WO2023241202A1

WO2023241202A1 - Supervision engine for network assets

Info

Publication number: WO2023241202A1
Application number: PCT/CN2023/088595
Authority: WO
Inventors: 戴宪宇; 蔡波涛; 李仁杰; 华驰
Original assignee: 江苏信息职业技术学院
Priority date: 2022-06-17
Filing date: 2023-04-17
Publication date: 2023-12-21
Also published as: CN115208634A

Abstract

The present invention mainly relates to the technical field of network security, and particularly relates to a supervision engine for network assets. The supervision engine comprises the steps of: discovering network assets by using an ICMP and a TCP; then performing fingerprint recognition and vulnerability identification on these assets; and restoring devices with vulnerabilities, so as to defend against network intrusion in real time. In the present invention, multi-dimensional accurate profiling is performed on various software and hardware network assets, such as Web assets, operating systems, middleware, network devices, security devices and Internet of Things devices, and a comprehensive asset information base is established, such that the defects of a traditional asset management mode of a user can be effectively overcome, the user is helped in getting through an informatization management process, and the working efficiency of security operation and maintenance is improved, and unknown assets are then accurately found and handled in a timely manner, thereby clearing risks in a timely manner. The maximum advantage is automatic and continuous monitoring and analysis, so that an important security risk is found in a timely manner, and the extensibility is high, thereby facilitating docking with an existing management system of an enterprise.

Description

A supervision engine for network assets

Technical field

The invention relates to the field of network security technology, and in particular to a monitoring engine for network assets.

Background technique

The current network space of the Internet has expanded rapidly from the initial chaos to the present. Internet devices are also used more and more widely. The proliferation of Internet devices around the world has made it impossible to continue to include IPV4 addresses. It is conceivable that in the future, there will be more and more devices Connected in the Internet, based on the extension and expansion of the Internet, the extension of human life extends to the exchange of information and communication between all items. However, the increasingly informatized era is also accompanied by more and more risks. , which requires quickly understanding the network assets in the intranet through the cyberspace supervision engine. The cyberspace supervision engine plays a huge role in network security fields such as cyberspace mapping, situational awareness, and enterprise asset security management.

Traditional cyberspace mapping engines mainly use network detection, collection or mining technologies to obtain network attributes of physical resources such as network equipment and virtual resources such as users and services. Their main functions are single, the identification is inaccurate, and they do not have defense functions.

To sum up, the present invention provides a network asset supervision engine to solve the above problems.

Contents of the invention

In view of the above situation, in order to overcome the shortcomings of the existing technology, the purpose of the present invention is to provide a network asset supervision engine that integrates discovery, detection, management, and defense, and can greatly improve the security protection capabilities of network equipment.

The above technical objectives of the present invention are achieved through the following technical solutions:

A network asset supervision engine is characterized by mainly including the following specific steps:

Step 1: Network service identification;

Step 1.1: Use the ICMP protocol to detect the IP to discover the surviving hosts in the IP segment and add the surviving host IP to the list; for the non-surviving IP, use the TCP protocol again to detect the data packets sent to the specific port. This can both The greatly improved recognition speed can also increase the recognition accuracy;

Step 1.2: Send a TCP packet to the surviving host port, and determine the open port of the host based on the content of the returned packet;

Step 2: Add the identification results of the open ports of the surviving hosts to the feature database and perform fingerprint identification on the open ports;

Step 2.1: Send a specific TCP packet to the open port, add the data returned by the port to the rule base, and determine the service running on the port based on the data characteristics;

Step 2.2: Perform fingerprint identification on the port using the W service to determine the type of running WEB service;

Step 3: Send specific data packets based on the identified services, and judge the returned content to detect whether it contains specified service vulnerabilities;

Step 4: Specify corresponding defense methods based on the detected vulnerabilities;

Step 5: Monitor intranet assets to defend against new intrusions and vulnerabilities;

Step 6: Input the results of steps 1-5 into the WEB page to facilitate user management.

Further, the step 1.1 is specifically:

Step 1.11: Since ICMP packets are sent and received very quickly, we first use the ICMP protocol to scan, send ICMP packets to the scanned IP segments, classify the IPs with returned data as surviving host IPs, and add the surviving IPs to the list for subsequent scanning. ;

Step 1.12: Some hosts will intercept the ICMP protocol, so the unrecognized hosts will use the TCP protocol for detection again. TCP is a reliable connection-oriented protocol. Each process of a complete TCP session has different states. Use TCP The protocol sends data to a specific port, based on the connection data Determine whether the host is alive.

Further, the step 1.2 is specifically:

Step 1.21: Perform port survival detection on the surviving host IP. According to the TCP protocol, the port in the closed state will respond to the RST packet when receiving the detection packet, while the port in the listening state ignores the detection packet. According to the detection packet Depending on the settings of each flag bit, TCP covert scanning is divided into four types: SYN/ACK scanning, FIN scanning, XMAS (Christmas tree) scanning and NULL scanning. Both SYN/ACK scanning and FIN scanning bypass the first step of the TCP three-way handshake process. , send SYN/ACK packet or FIN packet directly to the destination port. Because TCP is a connection-based protocol, the target host thinks that the SYN packet that the sender should send in the first step has not been sent, thus defining an error in the connection process this time and will send An RST packet to reset the connection, which is exactly what the scan needs. As long as there is a response, it means that the target system exists and the target port is closed.

Further, the step 2.1 is specifically:

Step 2.11: Due to different service ftp, http will have different return results. These results are used as fingerprints and matched with the fingerprints of the database to identify and mark the service corresponding to the port.

Further, the step 2.2 is specifically:

Step 2.21: Since there are various WEB systems, the ports identified as http and https in step 2.1 will be fingerprinted again. The WEB system will contain some characteristic strings in static files (such as html, js, css). Even if not, the fixed URL file is also a characteristic character; for example, WordPress will include wp-admin in robots.txt, the default style will include generator = wordpress xx on the homepage, the page will include wp-content path, etc. , and by analogy, almost all WEBs will have similar fingerprint characteristics. The way to identify WEB fingerprints is to obtain a specific path and determine the return text under the path (through md5 or regular expressions). There are related fingerprints in the fingerprint library. The corresponding fingerprint can be used to identify the WEB application to which the URL belongs.

Further, the step 3 is specifically:

Step 3.1: Scan based on the vulnerability database. First, construct the scanning environment model, model and analyze the possible vulnerabilities in the system, past hacker attack cases and the security configuration of the system administrator. Secondly, based on the analysis results, generate A set of standard vulnerability database and matching patterns. Finally, the program automatically performs scanning based on the vulnerability database and matching patterns. The accuracy of vulnerability scanning depends on the integrity and effectiveness of the vulnerability database;

Step 3.2: Plug-in-based scanning. Plug-ins are subroutine modules written in scripting languages. The scanner can perform scanning by calling the plug-in. Adding new functions plug-ins can enable the scanner to add new functions or add vulnerability points that can be scanned. Type and quantity, you can also upgrade the plug-in to update the characteristic information of the vulnerability points, so as to obtain more accurate results. The plug-in technology makes the upgrade and maintenance of the vulnerability scanning software relatively simple, and the use of a dedicated script language also simplifies the writing of new The programming work of plug-ins makes the vulnerability scanning software highly scalable.

Further, the step 4 is specifically:

Step 4.1: The vulnerability repair phase involves the cooperation between security personnel and operation and maintenance personnel; the vulnerabilities detected in step 3 are displayed on the WEB side for operation and maintenance personnel to view. When the operation and maintenance personnel convert the vulnerability to be repaired to the repaired state, the security personnel The vulnerability repair situation must be reviewed. If the vulnerability still exists after scanning again, it will be classified as a repair failure. Vulnerabilities that failed to be repaired must be converted back to the vulnerability discovery state. If the vulnerability does not exist after scanning again, it will be classified as verified. At the same time, if the vulnerability reappears due to changes in the asset itself during multiple scanning processes in the later period, the vulnerability status will be converted to rediscovered, and the rediscovered vulnerability must be promptly transferred to the pending repair status.

Further, the step 5 is specifically:

Step 5.1: Compare the data flowing through the computer's memory with the signatures of the cloud virus database (including virus definitions) to determine whether it is a virus. Use heuristic technology and based on the original feature value identification technology, Analyze suspicious program samples based on anti-virus samples. If the characteristic value comparison is not met, determine whether the specific purpose of the program is a virus or malware based on the win32API functions called by the decompiled program code (feature combination, frequency of occurrence, etc.). If the judgment conditions are met, an alarm will be issued to prompt the user to find suspicious programs, thereby achieving the purpose of defending against unknown viruses and malware. It solves the shortcomings of a single comparison of characteristic values. It uses artificial intelligence algorithms and has the ability to "self-learn and evolve" without the need for frequent By upgrading the signature database, you can be immune to most mutant viruses. Through a large number of mesh clients, you can monitor abnormal software behavior in the network, obtain the latest information on Trojans and malicious programs on the Internet, and push it to the server for automatic analysis and processing. Then distribute virus and Trojan solutions to each client.

Further, the step 6 is specifically:

Step 6.1: Import the results of steps 1-5 into the database and display them to users in a WEB-visualized form for users to monitor the status of internal network assets in real time.

To sum up, the present invention has the following beneficial effects:

This invention performs multi-dimensional accurate portraits of various software and hardware network assets such as Web assets, operating systems, middleware, network equipment, security equipment, and Internet of Things equipment, and establishes a comprehensive asset information database, which can effectively complement users' traditional asset management methods. It helps users open up the information management process, improve the efficiency of security operation and maintenance, accurately discover unknown assets and dispose of them in a timely manner, and achieve timely risk clearance. The biggest advantage is automatic and continuous monitoring and analysis, timely Discover important security risks and have strong scalability, making it easy to connect with the company's existing management system.

Description of the drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of this application, but do not constitute an improper limitation of the present invention. In the accompanying drawings:

Figure 1 is a schematic diagram of the overall structure of Embodiment 1 of the present invention.

Detailed ways

The foregoing and other technical contents, features and effects of the present invention will be clearly presented in the following detailed description of the embodiment with reference to the accompanying drawing 1. The structural contents mentioned in the following embodiments are all referred to the accompanying drawings of the description.

Various exemplary embodiments of the present invention will be described below with reference to the accompanying drawings.

Example 1:

A supervision engine for network assets, which mainly includes the following specific steps:

Step 1: Network service identification.

Step 1.1: Use the ICMP protocol to detect the IP to discover the surviving hosts in the IP segment and add the surviving host IP to the list; for the non-surviving IP, use the TCP protocol again to detect the data packets sent to the specific port. This can both Significantly increasing the recognition speed can also increase the recognition accuracy. Among them, step 1.1 is specifically:

Step 1.11: Since ICMP packets are sent and received very quickly, we first use the ICMP protocol to scan, send ICMP packets to the scanned IP segments, classify the IPs with returned data as surviving host IPs, and add the surviving IPs to the list for subsequent scanning. .

Step 1.12: Some hosts will intercept the ICMP protocol, so the unrecognized hosts will use the TCP protocol for detection again. TCP is a reliable connection-oriented protocol. Each process of a complete TCP session has different states. Use TCP The protocol sends data to a specific port and determines whether the host is alive based on the connection data.

Step 1.2: Send a TCP packet to the surviving host port, and determine the open port of the host based on the content of the returned packet. Step 1.2 is specifically as follows:

Step 1.21: Perform port survival detection on the surviving host IP. According to the TCP protocol, it is closed. The port in the state will respond to the RST packet when receiving the detection packet, while the port in the listening state will ignore the detection packet. According to the different flag bit settings in the detection packet, TCP covert scanning is divided into SYN/ACK scanning, There are four types of FIN scanning, XMAS (Christmas tree) scanning and NULL scanning. SYN/ACK scanning and FIN scanning bypass the first step of the TCP three-way handshake process and directly send SYN/ACK packets or FIN packets to the destination port, because TCP is based on The connection protocol. The target host believes that the SYN packet that the sender should send in the first step has not been sent, thus defining an error in the connection process. It will send a RST packet to reset the connection, and this is the result required for scanning. As long as If there is a response, it means that the target system exists and the target port is closed.

Step 2: Add the identification results of the open ports of the surviving host to the signature database and perform fingerprint identification on the open ports.

Step 2.1: Send a specific TCP data packet to the open port, add the data returned by the port to the rule base, and determine the service running on the port based on the data characteristics. Step 2.1 is specifically as follows:

Step 2.2: Perform fingerprint identification on the port using the W service to determine the type of running WEB service. Step 2.2 is specifically as follows:

Step 2.21: Since there are various WEB systems, the ports identified as http and https in step 2.1 will be fingerprinted again. The WEB system will contain some characteristic strings in static files (such as html, js, css). Even if not, the fixed URL file is also a characteristic character; for example, WordPress will include wp-admin in robots.txt, the default style will include generator = wordpress xx on the homepage, the page will include wp-content path, etc. , and by analogy, almost all WEBs will have similar fingerprint characteristics. The way to identify WEB fingerprints is to obtain a specific path, determine the return text under the path (through md5 or regular expressions), and store it in the fingerprint library. Based on the corresponding fingerprint, the WEB application to which the URL belongs can be identified.

Step 3: Send a specific data packet based on the identified service, and judge the returned content to detect whether it contains the specified service vulnerability. Step 3 is specifically as follows:

Step 3.1: Scan based on the vulnerability database. First, construct the scanning environment model, model and analyze the possible vulnerabilities in the system, past hacker attack cases and the security configuration of the system administrator. Secondly, based on the analysis results, generate A set of standard vulnerability database and matching patterns. Finally, the program automatically performs scanning based on the vulnerability database and matching patterns. The accuracy of vulnerability scanning depends on the integrity and effectiveness of the vulnerability database.

Step 4: Specify corresponding defense methods based on the detected vulnerabilities. Step 4 is specifically:

Step 5: Monitor intranet assets and defend against new intrusions and vulnerabilities. Step 5 is specifically:

Step 5.1: Compare the data flowing through the computer's memory with the signatures of the cloud virus database (including virus definitions) to determine whether it is a virus. Use heuristic technology and use anti-virus samples based on the original feature value recognition technology. Analyze suspicious program samples, and when there is no comparison of characteristic values, determine whether the specific purpose of the program is a virus or malware based on the win32API functions called by the decompiled program code (feature combination, frequency of occurrence, etc.). If the judgment conditions are met, that is The alarm prompts users to find suspicious programs to prevent unknown viruses and malware. It solves the shortcomings of single feature value comparison. It adopts artificial intelligence algorithms and has the ability of "self-learning and self-evolution", eliminating the need to frequently upgrade the feature library. It can be immune to most mutant viruses. Through a large number of meshed clients, it can monitor abnormal software behavior in the network, obtain the latest information on Trojans and malicious programs on the Internet, push it to the server for automatic analysis and processing, and then combine the viruses and The Trojan's solution is distributed to every client.

Step 6: Enter the results of steps 1-5 into the WEB page to facilitate user management. Step 6 is specifically:

The invention is a monitoring engine for network assets. It first uses ICMP and TCP protocols to discover network assets, then conducts fingerprint identification and vulnerability identification on these assets, and repairs equipment with vulnerabilities to prevent network intrusion in real time.

The above is a further detailed description of the present invention in combination with specific implementation modes, and it cannot be concluded that the specific implementation of the present invention is limited to this; for those skilled in the technical fields to which the present invention belongs and related, on the premise of thinking based on the technical solution of the present invention , the expansions made and the replacement of operating methods and data should all fall within the protection scope of the present invention.

Claims

A network asset supervision engine is characterized by mainly including the following specific steps:

Step 1: Network service identification;

Step 1.1: Use the ICMP protocol to detect the IP to discover the surviving hosts in the IP segment and add the surviving host IP to the list; for the non-surviving IP, use the TCP protocol again to detect the data packets sent to the specific port. This can both The greatly improved recognition speed can also increase the recognition accuracy;

Step 1.2: Send a TCP packet to the surviving host port, and determine the open port of the host based on the content of the returned packet;

Step 2: Add the identification results of the open ports of the surviving hosts to the feature database and perform fingerprint identification on the open ports;

Step 2.1: Send a specific TCP packet to the open port, add the data returned by the port to the rule base, and determine the service running on the port based on the data characteristics;

Step 2.2: Perform fingerprint identification on the port using the W service to determine the type of running WEB service;

Step 3: Send specific data packets based on the identified services, and judge the returned content to detect whether it contains specified service vulnerabilities;

Step 4: Specify corresponding defense methods based on the detected vulnerabilities;

Step 5: Monitor intranet assets to defend against new intrusions and vulnerabilities;

Step 6: Input the results of steps 1-5 into the WEB page to facilitate user management.
A network asset supervision engine according to claim 1, characterized in that said step 1.1 is specifically:

Step 1.11: Since ICMP packets are sent and received very quickly, we first use the ICMP protocol to scan, send ICMP packets to the scanned IP segments, classify the IPs with returned data as surviving host IPs, and add the surviving IPs to the list for subsequent scanning. ;

Step 1.12: Some hosts will intercept the ICMP protocol, so the unrecognized hosts will use the TCP protocol for detection again. TCP is a reliable connection-oriented protocol. Each process of a complete TCP session has different states. Use TCP The protocol sends data to a specific port and determines whether the host is alive based on the connection data.
A network asset supervision engine according to claim 1, characterized in that step 1.2 is specifically:

Step 1.21: Perform port survival detection on the surviving host IP. According to the TCP protocol, the port in the closed state will respond to the RST packet when receiving the detection packet, while the port in the listening state ignores the detection packet. According to the detection packet Depending on the settings of each flag bit, TCP covert scanning is divided into four types: SYN/ACK scanning, FIN scanning, XMAS (Christmas tree) scanning and NULL scanning. Both SYN/ACK scanning and FIN scanning bypass the first step of the TCP three-way handshake process. , send SYN/ACK packet or FIN packet directly to the destination port. Because TCP is a connection-based protocol, the target host thinks that the SYN packet that the sender should send in the first step has not been sent, thus defining an error in the connection process this time and will send An RST packet to reset the connection, which is exactly what the scan needs. As long as there is a response, it means that the target system exists and the target port is closed.
A network asset supervision engine according to claim 1, characterized in that step 2.1 is specifically:

Step 2.11: Due to different service ftp, http will have different return results. These results are used as fingerprints and matched with the fingerprints of the database to identify and mark the service corresponding to the port.
A network asset supervision engine according to claim 1, characterized in that step 2.2 is specifically:

Step 2.21: Due to the variety of WEB systems, the ports identified as http and https in step 2.1 will be subjected to WEB fingerprint identification again. The WEB system is in static files (such as html, js, css) will contain some characteristic strings, even if not, the fixed url file is also a characteristic character; for example, wordpress will include wp-admin in robots.txt, and the default style will include generator=wordpress xx on the homepage. In the page Will include wp-content path, etc., and so on. Almost all WEB will have similar fingerprint characteristics. The way to identify WEB fingerprint is to obtain a specific path and determine the return text under the path (through md5 or regular expression ), if there is a corresponding fingerprint in the fingerprint database, the WEB application to which the URL belongs can be determined.
A network asset supervision engine according to claim 1, characterized in that step 3 is specifically:

Step 3.1: Scan based on the vulnerability database. First, construct the scanning environment model, model and analyze the possible vulnerabilities in the system, past hacker attack cases and the security configuration of the system administrator. Secondly, based on the analysis results, generate A set of standard vulnerability database and matching patterns. Finally, the program automatically performs scanning based on the vulnerability database and matching patterns. The accuracy of vulnerability scanning depends on the integrity and effectiveness of the vulnerability database;

Step 3.2: Plug-in-based scanning. Plug-ins are subroutine modules written in scripting languages. The scanner can perform scanning by calling the plug-in. Adding new functions plug-ins can enable the scanner to add new functions or add vulnerability points that can be scanned. Type and quantity, you can also upgrade the plug-in to update the characteristic information of the vulnerability points, so as to obtain more accurate results. The plug-in technology makes the upgrade and maintenance of the vulnerability scanning software relatively simple, and the use of a dedicated script language also simplifies the writing of new The programming work of plug-ins makes the vulnerability scanning software highly scalable.
A network asset supervision engine according to claim 1, characterized in that step 4 is specifically:

Step 4.1: The vulnerability repair phase involves the cooperation between security personnel and operation and maintenance personnel; the vulnerabilities detected in step 3 are displayed on the WEB side for operation and maintenance personnel to view. When the operation and maintenance personnel convert the vulnerability to be repaired to the one that has been repaired, When the situation changes, security personnel must review the vulnerability repair status. If the vulnerability still exists after scanning again, it will be classified as a repair failure. For the vulnerability that failed to be repaired, it must be converted back to the vulnerability discovery state. If the vulnerability does not exist after scanning again, it will be classified as a repair failure. It is in the verified state. At the same time, if the vulnerability reappears due to changes in the asset itself during multiple scanning processes in the later period, the vulnerability status will be converted to rediscovered. Vulnerabilities discovered again must be transferred to the pending state in a timely manner.
A network asset supervision engine according to claim 1, characterized in that step 5 is specifically:

Step 5.1: Compare the data flowing through the computer's memory with the signatures of the cloud virus database (including virus definitions) to determine whether it is a virus. Use heuristic technology and use anti-virus samples based on the original feature value recognition technology. Analyze suspicious program samples, and when there is no comparison of characteristic values, determine whether the specific purpose of the program is a virus or malware based on the win32API functions called by the decompiled program code (feature combination, frequency of occurrence, etc.). If the judgment conditions are met, that is The alarm prompts users to find suspicious programs to prevent unknown viruses and malware. It solves the shortcomings of single feature value comparison. It adopts artificial intelligence algorithms and has the ability of "self-learning and self-evolution", eliminating the need to frequently upgrade the feature library. It can be immune to most mutant viruses. Through a large number of meshed clients, it can monitor abnormal software behavior in the network, obtain the latest information on Trojans and malicious programs on the Internet, push it to the server for automatic analysis and processing, and then combine the viruses and The Trojan's solution is distributed to every client.
A network asset supervision engine according to claim 1, characterized in that step 6 is specifically:

Step 6.1: Import the results of steps 1-5 into the database and display them to users in a WEB-visualized form for users to monitor the status of internal network assets in real time.