An attack defense device, method, device and medium based on mimic defense

Abstract

The invention discloses an attack defense device, method, equipment and medium based on mimic defense. The device includes a mimic scheduler and several heterogeneous executives; the heterogeneous executive receives and processes message data sent by the mimic scheduler; The mimetic scheduler includes a mimetic judgment module and an attack defense module, which are used to receive the message data sent by the front-end chip and forward it to the heterogeneous executors, so as to realize the data distribution, mimetic judgment and cleaning management of the heterogeneous executors; The downlink data of the heterogeneous executors makes a mimetic judgment, and sends the result of the mimetic judgment to the attack defense module; the attack defense module collects, extracts, and logs the packet data sent by the front-end chip, and makes a mimetic judgment according to the mimetic judgment module. As a result, log updates, attack defense detection, and attack data filtering are performed. The invention performs attack detection and judgment on the message data and effectively filters the abnormal message data, thereby reducing the number of cleaning times of the isomer executive body.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an attack defense device, method, device and medium based on mimic defense. Background technique [0002] The current cyberspace is in a security situation of "easy to attack and difficult to defend". How to improve the security of cyberspace is one of the most serious challenges in the current information age. Mimic defense technology is based on the endogenous security theory with dynamic heterogeneous redundant structure as the core, which can prevent security threats based on unknown and known vulnerability backdoors, and greatly enhance the ability of critical business networks to deal with external intrusion and internal penetration. [0003] Mimic products are based on existing network equipment, integrate mimic defense technology, introduce multiple heterogeneous processing engines as heterogeneous executors in their architecture, and include mimic netwo...

AI Technical Summary

Problems solved by technology

However, if the mimic scheduler sends the same attack message to the heterogeneous executable again, the heterogeneous executable will still appear abnormal again after receiving it, resulting in the heterogeneous executable being in an unavailable state all the time. Greatly reduces the advantages of heterogeneous redundancy and affects the overall stability of the system

Images