摘要
[目的/意义]提出一种基于组合扫描与镜像流量分析的网络空间资产测绘技术改进方法,快速、准确地测绘未知资产.[方法/过程]结合多进程ICMP扫描和多线程Python-Scapy实现SYN扫描,探测存活主机和端口,使用Python-Nmap、Wappalyzer深度识别指纹和服务,缩短资产测绘时间并获得资产端口、服务和指纹信息等.通过镜像流量分析,使用Zeek从网卡中抓取流量,并生成日志筛选资产信息,作为组合扫描结果的补充.[结果/结论]资产测绘方法与TCP扫描相比,速度提升约50%,对系统消耗较小,测绘出的端口数量和准确度有较大提升.
[Purpose/Significance]An improved method for cyberspace asset mapping technology based on combined scanning and mirror traffic analysis is proposed to quickly and accurately map unknown assets.[Method/Process]Combined scanning combines multi-process ICMP scanning and SYN scanning implemented by multi-threaded Python-Scapy to detect surviving hosts and ports,and uses Python-Nmap and Wappalyzer to deeply identify fingerprints and services,shorten asset mapping time and obtain asset ports,services and fingerprint information,etc.;Mirror traffic analysis uses Zeek to capture traffic from the network card and generate log filtering asset information as a supplement to the combined scan results.[Results/Conclusion]Tests show that the asset mapping method in this article is about 50%faster than TCP scanning,consumes less on the system,and has a higher improvement in the number and accuracy of mapped ports.
作者
王进福
苏成悦
何榕礼
Wang Jinfu;Su Chengyue;He Rongli(Guangdong University of Technology,Guangdong Guangzhou 510006)
出处
《网络空间安全》
2024年第3期78-82,共5页
Cyberspace Security
关键词
网络空间资产测绘
网络安全
无状态扫描
指纹识别
流量分析
并发处理
cyberspace asset mapping
cyber security
stateless scanning
fingerprint identification
traffic analysis
concurrent processing
作者简介
王进福(1998-),男,汉族,山东威海人,广东工业大学,在读硕士,主要研究方向和关注领域:网络安全;苏成悦(1961-),男,汉族,湖南长沙人,中国科学院研究生院云南天文台,博士,广东工业大学物理与光电工程学院/广东工业大学先进制造学院计算机系,教授,主要研究方向和关注领域:计算机技术、应用电子;何榕礼(1974-),男,汉族,广东广州人,广州大学,硕士,广东工业大学物理与光电工程学院,讲师,主要研究方向和关注领域:网络技术与应用电子。
