Mimicry judgment method, device and system

Abstract

The invention provides a mimicry judgment method, device and system, wherein the method is applied to a chip in connection with a heterogeneous multi-core processor. The method comprises the followingsteps: receiving a preset current message sent by a main processor; according to a preestablished default field lookup table and a subfield extraction table, analyzing the current message and obtaining a communication protocol and a plurality of sub-behavior operations; according to the sequence of the plurality of sub-behavior operations located in the preset behavior operation, arranging the current message to a preestablished first ordered queue; according to sorting between the communication protocol and the plurality of sub-behavior operations, arranging the sub-behavior operation to a preestablished first merging queue; and performing mimicry judgment on the message in the first ordered queue according to the first ordered queue and the preset merging queue. The mimicry judgment method, device and system in the invention improves the validity of the mimicry judgment, thereby improving the safety of the network space.

Description

technical field [0001] The present invention relates to the technical field of cyberspace security protection, in particular to a mimic judgment method, device and system. Background technique [0002] With the continuous development of network technology, the importance of cyberspace security has become increasingly prominent. Heterogeneous multi-core processors are used to generate heterogeneous functional equivalents. When one of the processors is attacked, the messages output by other processors can be used, thereby improving the security of the network space. Heterogeneous multi-core processors perform calculations at the same time to obtain results, or perform operations such as routing table entry configuration under multi-threading. Due to the different speeds of each processor and different thread scheduling methods, the tasks for continuous operations are divided into different components. It is more difficult to distinguish the mimicry of heterogeneous functional...

AI Technical Summary

Problems solved by technology

Nowadays, the method of direct comparison after data feature extraction based on FPGA (Field-Programmable Gate Array, Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit, application-specific integrated circuit) chip or the method of out-of-sequence comparison is mostly used. However, for data that has correlations within the data stream and the data size of a burst of data varies greatly, the effectiveness of using these methods for mimicry discrimination is poor, resulting in low security in cyberspace

Images