Two-stage multi-layer resource scheduling method and system for mimicry defense

Abstract

The invention provides a two-stage multi-layer resource scheduling method and system for mimicry defense, and the method comprises the steps: a scheduling object is built in a mimicry system, wherein the scheduling object comprises an executor deployment scheme, a backup executor pool and a work executor group; and two-stage scheduling is carried out among the three, a plurality of scheduling strategies are adopted to determine a multi-layer scheduling target, and scheduling services of an executor and resources are provided for the mimicry system in the stages of creation, initialization and executor cleaning and recovery. According to the method, the randomness and the isomerism of the scheduling result are improved through two-stage scheduling of the execution body deployment scheme and the backup execution body. Multi-layer scheduling is formed by comprehensively using multiple scheduling strategies, and scheduling in multiple scenes such as mimicry system initialization and cleaning recovery is met.

Description

technical field [0001] The invention relates to network security technology, in particular to a two-level and multi-layer resource scheduling method and system for mimic defense. Background technique [0002] In order to cope with the information leakage, system failure and other losses caused by the increasing number of network attacks, as well as the inability of traditional passive defense technologies to effectively defend against threats from unknown vulnerabilities, the mimicry defense theory independently developed by my country has been tested and verified in actual combat, and can effectively defend against malicious attacks Threats, especially the threat of defending against backdoor attacks that exploit unknown vulnerabilities, have reduced the success rate of cyber attacks exponentially. [0003] The core of the mimicry defense theory is the system architecture of "Dynamic Heterogeneous Redundancy" (DHR). Based on the common knowledge that "independently develope...

AI Technical Summary

Problems solved by technology

Among them, although the random scheduling algorithm is simple and easy to implement, because the heterogeneous resource sets used to generate executives are often small, such as: the operating system instruction set does not exceed 10, even if the scheduling is completely random, the same heterogeneous resource combination is repeated The probability of calling is still relatively high; the coefficient-based scheduling algorithm is generally based on the random scheduling algorithm, and the probability of various resources being called is adjusted through the system. Since the scheduling coefficient is often adjusted by machine learning and other methods, the scheduling results often have Biased, with some loss of randomness

In addition, in order to improve the cleaning and recovery speed of the execution body when the mimic system is attacked, the execution body to be scheduled is often created in advance and placed in the execution body pool. The service object of the scheduling algorithm is the execution body pool. Due to limited software and hardware resources, Executor pools are generally small, which largely limits the dynamics and heterogeneity of scheduling

Images