Mimicry WAF judgment method based on credibility

Abstract

The invention discloses a credibility-based mimicry WAF decision method, which is characterized in that the validity of decision results of all executors is represented by defining credibility, and a preliminary credible executor selection module, a decision result processing module and a credibility dynamic adjustment module are introduced to carry out traffic decision. The initial trusted executor selection module selects a relatively trusted executor to participate in flow judgment, the judgment result processing module obtains a judgment result through result fusion, consistency judgment and voting calculation, the credibility dynamic adjustment module updates the credibility of the executor in combination with a consistency result, and the untrusted executor executes self-cleaning operation. According to the method, the adverse effect on the flow judgment result due to the threat of the executor in the mimicry WAF can be weakened, and the defense capability of the mimicry defense system is effectively improved.

Description

technical field [0001] The invention belongs to the technical field of network security mimic defense, and in particular relates to a credibility-based mimic WAF judgment method. Background technique [0002] Cyberspace security issues have existed since the birth of the Internet and have become increasingly serious. At present, the security of the network infrastructure itself has become the most important insecurity factor. Attackers may launch malicious attacks on it through backdoors or loopholes in software and hardware. It makes network security "easy to attack but difficult to defend", so it is imminent to improve the active defense capability of network infrastructure. Mimic defense provides a relatively safe system operating environment through the application of dynamic heterogeneous redundant construction mechanism, which effectively improves the active defense capability of the system. Compared with traditional defense methods such as access control and intrusio...

AI Technical Summary

Problems solved by technology

[0002] Cyberspace security issues have existed since the birth of the Internet and have become increasingly serious. At present, the security of the network infrastructure itself has become the most important insecurity factor. Attackers may launch malicious attacks on it through backdoors or loopholes in software and hardware. Make network security "easy to attack but difficult to defend", so it is imminent to improve the active defense capability of network infrastructure

Images