share the memory in the process between the threads, In the case of a core CPU (Central Processing Unit), it is possible to increase the overall operation speed by having each CPU take charge of one thread.

In an alternative embodiment, the partitioning processor 150 divides the response information into different sizes, and the size of the divided response information divided by the thread may be all the same. Through the above-described process, the division processor 150 divides the response information into a number of processes in which response packets are integrated into one, and the division processor 150 divides response information into different sizes in this division process. At this time, the criterion for dividing the response information into different sizes by the division processing unit 150 may be various. As an example, the division processor 150 may divide the response information into different sizes based on the size of the memory used by the process. That is, the size of the response information processed by a process using 80 MB of memory can be divided into different sizes so that the size of the response information is twice the size of the response information processed by a process using 40 MB of memory.

Once the divided response information is allocated to each process through the above process, the plurality of threads generated in the process divides the response information divided by the division processing unit 150 into the number of threads again and processes the response information. As an example, if five threads are created in a process that processes 50 MB of response information, each thread will process 10 MB of response information.

6 is a diagram showing a structure in which a plurality of threads generated in a plurality of processes divide and process response information.

FIG. 6 is a structure designed to prevent the performance bottleneck of the system due to the redundant fingerprinting process described in FIG. 1, and will be described with reference to FIGS. 1 and 3 for convenience of explanation.

First, the response information is generated as a result of scanning an IP address. The response information may be the JSON (JavaScript Object Notation) format, which is the most common method of representing data when data is exchanged on the Internet. The response information is divided by the number of processes by the division processing unit 150, and the divided response information may have different sizes.

The response information assigned to each process is processed by a plurality of threads created in the process. More specifically, a thread in the process performs an indexing operation to reduce the load of data search for the divided response information and a format conversion operation to reduce the load of data parsing. The fast parallel structure 610 for performing an indexing operation and a format conversion operation by a plurality of threads in a plurality of processes is a structure for preventing a performance bottleneck in each process described in FIG.

Hereinafter, the process of the reactive scan thread 1 (hereinafter, "target thread") of the process 1 in the fast parallel structure 610 will be described. The division processing unit 150 divides the response information into 10 processes, which are the number of processes, and allocates them to the respective processes. Processes 1 to 10 generate a plurality of threads in the process, and the allocated response information is processed by a plurality of threads.

As an example, the target thread receives and processes the result obtained by dividing the response information divided by the process N again. The target thread receives the packet from the packet generating unit 110 from the response information, specifies the IP address of the object Internet apparatus that has transmitted the response packet, additionally requests the operating system information (apparatus information) from the object Internet apparatus, do. The target thread adjusts the field order in the same order as the field order defined in the rule file in which the operating system information is stored in advance. The number of fields of the operating system information collected in this process is used as the metadata of the operating system information, . Here, the rule file is a reference file used in a fingerprinting process described later, and has been described in the background art.

The target thread finally parses and sends the collected reactive scan results to a queue, where the reactive scan results sent from the plurality of threads are accumulated in order.

The process of adjusting the operating system information in the same order as the field order defined in the rule file and the process of adding the number of collected fields to the meta data of the operating system information are performed by indexing for load reduction of data retrieval in the fingerprinting process The process of parsing the reactive scan result by the target thread and transmitting the result to the queue corresponds to a format conversion process for reducing data parsing in the fingerprinting processor.

7 is a diagram illustrating a process in which response information is assigned to a thread to be processed in a thread created in a process in a fast parallel structure.

Referring to FIG. 7, it can be seen that IP scan result file 1 710, process 1 730, IP scan result file N 750, and process N 770 are included. For convenience of explanation, 3 will be described.

First, the IP scan result file 1 710 indicates one of pieces of response information divided by the division processing unit 150 according to the number of processes. The partitioning processor 150 divides the response information into N pieces of the number of processes, and the size of the divided response information may be different depending on the memory occupied by each process. 7, the size of the IP scan result file 1 (710) is 125 MB.

Process 1 730 processes the IP scan result file 1 (710). Process 1 730 generates 100 response type scan threads, and controls each thread to divide and process IP scan result file 1 710. More specifically, the process 1 730 divides the size of the IP scan result file 1 710 by 100, which is the number of threads, so that the IP scan result file 1 710 can be processed equally without missing or duplicated, The file is accessed and processed at an offset as much as the number of bytes. As an example, the reactive scan thread 1 generated in the process 1 730 is allocated and processed in a period from 0 MB to 1.25 MB of the IP scan result file 1 (710), and the response type generated in the process 1 (730) The scan thread 100 allocates and processes an interval of 123.75 MB to 125 MB of the IP scan result file 1 (710).

The IP scan result file N 750 represents one of the pieces of response information divided by the division processing unit 150 according to the number of processes, which is different from the IP scan result file 1 710. 7, the size of the IP scan result file N 750 is 120 MB.

Process N770 processes the IP scan result file N (750). Process N770 generates 100 reactive scan threads and controls each thread to divide and process IP scan result file N 750. [ As an example, the reactive scan thread 2 generated in the process N 770 is allocated and processed in a period from 1.2 MB to 2.4 MB in the IP scan result file N 750, and the response generated in the process N 770 Type scan thread 100 allocates and processes an interval of 123.8 MB to 125 MB of the IP scan result file N 750.

As shown in FIG. 7, the size of the divided response information processed by the process may be different according to the memory occupied by the process, etc., and may be generated by a reactive scan thread that is generated in the same process and performs a reactive scan operation The size of the response information to be allocated is the same. The responsive scan threads in the process receive the IP address from the response information, receive the operating system information through the additional communication with the object Internet device corresponding to the IP address, and perform the indexing and parsing And perform the operation.

The description with reference to FIG. 3 will be continued below.

The device information determination unit 170 determines device information of each device that has transmitted the response packet based on the result of processing the divided response information through a plurality of fingerprinting processes.

First, the device information determination unit 170 receives response information that is divided and processed through the plurality of threads from the division processing unit 150. [ Herein, the divided response information is information that has been indexed and parsed for proceeding with the fingerprinting process by a plurality of threads, and matches the rule file in the fingerprinting process, Can be grasped.

In the fingerprinting process, the device information of the destination Internet devices that send the response packet is determined by searching for a result matching the stored rule file with the previously stored response information. According to the fingerprinting process in the existing structure of FIG. 1, the data is parsed from the response-type scan result, the parsing result is made into one string variable, and then the string comparison operation is performed with all the contents of the rule file. However, according to the present invention, in accordance with the high-speed parallel structure described in FIG. 6, a plurality of threads are used as a preliminary task for the fingerprinting process, as a format for reducing the load of data parsing By performing the conversion, a performance bottleneck (a phenomenon in which the processing speed is significantly slowed down due to delay in input / output) is prevented when the fingerprinting process proceeds.

In an alternative embodiment, the device information acquiring unit 170 may process the plurality of fingerprinting processes in parallel in a queue and process the divided response information, integrate the parallelly processed response information, The device information of each device can be grasped based on the response information.

FIG. 8 is a diagram illustrating a process in which information stored in a queue is processed in parallel through a plurality of fingerprinting processes.

First, the IP scan result is divided into 10 processes in a high-speed parallel structure, a total of 10 multiplied by n threads, and the divided processing result is accumulated in a queue 1. The device information obtaining unit 170 generates a plurality of fingerprinting processes and controls the information stored in the queue 1 to be processed in parallel.

In FIG. 8, when a plurality of fingerprinting processes are performed in parallel, data processed by the reactive scan thread in queue 1 is collected in the same order as the field order defined in the rule file, and the matching process with the rule file Since the number of collection fields is included as the metadata of the divided response information in order to reduce the range of the search, the performance bottleneck does not occur during the fingerprinting process.

The information processed by the responsive scan thread is parsed and represented as a string variable that contains specific information but generally has the same order as the field order defined in the rule file no. If the information about some fields is omitted from the information processed by the reactive scan thread, the fingerprinting process does not need to match the rule file with the rule file.

For example, if the information of the rule file is recorded in accordance with the field order of 12345, and the device information of a certain device before processing by the responsive scan thread is 531, the reactive scan thread writes 531 to the field The number of fields collected is changed to 135 according to the order, and the information that the number of collected fields is three out of five is additionally calculated. Thereafter, the device information acquiring unit 170 can grasp the device information of the device in such a manner that one of the fingerprinting processes that are processed in parallel matches the information processed by the rule file and the reactive scan thread, Unlike the fingerprinting process of FIG. 1, information on the order and number of fields already exists, and can be processed quickly without performance bottlenecks.

When a plurality of fingerprinting processes are processed in parallel, the device information acquiring unit 170 causes the process result of each process to be sent to the queue 2, and the device information acquiring unit 170 acquires a new process And concatenates the response information processed in parallel based on the stacking order in queue 2 into one. In response to the request for transmission of the device information of the reactive scan thread, the device information acquiring unit 170 transmits the response packet when the packet generating unit 110 sends the packet through the integrated response information, The device information of the devices transmitting the information can be grasped collectively and the obtained device information can be generated as a JSON type result file for each device.

In the present invention, processing data through queues 1 and 2 before and after a plurality of fingerprinting processes is for processing data that is inputted at a high speed while a plurality of processes share a memory. When a plurality of processes write to a plurality of files, performance is deteriorated due to frequent disk input / output (I / O). Therefore, a memory queue is processed as shown in FIG. 8, To remove it.

9 is a flowchart illustrating an example of a method of collecting device information using the Internet according to the present invention.

Since the method according to FIG. 9 can be implemented by the system according to FIG. 3, the description of FIG. 3 will not be repeated below, and for convenience of description, do. The system according to the present invention includes a packet generation unit, a response information calculation unit, a division processing unit, and a device information determination unit.

First, the packet generating unit generates a plurality of IP addresses and transmits the packet to the generated IP address (S910).

As an alternative embodiment of step S910, the packet generator may generate an IP address through a formula using a circulation and a preset prime number as a variable. The mathematical formulas that can be used in this optional embodiment have already been described in Equation (1).

Then, the response information calculation unit receives the response packet from the device having the IP address of the packet that transmitted the packet, and calculates the response information combining the response packet received for each IP address (S930).

In an alternative embodiment of the step S930, the response information calculation unit may calculate the response information in such a manner that the response packet received from the device of the IP address to which the packet is transmitted passes through the kernel area and is processed at the user end.

In another alternative embodiment of step S930, the response information calculator may calculate the response information via data plane acceleration (DPA).

As another alternative embodiment of step S930, the packet transmitted by the packet generator to the apparatus of the IP address is a synchronization request packet (SYN packet) of the transmission control protocol, and the response information calculator is a response packet to the synchronization request packet, After receiving the acknowledgment packet (SYN-ACK packet), it does not send the acknowledge packet (ACK) packet again, ends the connection with the device of the corresponding IP address through the reset (RST) flag, It can also be verified.

The division processing unit divides the response information combining the response packets according to the number of the preset processes, and controls the divided response information to be divided through a plurality of threads included in each process (S950).

The response information incorporating the response packet includes information on the IP address of the device that has transmitted the packet from the packet generation unit to the response packet among the numerous IP addresses generated by the packet generation unit. The division processing unit divides the response information in which the response packet is integrated according to the number of the preset processes, and controls the divided response information to be divided into the number of threads once again in the process.

In this process, each thread obtains the IP address from the IP address scanning result included in the response information, and then receives the device information from the device corresponding to the IP address. The thread collects the device information in the same order as the field order of the rule file so that the device information on all the devices can be quickly identified through quick matching with the rule file in the fingerprinting process, The number of collection fields is additionally recorded as metadata of each device information.

As an alternative embodiment of step S950, when the division processing unit divides the response information incorporating the response packet according to the number of processes, the size of the divided response information is different from the size of the divided response information divided by the thread, May all be the same. This optional embodiment is due to the multi-threaded and multi-thread functional characteristics. When there are a plurality of processes, each process occupies an independent and distinct memory, but when a plurality of threads are created in the process, each thread can share the memory in the process and use it because the conversion speed is faster.

The response information divided according to the number of processes of the division processing unit may be referred to as first divided response information and the response information obtained by dividing the divided response information in accordance with the number of threads equally according to the number of threads, Information.

The device information determination unit processes the response information divided by each thread of the division processing unit through a plurality of fingerprinting processes and grasps the device information of each device that transmitted the response packet based on the processed result (S970) .

The fingerprinting process is a process for receiving both the IP scanning result and the reactive scanning process result of the reactive scan thread and grasping the device information (operating system information) of the corresponding IP address. For fast data processing, the device information acquiring unit generates a plurality of fingerprinting processes to process data, and grasps the device information of each device based on the result of processing by the fingerprinting process.

As an alternative embodiment of step S970, the apparatus information obtaining unit may be configured such that the plurality of fingerprinting processes process queued response information in parallel, integrate the parallelly processed response information, The device information of the devices can be grasped. In this optional embodiment, the device information acquiring unit has been described with reference to FIG. 8 that device information of each device can be generated as a result file in the form of JSON (JavaScript Object Notation).

In the case of a large number of Internet service terminals connected to the Internet, there are limitations in the performance of software such as CPU and memory, and there is a problem in that software is vulnerable to security threats due to limited computing ability. In order to detect security weakness of Internet service terminal and make instant security patch, information of terminals connected to the Internet should be collected and managed at a fast cycle. According to the present invention, device information of object Internet devices connected to the Internet can be collected and processed by using a number of lightweight threads, and the collected device information can be grasped through a separate parallel process, It is possible to provide a service that helps maintain the latest update state of the operating system of the terminal.

The embodiments of the present invention described above can be embodied in the form of a computer program that can be executed on various components on a computer, and the computer program can be recorded on a computer-readable medium. At this time, the medium may be a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, an optical recording medium such as CD-ROM and DVD, a magneto-optical medium such as a floptical disk, , A RAM, a flash memory, and the like, which are specifically configured to store and execute program instructions.

Meanwhile, the computer program may be designed and configured specifically for the present invention or may be known and used by those skilled in the computer software field. Examples of computer programs may include machine language code such as those produced by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like.

The specific acts described in the present invention are, by way of example, not intended to limit the scope of the invention in any way. For brevity of description, descriptions of conventional electronic configurations, control systems, software, and other functional aspects of such systems may be omitted. Also, the connections or connecting members of the lines between the components shown in the figures are illustrative of functional connections and / or physical or circuit connections, which may be replaced or additionally provided by a variety of functional connections, physical Connection, or circuit connections. Also, unless explicitly mentioned, such as " essential ", " importantly ", etc., it may not be a necessary component for application of the present invention.

The use of the terms " above " and similar indication words in the specification of the present invention (particularly in the claims) may refer to both singular and plural. In addition, in the present invention, when a range is described, it includes the invention to which the individual values belonging to the above range are applied (unless there is contradiction thereto), and each individual value constituting the above range is described in the detailed description of the invention The same. Finally, the steps may be performed in any suitable order, unless explicitly stated or contrary to the description of the steps constituting the method according to the invention. The present invention is not necessarily limited to the order of description of the above steps. The use of all examples or exemplary language (e.g., etc.) in this invention is for the purpose of describing the present invention only in detail and is not to be limited by the scope of the claims, It is not. It will also be appreciated by those skilled in the art that various modifications, combinations, and alterations may be made depending on design criteria and factors within the scope of the appended claims or equivalents thereof.

Claims (15)

Wherein the packet generating unit generates a plurality of Internet protocol (IP) addresses through a formula using a circulation and a preset prime number as variables, and transmits a packet to the generated plurality of IP addresses ;
A response information calculation step in which a response packet corresponding to the transmitted packet is received by the response information calculation unit and response information obtained by combining response packets received for each IP address is calculated;
A division processing step of dividing the calculated response information according to the number of predetermined processes and dividing the divided response information through a plurality of threads included in each process; And
And a device information grasping step of grasping device information of each device that has transmitted the response packet based on a result of processing the divided response information through a plurality of fingerprinting processes,
The packet generation step includes:
When a valid IP address range of an IP address that can be generated according to IPv4 is recognized by an address generating thread defined in a process executed by the packet generation unit, An IP address is generated within a predetermined number of addresses,
The predetermined number of prime numbers,
It is the closest prime number to the total number of IP addresses that can be defined in IPv4,
The transmitted packet is transmitted,
Wherein the packet generator is a packet from which a check sum of an Ethernet header not modified is removed,
Wherein the dividing step comprises:
Wherein the plurality of threads perform an indexing operation for reducing a load of data retrieval with respect to the divided response information and a format conversion operation for reducing a load of data parsing, Processing information,
The generated plurality of IP addresses are determined through the following equation,

G is a number smaller than the predetermined number of decimals determined by the packet generation unit,
Wherein p is the predetermined prime number,
remind

And

Is an i-th and (i + 1) -th decimal number, and the IP address is an address obtained by converting the i + 1-th decimal in accordance with the IPv4. delete The method according to claim 1,
The response information calculation step may include:
And the response information is calculated in such a manner that the received response packet is passed through a kernel area and processed by a user terminal. The method according to claim 1,
The response information calculation step
Wherein the response information is calculated through Data Plane Acceleration (DPA). The method according to claim 1,
Wherein the dividing step comprises:
The sizes of the divided response information are different from each other,
Wherein the size of the divided response information divided by the thread is all the same. The method according to claim 1,
In the device information holding step,
A plurality of fingerprinting processes are performed in parallel on the divided response information stacked in a queue, the parallel processed response information is integrated, and the device information of each device based on the integrated response information The method comprising the steps of: acquiring device information using the Internet; The method according to claim 1,
The transmitted packet is a SYN packet of a transmission control protocol,
The response information calculation step may include:
Receiving a SYN-ACK packet as a response packet for the SYN packet, and terminating the connection with the device corresponding to the IP address through the RST flag. A computer-readable recording medium storing a program for executing the method according to any one of claims 1 to 7. A packet generating unit for generating a plurality of internet protocol (IP) addresses through a mathematical expression using a circulation and a predetermined prime number as parameters, and transmitting the packets to the generated plurality of IP addresses;
A response information calculation unit for receiving a response packet corresponding to the transmitted packet and calculating response information combining response packets received for each IP address;
A division processing unit for dividing the calculated response information according to the number of predetermined processes and dividing the divided response information through a plurality of threads included in each process; And
And a device information acquisition unit for acquiring device information of each device that has transmitted the response packet based on a result of processing the divided response information through a plurality of fingerprinting processes,
When a valid IP address range of an IP address that can be generated according to IPv4 is recognized by an address generating thread defined in a process executed by the packet generation unit, Generates an IP address within a predetermined number of valid addresses,
The predetermined number of prime numbers,
It is the closest prime number to the total number of IP addresses that can be defined in IPv4,
The transmitted packet is transmitted,
Wherein the packet generator is a packet from which a check sum of an Ethernet header not modified is removed,
The division processing unit,
Wherein the plurality of threads perform an indexing operation for reducing a load of data retrieval with respect to the divided response information and a format conversion operation for reducing a load of data parsing, Processing information,
The generated plurality of IP addresses are determined through the following equation,

G is a number smaller than the predetermined number of decimals determined by the packet generation unit,
Wherein p is the predetermined prime number,
remind

And

Is an i-th and (i + 1) -th decimal number, and the IP address is an address obtained by converting the (i + 1) -th decimal in accordance with the IPv4. delete 10. The method of claim 9,
Wherein the response information calculation unit comprises:
Wherein the response information is calculated in a manner that the received response packet is passed through a kernel area and processed by a user terminal. 10. The method of claim 9,
The response information calculation unit
Wherein the response information is calculated through Data Plane Acceleration (DPA). 10. The method of claim 9,
The division processing unit,
The sizes of the divided response information are different from each other,
Wherein the size of the divided response information divided by the thread is all the same. 10. The method of claim 9,
Wherein the device-
A plurality of fingerprinting processes are performed in parallel on the divided response information stacked in a queue, the parallel processed response information is integrated, and the device information of each device based on the integrated response information And collecting device information using the Internet. 10. The method of claim 9,
The transmitted packet is a SYN packet of a Transmission Control Protocol (TCP)
Wherein the response information calculation unit comprises:
Receiving a SYN-ACK packet, which is a response packet for the SYN packet, and terminating the connection with the device corresponding to the IP address through the RST flag.

Images