Mimicry scheduling method, device, mimicry device and computer readable storage medium

Abstract

The present application relates to a mimetic scheduling method, device, mimetic device and computer-readable storage medium, which are applied to mimetic devices, and the method includes obtaining the heterogeneous type of the executable body attacked this time; if the heterogeneous type of the executable body attacked this time has a coupling point, then obtaining the executable body without the coupling point in the backup executable body, and storing the executable body without the coupling point in the backup executable body in the scheduling array; if the heterogeneous type of the executable body attacked this time does not have a coupling point, then obtaining all the backup executable bodies except the executable body attacked last time, and storing all the backup executable bodies except the executable body attacked last time in the scheduling array; based on the attacked weight and the scheduling online weight of the executable body in the scheduling array, determining the executable body to be online, scheduling the executable body to be online online, and scheduling the executable body attacked this time offline. The present application has the effect of improving the defensiveness of the mimetic scheduling system and the utilization rate of the executable body.

Description

Technical Field

[0001] The present application relates to the technical field of mimicry defense, and in particular to a mimicry scheduling method, apparatus, mimicry device, and computer-readable storage medium. Background Art

[0002] The mimetic defense theory is an endogenous security mechanism theory, method and technology based on dynamic heterogeneous redundant architecture. It strategically changes the functional structure and operating environment of network information systems through dynamic heterogeneous redundant construction, multi-dimensional dynamic reconstruction negative feedback based on multi-mode strategy judgment and other mechanisms. Its architectural technology can prevent security threats such as backdoors based on unknown and known vulnerabilities.

[0003] Based on the theory of mimicry defense, mimicry equipment came into being. Mimicry equipment includes mimicry adjudication, mimicry distribution, mimicry scheduling, mimicry cleaning and several heterogeneous executors. Among them, the main function of mimicry scheduling is to dispatch the abnormal executor offline when the distributed executor adjudicates abnormally, and dispatch the executor in normal state online to provide services.

[0004] Among the existing mimetic scheduling methods, the following two are more common: the first is to traverse the standby executor group in the order of the executor number, and select the executor with the earlier number to schedule online. If there are a large number of standby executors, the possibility of the executors with the later number to go online is very low, which makes the scheduling and online times of many standby executors lower than the scheduling average of all executors, resulting in low utilization rate of most executors and waste of resources; the second is to randomly select an executor to schedule online. The executor scheduled online may be roughly the same heterogeneous type as the attacked executor. If the attacker launches multiple attacks on the same type of vulnerability, the executor scheduled online this time is more likely to be attacked. Therefore, the defense effect against the same type of attack is not good. Summary of the invention

[0005] In order to improve the defensiveness of a mimetic scheduling system and the utilization rate of an executor, the present application provides a mimetic scheduling method, apparatus, mimetic device, and computer-readable storage medium.

[0006] In a first aspect, the present application provides a mimic scheduling method, which adopts the following technical solution:

[0007] A mimic scheduling method, comprising:

[0008] Get the heterogeneous type of the executable that is attacked this time;

[0009] If the heterogeneous type of the executable body attacked this time has a coupling point, then obtaining the executable body without the coupling point in the backup executable body, and storing the executable body without the coupling point in the backup executable body in the scheduling array;

[0010] If the heterogeneous type of the executable body attacked this time does not have a coupling point, all the backup executable bodies except the executable body attacked last time are obtained, and all the backup executable bodies except the executable body attacked last time are stored in the scheduling array;

[0011] Based on the attack weights and scheduling online weights of the executables in the scheduling array, determining the executables to be online, scheduling the executables to be online online, and then scheduling the executables that are attacked this time offline;

[0012] The attack weight represents the number of times the executable body is attacked, and the scheduling and online weight represents the number of times the executable body is scheduled and online.

[0013] By adopting the above technical solution, an executor that does not have a coupling point with the executor that is attacked this time is selected from the backup executors as candidate executors to be put online, or all the backup executors outside the executor that was attacked last time are directly selected as candidate executors to be put online, and the executors in the scheduling array are scheduled to go online based on the attack weight and the scheduling online weight, thereby reducing the possibility of attackers continuously attacking executors with high similarity, and making full use of executor resources, thereby improving the system's defensiveness and the utilization rate of executors.

[0014] Optionally, also include:

[0015] Determine whether the executable body that is attacked this time is attacked for the first time;

[0016] If yes, it is determined that the heterogeneous type of the executable body attacked this time has the coupling point, and the coupling point is the heterogeneous type of the executable body attacked this time;

[0017] If not, determining whether the heterogeneous type of the executable body attacked this time has the same point as the heterogeneous type of the executable body attacked last time;

[0018] If so, it is determined that the heterogeneous type of the executable body attacked this time has the coupling point, and the coupling point is the same point;

[0019] If not, it is determined that the heterogeneous type of the executable body attacked this time does not have the coupling point.

[0020] Optionally, the coupling point is a heterogeneous type of the executable body that is attacked this time.

[0021] Optionally, the attack weight is positively correlated with the number of times the executable body is attacked, and the scheduling online weight is positively correlated with the number of times the executable body is scheduled online; and determining the executable body to be online based on the attack weight and the scheduling online weight of the executable body in the scheduling array includes:

[0022] The sum of the weights of each executable body in the scheduling array is calculated based on the attacked weight and the scheduling online weight, the sum of the weights is sorted by numerical value, and the executable body with the smallest sum of weights is selected as the executable body to be online.

[0023] By adopting the above technical solution, the executor that has been attacked and scheduled to go online the least number of times is selected as the executor to be put online, which can improve the utilization rate of a single executor and reduce the possibility that the number of times a single executor is scheduled to go online is far less than the average number of times all executors are scheduled to go online, thereby reducing resource waste.

[0024] Optionally, the selecting the executor with the smallest total weight as the executor to be put online includes:

[0025] If the number of executable bodies with the smallest sum of weights after sorting is not unique, the number of executable bodies with the smallest sum of weights is used as a random seed to randomly select an executable body as the executable body to be put online.

[0026] Optionally, after scheduling the executable body to be put online, the method further includes:

[0027] The scheduling online weight of the executable body to be online is increased by one.

[0028] Optionally, after scheduling the executable body attacked this time to go offline, the method further includes:

[0029] Clean the offline actuator and use the cleaned actuator as a spare actuator.

[0030] By adopting the above technical solution, the actuator can be restored to a normal state after cleaning and can be used again, thereby improving the utilization rate of the actuator.

[0031] In a second aspect, the present application provides a mimicking scheduling device, which adopts the following technical solution:

[0032] A mimic scheduling device, comprising:

[0033] The acquisition module is used to obtain the heterogeneous type of the executable body that is attacked this time;

[0034] A first storage module is used for obtaining an executable body without the coupling point in the backup executable body if the heterogeneous type of the executable body attacked this time has a coupling point, and storing the executable body without the coupling point in the backup executable body in the scheduling array;

[0035] A second storage module is used for obtaining all spare executable bodies except the last attacked executable body if the heterogeneous type of the attacked executable body does not have a coupling point, and storing all spare executable bodies except the last attacked executable body in a scheduling array;

[0036] The scheduling module is used to determine the executable body to be put online based on the attack weight and the scheduling online weight of the executable body in the scheduling array, schedule the executable body to be put online, and then schedule the executable body attacked this time offline.

[0037] By adopting the above technical solution, an executor that does not have the same coupling point as the executor that is attacked this time is selected for scheduling online, thereby reducing the possibility of attackers continuously attacking executors with high similarity, reducing the number of mimicry ruling anomalies, and thus improving the stability of the system.

[0038] In a third aspect, the present application provides a mimicking device, which adopts the following technical solution:

[0039] A mimetic device comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the mimetic scheduling method described in any one of the first aspects.

[0040] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0041] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute the mimetic scheduling method described in any one of the first aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flowchart of a mimetic scheduling method according to an embodiment of the present application.

[0043] Figure 2 It is a structural block diagram of a mimic scheduling device according to an embodiment of the present application.

[0044] Figure 3 It is a structural block diagram of a mimicking device according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] The present application is further described in detail below in conjunction with the accompanying drawings.

[0046] Figure 1 A flowchart of a mimic scheduling method provided in an embodiment of the present application.

[0047] like Figure 1 As shown, the main process of the method is described as follows (steps S101 to S104):

[0048] Step S101, obtaining the heterogeneous type of the executable body attacked this time.

[0049] Specifically, each executable body in the system has a unique executable body number. When an executable body is attacked, the system stores the attacked executable body number in the memory and obtains the heterogeneous type of the attacked executable body according to the executable body number.

[0050] Step S102: If the heterogeneous type of the executable body attacked this time has a coupling point, then the executable body without the coupling point in the standby executable body is obtained, and the executable body without the coupling point in the standby executable body is stored in the scheduling array.

[0051] Step S103: if the heterogeneous type of the executable body attacked this time does not have a coupling point, all the backup executable bodies except the executable body attacked last time are obtained, and all the backup executable bodies except the executable body attacked last time are stored in the scheduling array.

[0052] In this embodiment, the standby executable body is all the executable bodies in the system except the executable body that is currently running, that is, online. The standby executable body is used to be scheduled online and put into operation after the currently running executable body is attacked.

[0053] Step S104, based on the attack weights and scheduling online weights of the executables in the scheduling array, determine the executables to be online, schedule the executables to be online, and then schedule the executables attacked this time offline.

[0054] It should be noted that heterogeneous executors can be constructed by using different device hardware, different operating systems, different server types, different applications, etc. The higher the coupling point of the heterogeneous type with other executors, the weaker the heterogeneity of the executor. When an attacker attacks the same type of vulnerability, the easier it is to break through, and the defense effect against the same type of attack is poor. If the attacker continues to attack the weakness of a certain heterogeneous type, it is easy to cause continuous abnormalities in the mimicry judgment and frequent scheduling of the executor, thereby causing system instability.

[0055] In order to solve the above problem, this embodiment needs to find a backup executable that has a low coupling point with the heterogeneous type of the executable that was attacked this time and schedule it online. Of course, in order to better improve the defense effect, it is best to find an executable that has a low coupling point with the heterogeneous type of multiple executables that were recently attacked and schedule it online. However, the following problems will occur during implementation:

[0056] (1) The more times comparisons are made, the longer the time consumed. (2) If an attacker only attacks the weaknesses of a certain layer, the attacker will attack only the executables of the same heterogeneous layer. It is sufficient to compare two executables that are attacked consecutively, and there is no need to compare more. (3) Some systems have a small number of executables. If multiple comparisons are made, there is a possibility that there are no available executables in the system. Therefore, only the most recent comparison is performed, or only the coupling points themselves are recorded.

[0057] In the case where only the heterogeneous type of the executable body attacked this time is considered as the coupling point, the executable body without the coupling point in the backup executable body is obtained, that is, the backup executable body that does not have the same point as the heterogeneous type of the executable body attacked this time is obtained and stored in the scheduling array.

[0058] In the case where only the similarities between the executable body attacked this time and the executable body attacked last time are considered as coupling points, it is necessary to first determine whether the executable body attacked this time is attacked for the first time; if it is the first time, it is determined that the heterogeneous type of the executable body attacked this time has a coupling point, and the coupling point is the heterogeneous type of the executable body attacked this time; if it is not the first time, it is determined whether the heterogeneous type of the executable body attacked this time has the same points as the heterogeneous type of the executable body attacked last time.

[0059] If there are similarities, it is determined that the heterogeneous type of the executable body attacked this time has a coupling point, and the coupling point is the same point. A backup executable body that does not have the coupling point is obtained and stored in the scheduling array.

[0060] If there is no common point, it is determined that the heterogeneous type of the executable body attacked this time has no coupling point. At this time, all the backup executable bodies except the executable body attacked last time are obtained and stored in the scheduling array.

[0061] It should be noted that the execution body that was attacked most recently is more likely to be attacked continuously. In order to reduce the possibility of being attacked by attackers, the execution body that was attacked last time will not be put into online service.

[0062] In this embodiment, the attack weight represents the number of times the executable body is attacked. The attack weight can be positively correlated with the number of times the executable body is attacked. For example, for any executable body, the initial value of its attack weight is zero. If it is attacked, its attack weight increases by one. Of course, the attack weight can also be negatively correlated with the number of times the executable body is attacked. For example, for any executable body, if it is attacked, its attack weight decreases by one.

[0063] In this embodiment, the scheduling online weight represents the number of times the executor is scheduled online. The scheduling online weight can be positively correlated with the number of times the executor is scheduled online. For example, for any executor, the initial value of its scheduling online weight is zero. If it is scheduled online, its scheduling online weight is increased by one. Of course, the scheduling online weight can also be negatively correlated with the number of times the executor is scheduled online. For example, for any executor, if it is scheduled online, its scheduling online weight is reduced by one.

[0064] It should be noted that, in the case of the aforementioned positive correlation, the attack weight and scheduling online weight of each executor in the scheduling array are obtained, the attack weight and the scheduling online weight are added together to obtain the total weight, and all executors in the scheduling array are sorted from large to small according to the value of the total weight, and the executor with the smallest total weight is selected for scheduling online.

[0065] In addition, if there are a large number of executors in the scheduling array, and there are multiple executors with the smallest sum of weights, that is, the number of executors with the smallest sum of weights after sorting is not unique, then the number of executors with the smallest sum of weights is used as the random seed, and an executor is randomly selected from them for scheduling online.

[0066] In this embodiment, the structure of the attacked execution body changes and cannot be used any more. Therefore, the execution body that is scheduled offline is cleaned to restore it to a normal state. The cleaned execution body will continue to be used as a backup execution body waiting to be scheduled.

[0067] The mimic scheduling method in step S101 to step S104 is described by taking a specific example:

[0068] If there are 10 executables in the system, assuming that 3 of them support online distribution, the remaining 7 will serve as backup executables.

[0069] Examples of heterogeneous executable types are shown in the following table:

[0070] Table 1 Executable heterogeneous types

[0071]

[0072] As shown in Table 1, the hardware architecture, operating system, server, and application type of executor 1 and executor n are completely different, and the heterogeneity is very high; the hardware architecture, operating system, and server of executor 1 and executor 2 are the same, but the application types are different, and the heterogeneity is relatively low.

[0073] Assuming that the executable body attacked this time is executable body 2, the executable body heterogeneous type corresponding to the attacked executable body 1 is hardware architecture 1+operating system 1+server 1+application 2. If it is not the first attack, it is compared with the executable body type attacked last time. For example, the executable body attacked last time is executable body 1, and the coupling point of the heterogeneous type of the executable bodies attacked twice is found. The heterogeneous type of executable body 1 is hardware architecture 1+operating system 1+server 1+application 1, then the coupling point between executable body 1 and executable body 2 is hardware architecture 1+operating system 1+server 1, then it is necessary to select an executable body without a coupling point from the backup executable bodies, that is, an executable body whose heterogeneous type is not hardware architecture 1+operating system 1+server 1, and store the executable body in the scheduling array, that is, store executable body n in the scheduling array.

[0074] The relevant data of the execution body in the scheduling array is shown in the following table:

[0075] Table 2: Schedule array summary execution weight data table

[0076]

[0077] As shown in Table 2, the scheduling array stores executors 5, 6, 7, and 8. The historical attack weights and scheduling weights of executors 5, 6, 7, and 8 are added together, and the executor with the smallest sum of weights is selected for scheduling. The sum of weights of executors 6 and 7 is the same and smaller than the sum of weights of other executors, so a random executor is selected from executor 6 or executor 8 for scheduling.

[0078] It should be noted that the executor in the scheduling array must be scheduled online first and then the executor that is attacked this time must be scheduled offline. If the executor that is attacked this time is scheduled offline first and then the executor in the scheduling array is scheduled online, there may be a situation where no executor is scheduled online to fill the vacant position after the executor is scheduled offline. When the mimic is distributed to the vacant position, no executor will receive and process the distributed message in time, resulting in a system unresponsive situation.

[0079] Figure 2 A structural block diagram of a mimic scheduling device 200 provided in an embodiment of the application.

[0080] like Figure 2 As shown, the mimicking scheduling device 200 mainly includes:

[0081] The acquisition module 201 is used to acquire the heterogeneous type of the executable body attacked this time;

[0082] The first storage module 202 is used for obtaining an executable body without a coupling point in the backup executable body if the heterogeneous type of the executable body attacked this time has a coupling point, and storing the executable body without a coupling point in the backup executable body in the scheduling array;

[0083] The second storage module 203 is used for obtaining all the spare executable bodies except the last attacked executable body if the heterogeneous type of the attacked executable body does not have a coupling point, and storing all the spare executable bodies except the last attacked executable body in the scheduling array;

[0084] The scheduling module 204 is used to determine the executable body to be put online based on the attack weight and the scheduling online weight of the executable body in the scheduling array, schedule the executable body to be put online, and then schedule the executable body under attack offline.

[0085] As an optional implementation of this embodiment, the device also includes a judgment module, which is used to determine whether the executable body attacked this time is attacked for the first time; if so, it is determined that the heterogeneous type of the executable body attacked this time has a coupling point, and the coupling point is the heterogeneous type of the executable body attacked this time; if not, it is determined whether the heterogeneous type of the executable body attacked this time has the same point as the heterogeneous type of the executable body attacked last time; if so, it is determined that the heterogeneous type of the executable body attacked this time has a coupling point, and the coupling point is the same point; if not, it is determined that the heterogeneous type of the executable body attacked this time does not have a coupling point.

[0086] As an optional implementation of this embodiment, the device also includes a sorting module, which is used to calculate the sum of the weights of each executor in the scheduling array based on the attacked weight and the scheduling online weight, sort the sum of the weights by numerical value, and select the executor with the smallest sum of weights as the executor to be put online.

[0087] As an optional implementation of this embodiment, the device also includes a random selection module, which is used to randomly select an executable body as the executable body to be put online using the number of executable bodies with the smallest total weight as a random seed if the number of executable bodies with the smallest total weight after sorting is not unique.

[0088] As an optional implementation of this embodiment, the device further includes a weight calculation module, which is used to increase the scheduling online weight of the execution body to be online by one.

[0089] As an optional implementation of this embodiment, the device further includes a cleaning module, which is used to clean the offline actuator and use the cleaned actuator as a spare actuator.

[0090] In one example, the module in any of the above devices can be one or more integrated circuits configured to implement the above methods, such as: one or more application specific integrated circuits (ASICs), or, one or more digital signal processors (DSPs), or, one or more field programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0091] For another example, when the modules in the device can be implemented in the form of a processing element scheduling program, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call a program. For another example, these modules can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0092] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0093] Figure 3 This is a structural block diagram of the mimicry device 300 provided in an embodiment of the present application.

[0094] like Figure 3 As shown, the mimic device 300 includes a processor 301 and a memory 302 , and may further include one or more of an information input / information output (I / O) interface 303 and a communication component 304 .

[0095] The processor 301 is used to control the overall operation of the mimetic device 300 to complete all or part of the steps of the above-mentioned mimetic scheduling method; the memory 302 is used to store various types of data to support the operation of the mimetic device 300, and these data may include, for example, instructions for any application or method used to operate on the mimetic device 300, and data related to the application. The memory 302 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk. One or more.

[0096] The I / O interface 303 provides an interface between the processor 301 and other interface modules, and the above-mentioned other interface modules can be keyboards, mice, buttons, etc. These buttons can be virtual buttons or physical buttons. The communication component 304 is used for wired or wireless communication between the mimic device 300 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 104 can include: Wi-Fi components, Bluetooth components, NFC components.

[0097] The mimetic device 300 is divided into a mimetic router, a mimetic router, a mimetic web virtual machine, a mimetic cloud server and a mimetic firewall. As a network information infrastructure, the mimetic device 300 undertakes multiple functions such as address resolution, data forwarding, website service provision, and facility protection.

[0098] The mimetic device 300 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the mimetic scheduling method given in the above embodiment.

[0099] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned mimetic scheduling method are implemented.

[0100] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0101] The terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus.

[0102] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A mimic scheduling method, characterized in that: include: Get the heterogeneous type of the executable that is attacked this time; If the heterogeneous type of the executable body attacked this time has a coupling point, then obtaining the executable body without the coupling point in the backup executable body, and storing the executable body without the coupling point in the backup executable body in the scheduling array; If the heterogeneous type of the executable body attacked this time does not have a coupling point, all the backup executable bodies except the executable body attacked last time are obtained, and all the backup executable bodies except the executable body attacked last time are stored in the scheduling array; Based on the attack weights and scheduling online weights of the executables in the scheduling array, determining the executables to be online, scheduling the executables to be online online, and then scheduling the executables that are attacked this time offline; The attack weight represents the number of times the execution body is attacked, and the scheduling online weight represents the number of times the execution body is scheduled online; Determine whether the executable body that is attacked this time is attacked for the first time; If yes, it is determined that the heterogeneous type of the executable body attacked this time has the coupling point, and the coupling point is the heterogeneous type of the executable body attacked this time; If not, determining whether the heterogeneous type of the executable body attacked this time is similar to the heterogeneous type of the executable body attacked last time; If so, it is determined that the heterogeneous type of the executable body attacked this time has the coupling point, and the coupling point is the same point; If not, it is determined that the heterogeneous type of the executable body attacked this time does not have the coupling point; The attack weight is positively correlated with the number of times the executable body is attacked, and the scheduling online weight is positively correlated with the number of times the executable body is scheduled online; the determining the executable body to be online based on the attack weight and the scheduling online weight of the executable body in the scheduling array includes: Based on the attacked weight and the scheduling online weight, the sum of the weights of each executable body in the scheduling array is calculated respectively, the sum of the weights is sorted by numerical value, and the executable body with the smallest sum of weights is selected as the executable body to be online; The selecting of the executor with the smallest total weight as the executor to be put online includes: If the number of executable bodies with the smallest sum of weights after sorting is not unique, the number of executable bodies with the smallest sum of weights is used as a random seed to randomly select an executable body as the executable body to be put online.

2. The method according to claim 1, characterized in that After scheduling the execution body to be put online, the method further includes: The scheduling online weight of the executable body to be online is increased by one.

3. The method according to claim 1, characterized in that After scheduling the execution body attacked this time to go offline, the method further includes: Clean the offline actuator and use the cleaned actuator as a spare actuator.

4. A mimicry scheduling device, characterized in that: include: The acquisition module is used to obtain the heterogeneous type of the executable body that is attacked this time; A first storage module is used for obtaining an executable body without the coupling point in the backup executable body if the heterogeneous type of the executable body attacked this time has a coupling point, and storing the executable body without the coupling point in the backup executable body in the scheduling array; A second storage module is used for obtaining all spare executable bodies except the last attacked executable body if the heterogeneous type of the attacked executable body does not have a coupling point, and storing all spare executable bodies except the last attacked executable body in a scheduling array; A scheduling module, used for determining the executable body to be put online based on the attack weight and the scheduling online weight of the executable body in the scheduling array, scheduling the executable body to be put online, and then scheduling the executable body under attack offline; A judgment module is used to judge whether the executable body attacked this time is attacked for the first time; if so, it is judged that the heterogeneous type of the executable body attacked this time has a coupling point, and the coupling point is the heterogeneous type of the executable body attacked this time; If not, determine whether the heterogeneous type of the executable body attacked this time has the same point as the heterogeneous type of the executable body attacked last time; if so, determine that the heterogeneous type of the executable body attacked this time has a coupling point, and the coupling point is the same point; If it does not exist, it is determined that the heterogeneous type of the executable body under attack does not have a coupling point; A sorting module is used to calculate the sum of weights of each executor in the scheduling array based on the attack weight and the scheduling online weight, sort the sum of weights by numerical value, and select the executor with the smallest sum of weights as the executor to be put online; The random selection module is used to randomly select an executable body as the executable body to be put online by taking the number of executable bodies with the smallest total weight as a random seed if the number of executable bodies with the smallest total weight after sorting is not unique.

5. A mimicry device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program which can be loaded by the processor and executes the method according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 3.

Images