A Network Space Mapping Method Based on Service Authentication

Abstract

The invention belongs to a network space surveying and mapping method based on service verification, and belongs to the technical field of network security. The method includes the following steps: A. sequentially analyzing traffic logs, mirroring traffic, and offline data to obtain analysis results; B. analyzing the data through scripts The results are verified to obtain the verification results; C. The spatial surveying and mapping information is improved through the verification results. Improve the efficiency of spatial surveying and mapping by using the server IP, port, and protocol information obtained by data collection, enrich the dimensions of spatial surveying and mapping asset portraits, and actively detect the validity of the verification data, thereby improving the reliability of the overall data of spatial surveying and mapping, and avoiding active scanning methods. The network creates enormous pressure.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network space surveying and mapping method based on service verification. Background technique [0002] Cyberspace mapping refers to the use of specific technologies to detect cyberspace, identify asset identities in the network (such as servers, routing equipment, industrial control equipment, firewalls, gateways, etc.), service applications (webserver, ftp, ssh, mysql, etc.) Combining with other basic data to realize the portrait of assets in cyberspace. The existing surveying and mapping methods are mainly realized by active scanning. Active scanning is to use the detection server to initiate a connection request to the specified port of the target device to judge the characteristic information of the target device according to the returned situation. [0003] For the detection server, the target device is an unknown situation, it does not know the ser...

AI Technical Summary

Problems solved by technology

[0004] When the detection server conducts active detection, it often needs to retry a port multiple times before it can return the fingerprint (banner) data expected by the detection server. Therefore, we can calculate the number of detections initiated by a network-wide active detection: total detection Number of times = IP*port*number of detections on a single port. It can be seen that the cost of performing an active detection is very high, but high-frequency network detections often cause network congestion and affect normal network use. In actual use A target may only have a small number of ports open, and even the target IP is unreachable

Therefore, the success rate of active detection is low

Images