CN111800286A - Intranet asset detection method, device and electronic device - Google Patents

Abstract

The present application proposes a method, device and electronic device for detecting intranet assets, wherein the above-mentioned method for detecting intranet assets includes: configuring a pre-defined credit network segment to be in a reachable state to the network connected to the current device; The device in the immediate vicinity of the current device is detected, and the asset information of the device in the immediate vicinity is obtained; it is judged whether the device in the immediate vicinity is a network-connected device; when the device in the immediate vicinity is not a network-connected device, the asset information of the device in the immediate vicinity is checked. register. This application can realize the acquisition of all asset information in the enterprise intranet, improve the effect of enterprise asset management, and reduce the risk of IT asset security management and control.

Description

Intranet asset detection method, device and electronic device

【Technical field】

The present application relates to the field of Internet technologies, and in particular, to a method, device and electronic device for detecting intranet assets.

【Background technique】

With the gradual increase in the scale of enterprise Internet technology (Internet Technology; hereinafter referred to as: IT) assets and the increasingly severe network security situation, it is imperative to grasp the security situation of intranet assets in real time. Asset information is the basis for security situation management and control. Only by accurately grasping the enterprise intranet asset information can we effectively discover existing risks and conduct timely management and control, so as to prevent problems before they occur.

At present, the enterprise has realized the centralized and information management of assets relying on the asset management system. In the prior art, the asset management system generally uses an Internet Protocol (Internet Protocol; hereinafter referred to as: IP)-based scanning method for the entire network to discover assets. Use specific tools to scan the entire network segment, detect information such as IP survival and port release, and then form a certain asset fingerprint to realize asset discovery and management.

However, due to the consideration of network security, most of the internal networks of enterprises have security domain divisions, and the domains are isolated by network policies or devices. Based on IP-wide network scanning, it is not possible to completely discover all the surviving assets in the intranet, which leads to the fact that the assets are connected to the network. The situation is difficult to manage and control, the effect of enterprise asset management is relatively low, and there is a great risk of IT asset security management and control.

[Content of the invention]

The embodiments of the present application provide an intranet asset detection method, device, and electronic device, so as to obtain full asset information in an enterprise intranet, improve the effect of enterprise asset management, and reduce the risk of IT asset security management and control.

In a first aspect, an embodiment of the present application provides a method for detecting intranet assets, including: configuring a pre-defined trusted network segment to be in a reachable state to a network to which a current device is connected; detecting a device immediately adjacent to the current device , obtain the asset information of the adjacent device; determine whether the adjacent device is a network connection device; when the adjacent device is not a network connection device, register the asset information of the adjacent device.

In one possible implementation manner, after judging whether the immediately adjacent device is a network connection device, the method further includes: when the immediately adjacent device is a network connection device and the immediately adjacent device is a border device in the network connection device , and register the asset information of the adjacent equipment.

In one possible implementation manner, the method further includes: in the process of registering the asset information, if the network access port in the asset information to be registered is the same as the network access port in the registered asset information , then only the Internet Protocol IP address in the asset information to be registered is registered in the asset information with the same network access port.

In one of the possible implementations, configuring the pre-defined trusted network segment to be in a reachable state to the network connected to the current device includes: logging in to the current device, enabling a simple network management protocol, and managing the network through the simple network The protocol configures the trusted network segment to be in a reachable state to the network to which the current device is connected.

In one of the possible implementation manners, the detecting the device next to the current device and acquiring the asset information of the device includes: using a simple network management protocol to detect the device next to the current device, and obtaining the information of the device next to the current device. Describe asset information in the immediate vicinity of the device.

In one possible implementation manner, the configuring the pre-defined trusted network segment before the network connected to the current device is in a reachable state, further includes: delimiting a trusted network segment in the intranet; detecting the intranet The first reachable network connection device in the Intranet is used as the starting point equipment for asset discovery in the intranet, and the asset information of the starting point equipment is registered.

In one possible implementation manner, the asset information of the current device includes: the asset fingerprint of the current device, the network access port that the current device is connected to the previous device, multi-IP information, and the origin device to Topological path information of the current device.

In a second aspect, an embodiment of the present application provides an apparatus for detecting intranet assets, including: a configuration module configured to configure a pre-defined trusted network segment to be in a reachable state to a network connected to a current device; a detection module, used for Detecting the equipment in the immediate vicinity of the current equipment, and obtaining the asset information of the equipment in close proximity; a judgment module for judging whether the equipment in close proximity is a network connection device; a registration module for when the judgment module determines that the adjacent equipment is in the immediate vicinity When the device is not a network-connected device, the asset information of the adjacent device is registered.

In a third aspect, embodiments of the present application provide an electronic device, including: at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores a program executable by the processor Instructions, the processor invoking the program instructions capable of performing the method as described above.

In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the above method.

In the above technical solution, a pre-defined credit network segment is configured to make the network connected to the current device in a reachable state, and then the device adjacent to the current device is detected, the asset information of the adjacent device is obtained, and it is determined whether the adjacent device is Network connection equipment, when the above-mentioned adjacent equipment is not a network connection equipment, the asset information of the above-mentioned adjacent equipment can be registered, so as to realize the detection of all surviving assets in the enterprise intranet, obtain the full amount of asset information in the intranet, and improve the enterprise The effect of asset management reduces the risk of IT asset security management and control.

【Description of drawings】

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the accompanying drawings used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a flowchart of an embodiment of a method for detecting intranet assets of the present application;

2 is a schematic diagram of an embodiment of asset information registration in a method for detecting intranet assets of the application;

3 is a flowchart of another embodiment of a method for detecting intranet assets of the present application;

4 is a schematic diagram of an embodiment of asset information of a starting point device in a method for detecting intranet assets of the application;

FIG. 5 is a flowchart of yet another embodiment of a method for detecting intranet assets of the present application;

FIG. 6 is a schematic structural diagram of an embodiment of an apparatus for detecting intranet assets of the present application;

FIG. 7 is a schematic structural diagram of another embodiment of an apparatus for detecting intranet assets of the present application;

FIG. 8 is a schematic structural diagram of an embodiment of an electronic device of the present application.

【Detailed ways】

In order to better understand the technical solutions of the present application, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

It should be clear that the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. As used in the embodiments of this application and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise.

FIG. 1 is a flowchart of an embodiment of a method for detecting intranet assets of the application. As shown in FIG. 1 , the above-mentioned method for detecting intranet assets may include:

Step 101: Configure a pre-defined trusted network segment to be in a reachable state to the network to which the current device is connected.

Wherein, the above-mentioned current device is the device currently detected by the asset detection device.

Specifically, configuring the trusted network segment to be in a reachable state to all networks connected to the current device may be: logging in to the current device, enabling Simple Network Management Protocol (Simple Network Management Protocol; SNMP for short), and configuring the above-mentioned trusted network segment through SNMP The network connected to the current device is reachable.

In the specific implementation, to log in to the current device, manual participation is required or the account information of the current device is entered into the system in advance to achieve automatic login. After logging in to the current device, you can enable SNMP and related configuration policies, and configure the trusted network segment to be reachable to the network connected to the current device.

Step 102 : Detecting the equipment adjacent to the current equipment, and acquiring asset information of the equipment adjacent to the current equipment.

Specifically, the asset detection device may detect the adjacent devices of the current device through SNMP, and obtain the asset information of the adjacent devices.

Step 103 , determine whether the above-mentioned immediately adjacent device is a network connection device; if not, go to step 104 ; if the above-mentioned adjacent device is a network connection device, go to step 105 .

Wherein, the network connection device may include a device used for network connection, such as a switch or a router.

Step 104, register the asset information of the above-mentioned adjacent equipment.

Step 105, when the above-mentioned adjacent device is a border device in the network connection device, register the asset information of the above-mentioned adjacent device.

In this embodiment, when the above-mentioned adjacent device is a border device in the network connection device, the asset information detection of the current topology path is terminated, and the asset information of the above-mentioned adjacent device is registered.

Specifically, in this embodiment, in the process of registering asset information, if the network access port in the asset information to be registered is the same as the network access port in the registered asset information, only the above-mentioned to-be-registered asset information will be registered. The IP address in the asset information is registered in the asset information with the same network access port.

In this embodiment, when registering asset information, it is necessary to determine whether the network access port in the asset information to be registered is the same as the network access port in the registered asset information. If so, it means that the same network card has multiple IP addresses. In this case, there is no need to register the above-mentioned asset information to be registered, and only the IP address in the above-mentioned asset information to be registered can be registered in the asset information with the same network access port.

As shown in FIG. 2 , FIG. 2 is a schematic diagram of an embodiment of asset information registration in the method for detecting intranet assets of the present application. As can be seen from FIG. 2 , the device identifier (Identifier; hereinafter referred to as: ID) is 10000006. The asset information is the asset information to be registered. The network access port in the asset information to be registered above is the same as the network access port in the asset information with the registered device ID of 10000005. At this time, there is no need to register the device with the device ID of 10000006. Only add the IP address of the device whose device ID is 10000006 in the multi-IP field of the asset information whose device ID is 10000005, so that the asset information can be effectively integrated when there are multiple IPs in the same asset. Realize accurate asset management.

In the above-mentioned detection method of intranet assets, a pre-defined credit network segment is configured to be in a reachable state to the network connected to the current device, and then the device adjacent to the current device is detected, the asset information of the adjacent device is obtained, and the above-mentioned device is judged. Whether the adjacent device is a network-connected device, when the above-mentioned adjacent device is not a network-connected device, register the asset information of the above-mentioned adjacent device, so as to detect all surviving assets in the enterprise intranet and obtain the full amount of assets in the intranet Information, improve the effect of enterprise asset management, reduce the risk of IT asset security management and control; and can effectively integrate asset information when there are multiple IPs in the same asset to achieve accurate asset management.

FIG. 3 is a flowchart of another embodiment of the method for detecting intranet assets of the present application. As shown in FIG. 3 , before step 101 in the embodiment shown in FIG. 1 of the present application, the method may further include:

Step 301: Delineate a credit network segment in the intranet.

In this embodiment, the trusted network segment defined in the intranet can be used as a secure address segment to access all IP address segments of the intranet.

Step 302: Detect the first reachable network connection device in the above-mentioned intranet, and register the asset information of the above-mentioned starting point device as a starting point device for asset discovery in the above-mentioned intranet.

Specifically, the asset detection device can detect the first reachable network connection device in the above-mentioned intranet, and register the asset information of the above-mentioned starting point device as a starting point device for asset discovery in the above-mentioned intranet.

The asset information of the above-mentioned starting device may include asset fingerprints, network access ports, multi-IP information and topology path information:

The above asset fingerprints may include information such as operating system and version, device ID, IP address, gateway, asset type and/or port in use;

The network access port of the above starting device is 0;

The topology path information of the above-mentioned origin device is the above-mentioned origin device itself;

The multi-IP information of the above-mentioned starting device, if the network access port of the subsequently detected device is the same as the network access port of the above-mentioned starting device, then the IP address of the subsequently detected device is added to the above-mentioned multiple of the asset information of the starting device. in the IP field.

Referring to FIG. 4 , FIG. 4 is a schematic diagram of an embodiment of the asset information of the origin device in the method for detecting intranet assets of the present application.

In this way, in the embodiment shown in FIG. 1 of the present application, the asset information of the current device may include: the asset fingerprint of the current device, the network access port that the current device is connected to the previous device, the multi-IP information, and the origin device to the current device. Topological path information of the device.

Likewise, the asset fingerprint of the above-mentioned current device may include information such as operating system and version, device ID, IP address, gateway, asset type and/or port in use; an example of the asset information of the current device can be found in FIG. 2 , which is omitted here. Repeat.

FIG. 5 is a flowchart of another embodiment of a method for detecting intranet assets of the present application. As shown in FIG. 5 , the above-mentioned method for detecting intranet assets may include:

Step 501: Delineate a credit network segment in the intranet.

Step 502: Detect the first reachable network connection device in the above-mentioned intranet, and register the asset information of the above-mentioned starting point device as a starting point device for asset discovery in the above-mentioned intranet.

The above-mentioned starting point device is the current device detected by the network detection device.

Step 503: Configure a pre-defined trusted network segment to be in a reachable state to the network connected to the current device.

Step 504: Detecting the adjacent devices of the current device to obtain asset information of the adjacent devices.

Step 505 , determine whether the above-mentioned immediately adjacent device is a network connection device; if not, go to step 506 ; if the above-mentioned adjacent device is a network connection device, go to step 507 .

Step 506, register the asset information of the above-mentioned adjacent equipment.

Step 507: Determine whether the above-mentioned network connection device is a boundary device. If yes, go to step 508 ; if the above-mentioned network connection device is not a boundary device, go back to go to step 503 .

Step 508, register the asset information of the above-mentioned adjacent equipment.

Specifically, in this embodiment, in the process of registering asset information, if the network access port in the asset information to be registered is the same as the network access port in the registered asset information, only the above-mentioned to-be-registered asset information will be registered. The IP address in the asset information is registered in the asset information with the same network access port.

In this embodiment, when registering asset information, it is necessary to determine whether the network access port in the asset information to be registered is the same as the network access port in the registered asset information. If so, it means that the same network card has multiple IP addresses. In this case, there is no need to register the above-mentioned asset information to be registered, and only the IP address in the above-mentioned asset information to be registered can be registered in the asset information with the same network access port. In this way, when there are multiple IPs in the same asset, the asset information can be effectively integrated to achieve accurate asset management.

6 is a schematic structural diagram of an embodiment of an apparatus for detecting intranet assets of the present application. The apparatus for detecting intranet assets in this embodiment can be used as an asset detection device to implement the method for detecting intranet assets provided by this embodiment of the present application. As shown in FIG. 6 , the above-mentioned detection device for intranet assets may include: a detection module 61 , a registration module 62 , a configuration module 63 and a judgment module 64 ;

The configuration module 63 is used to configure the pre-defined credit network segment to be in a reachable state to the network connected to the current device; in this embodiment, the configuration module 63 is specifically used to log in to the current device, enable SNMP, and configure the above-mentioned credit through SNMP The network segment is reachable to the network connected to the current device.

In the specific implementation, to log in to the current device, manual participation is required or the account information of the current device is entered into the system in advance to achieve automatic login. After logging into the current device, the configuration module 63 can enable SNMP and related configuration policies, and configure the trusted network segment to be in a reachable state to the network connected to the current device.

The detection module 61 is used to detect the adjacent devices of the current device, and obtain the asset information of the above-mentioned adjacent devices; in this embodiment, the detection module 61 is specifically used to detect the adjacent devices of the above-mentioned current equipment through SNMP, and obtain the above-mentioned adjacent devices. Asset information for the device.

The judging module 64 is used to judge whether the above-mentioned adjacent device is a network connection device; wherein, the network connection device may include a switch or a router and other devices used for network connection.

The registration module 62 is configured to register the asset information of the above-mentioned adjacent device when the judgment module 64 determines that the above-mentioned adjacent device is not a network connection device.

Further, the registration module 62 is further configured to register the asset information of the above-mentioned adjacent device when the above-mentioned adjacent device is a border device in the network connection device.

In this embodiment, when the above-mentioned adjacent device is a border device in the network connection device, the asset information detection of the current topology path is terminated, and the registration module 62 registers the asset information of the above-mentioned adjacent device.

In this embodiment, the registration module 62 is specifically configured to, in the process of registering the asset information, if the network access port in the asset information to be registered is the same as the network access port in the registered asset information, only Register the IP address in the asset information to be registered in the asset information with the same network access port.

In this embodiment, when registering asset information, the registration module 62 needs to determine whether the network access port in the asset information to be registered is the same as the network access port in the registered asset information. In the case of the network card with multiple IPs, the registration module 62 does not need to register the asset information to be registered, but only needs to register the IP address in the asset information to be registered in the asset information with the same network access port.

As can be seen from Figure 2, the asset information of the device whose device ID is 10000006 is the asset information to be registered, the network access port in the asset information to be registered and the network access port in the asset information whose device ID is 10000005 has been registered. The access ports are the same. At this time, the registration module 62 does not need to register the asset information of the device whose device ID is 10000006. It only needs to add the IP address of the device whose device ID is 10000006 in the multi-IP field of the asset information whose device ID is 10000005. When there are multiple IPs in the same asset, asset information can be effectively integrated to achieve accurate asset management.

In the detection device of the above-mentioned intranet assets, the configuration module 63 configures a pre-defined credit network segment to be in a reachable state to the network connected to the current device, and then the detection module 61 detects the adjacent device of the above-mentioned current device, and obtains the above-mentioned adjacent device. The asset information, the judgment module 64 judges whether the above-mentioned adjacent device is a network connection device, and when the above-mentioned adjacent device is not a network connection device, the registration module 62 registers the asset information of the above-mentioned adjacent device, so that all the information in the enterprise intranet can be registered. Detect surviving assets, obtain full asset information in the intranet, improve the effect of enterprise asset management, and reduce the risk of IT asset security management and control; and can effectively integrate asset information when there are multiple IPs in the same asset to realize asset management. Precise management.

FIG. 7 is a schematic structural diagram of another embodiment of the device for detecting intranet assets in the application. Compared with the device for detecting intranet assets shown in FIG. 6 , the difference is that the device for detecting intranet assets shown in FIG. 7 is different. It can also include: a delineation module 65;

The demarcation module 65 is configured to demarcate the credited network segment in the intranet before the configuration module 63 configures the pre-defined credited network segment to be in a reachable state to the network to which the current device is connected.

In this embodiment, the trusted network segment demarcated by the delimiting module 65 in the intranet can be used as a secure address segment to access all IP address segments of the above intranet.

In this embodiment, the detection module 61 is further configured to detect the first reachable network connection device in the above-mentioned intranet, as a starting point device for asset discovery in the above-mentioned intranet;

The registration module 62 is further configured to register the asset information of the above-mentioned starting point equipment.

Specifically, the detection module 61 can detect the first reachable network connection device in the above-mentioned intranet as a starting point device for asset discovery in the above-mentioned intranet, and then the registration module 62 registers the asset information of the above-mentioned starting point equipment.

The asset information of the above-mentioned starting device may include asset fingerprints, network access ports, multi-IP information and topology path information:

The above asset fingerprints may include information such as operating system and version, device ID, IP address, gateway, asset type and/or port in use;

The network access port of the above starting device is 0;

The topology path information of the above-mentioned origin device is the above-mentioned origin device itself;

The multi-IP information of the above-mentioned starting device, if the network access port of the subsequently detected device is the same as the network access port of the above-mentioned starting device, then the IP address of the subsequently detected device is added to the above-mentioned multiple of the asset information of the starting device. in the IP field.

In this embodiment, an example of the asset information of the origin device may be as shown in FIG. 4 .

In this way, the asset information of the current device may include: the asset fingerprint of the current device, the network access port connecting the current device to the previous device, multi-IP information, and topology path information from the origin device to the current device.

Likewise, the asset fingerprint of the above-mentioned current device may include information such as operating system and version, device ID, IP address, gateway, asset type and/or port in use; an example of the asset information of the current device can be found in FIG. 2 , which is omitted here. Repeat.

FIG. 8 is a schematic structural diagram of an embodiment of the electronic device of the present application. As shown in FIG. 8 , the electronic device may include at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores data that can be processed A program instruction executed by the processor, and the processor invokes the program instruction to execute the method for detecting intranet assets provided by the embodiment of the present application.

The above electronic device may be an asset detection device, and the specific form of the above electronic device is not limited in this embodiment.

Figure 8 shows a block diagram of an exemplary electronic device suitable for use in implementing embodiments of the present application. The electronic device shown in FIG. 8 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

As shown in Figure 8, the electronic device takes the form of a general-purpose computing device. Components of an electronic device may include, but are not limited to, one or more processors 410 , memory 430 , and a communication bus 440 connecting various system components including memory 430 and processing unit 410 .

Communication bus 440 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of a variety of bus structures. For example, these architectures include, but are not limited to, Industry Standard Architecture (hereinafter referred to as: ISA) bus, Micro Channel Architecture (hereinafter referred to as: MAC) bus, enhanced ISA bus, video electronic standard Association (Video Electronics Standards Association; hereinafter referred to as: VESA) local bus and Peripheral Component Interconnection (Peripheral Component Interconnection; hereinafter referred to as: PCI) bus.

Electronic devices typically include various computer system readable media. These media can be any available media that can be accessed by the electronic device, including both volatile and nonvolatile media, removable and non-removable media.

The memory 430 may include a computer system readable medium in the form of volatile memory, such as random access memory (Random Access Memory; hereinafter referred to as: RAM) and/or cache memory. The electronic device may further include other removable/non-removable, volatile/non-volatile computer system storage media. Although not shown in FIG. 8, disk drives for reading and writing to removable non-volatile magnetic disks (eg, "floppy disks") and removable non-volatile optical disks (eg, compact disk read only memory) may be provided. Disc Read Only Memory; hereinafter referred to as: CD-ROM), Digital Video Disc Read Only Memory (hereinafter referred to as: DVD-ROM) or other optical media) read and write optical disc drives. In these cases, each drive may be connected to communication bus 440 through one or more data media interfaces. Memory 430 may include at least one program product having a set (eg, at least one) of program modules configured to perform the functions of various embodiments of the present application.

A program/utility having a set (at least one) of program modules that may be stored in memory 430, such program modules including, but not limited to, an operating system, one or more application programs, other program modules, and program data , each or some combination of these examples may include an implementation of a network environment. Program modules generally perform the functions and/or methods of the embodiments described herein.

The electronic device may also communicate with one or more external devices (eg, keyboards, pointing devices, displays, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device, and/or communicate with the electronic device Any device (eg, network card, modem, etc.) capable of communicating with one or more other computing devices. Such communication may take place through communication interface 420 . In addition, the electronic device can also communicate with one or more networks (eg, Local Area Network (hereinafter referred to as: LAN), Wide Area Network (hereinafter referred to as: WAN) and/or through a network adapter (not shown in FIG. 8 ) A public network, such as the Internet, the aforementioned network adapter can communicate with other modules of the electronic device through the communication bus 440 . It should be understood that, although not shown in Figure 8, other hardware and/or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, Redundant Arrays of Independent Drives; hereinafter referred to as: RAID) systems, tape drives and data backup storage systems.

The processor 410 executes various functional applications and data processing by running the programs stored in the memory 430, for example, implementing the method for detecting intranet assets provided by the embodiments of the present application.

Embodiments of the present application further provide a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the method for detecting intranet assets provided by the embodiments of the present application.

The aforementioned non-transitory computer-readable storage media may employ any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples (non-exhaustive list) of computer readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (Read Only Memory) ; hereinafter referred to as: ROM), erasable programmable read only memory (Erasable Programmable Read Only Memory; hereinafter referred to as: EPROM) or flash memory, optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices , or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

A computer-readable signal medium may include a propagated data signal in baseband or as part of a carrier wave, with computer-readable program code embodied thereon. Such propagated data signals may take a variety of forms including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device .

Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for performing the operations of the present application may be written in one or more programming languages, including object-oriented programming languages—such as Java, Smalltalk, C++, but also conventional Procedural programming language - such as the "C" language or similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (hereinafter referred to as: LAN) or a Wide Area Network (hereinafter referred to as: WAN), or may be connected to an external computer (eg using an internet service provider to connect via the internet).

In the description of this specification, description with reference to the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples", etc., mean specific features described in connection with the embodiment or example , structure, material or feature is included in at least one embodiment or example of the present application. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of the different embodiments or examples, without conflicting each other.

In addition, the terms "first" and "second" are only used for descriptive purposes, and should not be construed as indicating or implying relative importance or implying the number of indicated technical features. Thus, a feature delimited with "first", "second" may expressly or implicitly include at least one of that feature. In the description of the present application, "plurality" means at least two, such as two, three, etc., unless expressly and specifically defined otherwise.

Any process or method description in the flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing custom logical functions or steps of the process , and the scope of the preferred embodiments of the present application includes alternative implementations in which the functions may be performed out of the order shown or discussed, including performing the functions substantially concurrently or in the reverse order depending upon the functions involved, which should It is understood by those skilled in the art to which the embodiments of the present application belong.

Depending on the context, the word "if" as used herein can be interpreted as "at" or "when" or "in response to determining" or "in response to detecting." Similarly, the phrases "if determined" or "if detected (the stated condition or event)" can be interpreted as "when determined" or "in response to determining" or "when detected (the stated condition or event)," depending on the context )" or "in response to detection (a stated condition or event)".

It should be noted that the terminals involved in the embodiments of the present application may include but are not limited to personal computers (Personal Computer; hereinafter referred to as: PC), personal digital assistants (Personal Digital Assistant; hereinafter referred to as: PDA), wireless handheld devices, tablet computers ( Tablet Computer), mobile phones, MP3 players, MP4 players, etc.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined. Either it can be integrated into another system, or some features can be omitted, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, and includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (Processor) to execute the methods described in the various embodiments of the present application. some steps. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (Read-Only Memory; hereinafter referred to as: ROM), Random Access Memory (Random Access Memory; hereinafter referred to as: RAM), magnetic disk or optical disk and other various A medium on which program code can be stored.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the present application. within the scope of protection.

Claims (10)

1. A detection method for intranet assets, comprising: Configure the pre-defined trusted network segment to be reachable to the network connected to the current device; Detecting the adjacent equipment of the current equipment, and obtaining the asset information of the adjacent equipment; Determine whether the adjacent device is a network connection device; When the immediately adjacent device is not a network-connected device, the asset information of the immediately adjacent device is registered. 2. The method according to claim 1, wherein after judging whether the immediately adjacent device is a network connection device, the method further comprises: When the immediately adjacent device is a network connection device, and the immediately adjacent device is a border device in the network connection device, the asset information of the immediately adjacent device is registered. 3. The method according to claim 1 or 2, characterized in that, further comprising: During the process of registering the asset information, if the network access port in the asset information to be registered is the same as the network access port in the registered asset information, only the Internet Protocol in the asset information to be registered will be registered. The IP address is registered in the asset information with the same network access port. 4. The method according to claim 1, wherein the configuring the pre-defined trusted network segment to be in a reachable state to the network docked by the current device comprises: Log in to the current device, enable the Simple Network Management Protocol, and configure the trusted network segment to be in a reachable state to the network connected to the current device through the Simple Network Management Protocol. 5. The method according to claim 1 or 4, characterized in that, the detection of the device adjacent to the current device, and the acquisition of asset information of the device adjacent to the current device comprises: Probe the device adjacent to the current device through the Simple Network Management Protocol to acquire asset information of the device adjacent to the current device. 6 . The method according to claim 1 , wherein the configuring the pre-defined credit network segment before the network connected to the current device is in a reachable state, further comprising: 6 . Delineate credit network segments in the intranet; The first reachable network connection device in the intranet is detected, and the asset information of the origin device is registered as the origin device for asset discovery in the intranet. 7 . The method according to claim 6 , wherein the asset information of the current device comprises: the asset fingerprint of the current device, the network access port that the current device is docked with the previous device, the multi-IP information and topology path information from the origin device to the current device. 8. An apparatus for detecting intranet assets, comprising: The configuration module is used to configure the pre-defined credit network segment to be in a reachable state to the network connected to the current device; A detection module, used to detect the equipment adjacent to the current equipment, and obtain asset information of the equipment adjacent to the current equipment; A judging module for judging whether the adjacent device is a network connection device; A registration module, configured to register the asset information of the immediately adjacent device when the judgment module determines that the adjacent device is not a network connection device. 9. An electronic device, characterized in that, comprising: at least one processor; and at least one memory communicatively coupled to the processor, wherein: The memory stores program instructions executable by the processor, and the processor invokes the program instructions to be able to perform the method as claimed in any one of claims 1 to 7 . 10 . A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, the computer instructions cause the computer to execute any one of claims 1 to 7 . Methods.

Images