Mimicry WAF construction method

Abstract

The invention discloses a mimicry WAF construction method which is based on a mimicry defense thought and can actively defend against malicious attacks on a WAF. A dynamic selection module, a mimicryjudgment module, an isomer construction module and the like are designed to realize mimicry WAF construction, and isomerization processing is performed on a cloud server, a virtualized container, an operating system in the container, a WAF platform, an interception rule and the like, so that the WAF has an active defense capability. When the traffic passes through the dynamic selection module, themodule selects k WAF isomers for traffic processing, after the processing result is judged by the mimicry judgment module, a judgment result is used for modifying the abnormal rate of each isomer, when the abnormal rate of a certain isomer is higher than a certain value, offline self-cleaning operation is carried out on the isomer, and finally, when the judgment result is that the judgment is passed, the traffic is released, and when the judgment result is not passed, the traffic is forwarded to a subsequent processing module.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for constructing a mimic WAF. Background technique [0002] In recent years, the United States has planned to deploy "game-changing" network security defense technologies, proposed moving target defense, and is committed to building dynamics, heterogeneity and uncertainty to increase the difficulty of attackers' attacks. Mobile target defense can be implemented at multiple levels such as network, platform operating environment, software, and data, including variable IP addresses, variable ports, randomness in code execution, and randomness in address space. [0003] Academician Wu Jiangxing and others have proposed innovative active defense technologies such as "mimetic defense", "self-reconfiguration and trustworthiness", and "mission assurance", and have made important progress in theoretical deduction, technical research and principle verification...

AI Technical Summary

Problems solved by technology

However, there are still problems such as malicious bypass of the protection rule base, exploiting the vulnerabilities of the WAF platform, the operating system, or the cloud platform to attack, so it faces serious security threats.

Images