Design And Implementation Of Kscan:A Device Identification Based Network Scanner

With the development of the technology of Internet,more and more terminal devices are connected into the network space.Network camera,network printers,digital media device,smart appliances and other new device to make the network space becomes complex.Accurate identification of terminal device can help network administrator manage their terminal devices,discover the potential dangerous,and avoid being attacked by relating the device info and the bug info.Therefore,it is of great significance for the network security early warning and security evaluation.Therefore,device identification has a great meaning for the network security early warning and security evaluation.The main content of this paper is the introduction of the design and implementation of the Kscan,a network scanner which base on device identification.Kscan can get the port info,application info,OS info of target devices by the way of active probing.The probe result will be saved in the database of threat intelligence platform,which is the main production of the company the author worked for.Kscan sends different types of probe packet according to the different application protocol and software to the target device to get the Banner info.Kscan can identify the remote device by matching the Banner with the device fingerprint.Kscan uses the fingerprint of TCP/IP protocol stack to probe the remote OS,by matching the feature with the OS fingerprint of Kscan,Kscan can know the info of the remote OS.In this paper,we will describe the architecture design and the details of every module's design and implementation.In the chapter of design and implemention,the author will introduce the analysis of application protocols and softwares which has a high device identification rate and show how to identify the device by them.In addition,the author will introduce the key technology and the strategy of device identification.Kscan currently can probe 56 different types of protocol and software and identify 50 different types of terminal devices.Kscan is developing its ability in the filed of identification of industrial control device,and Kscan will expand its.