A method, apparatus, device and medium for cleaning and restoring a mimic executor

Abstract

The present application provides a kind of mimicry executor cleaning recovery method, device, equipment and medium, method includes the following steps: S1, initialization: presetting time backup module in distribution agent module, time backup module sends system mirror backup command to executor regularly;S2, mirror data in each mirror warehouse real-time synchronization: after executor receives backup command, the current state of its operating system generates a mirror file backup to mirror warehouse;The current state of operating system includes kernel and file system;S3, decision maker finds that executor has problem and cleans: decision maker carries out consistency decision according to the processing result of each executor, if it is found that abnormal executor, dispatching module sends cleaning instruction to executor;S4, execute cleaning instruction: executor takes out mirror file from mirror warehouse and loads, realizes the cleaning recovery of abnormal executor;S5, return to step S2, mirror data in each mirror warehouse real-time synchronization.

Description

Technical Field

[0001] This invention belongs to the field of mimicry defense technology, and particularly relates to a method, apparatus, equipment and medium for cleaning and restoring mimicry entities. Background Technology

[0002] Mimicry defense technology relies on a dynamic, heterogeneous, and redundant architecture to dynamically modify business processes and uses a feedback scheduling module to clean up problematic execution units. Current mimicry solutions often implement the cleanup operation by restarting the system or business processes. While this method can address memory-based attacks, it cannot address file system-based attacks.

[0003] There are also solutions that use image files to clean the execution body, such as 202011575745.2 Cleaning and recovery method, device, equipment and media based on OSPF protocol deployed in Docker containers. However, it is aimed at the OSPF protocol and not at the kernel and file system.

[0004] How can we recover from an attack that has been injected with a virus or Trojan at the kernel or file system level? Often, simply restarting the system after placing an attack file on the file system does not remove it. For example, if a file named c.txt is placed on the D drive of a computer, the c.txt file will remain after a restart. Therefore, a solution for cleaning up attack files from both the kernel and file system is needed. Summary of the Invention

[0005] To address the aforementioned issues, it is necessary to provide a method, apparatus, equipment, and medium for cleaning and restoring a mimicry execution entity.

[0006] The first aspect of this invention provides a method for cleaning and restoring a mimicry execution entity, comprising the following steps: S1. Initialization: A scheduled backup module is preset in the distribution agent module. The scheduled backup module sends system image backup commands to the executor at regular intervals. S2. Real-time synchronization of image data in each image repository: After receiving the backup command, the executable generates an image file of its current operating system state and backs it up to the image repository; the current operating system state includes the kernel and file system; S3. The arbiter detects problems with the executor and performs a cleanup: The arbiter makes a consistency decision based on the processing results of each executor. If an abnormal executor is found, the scheduling module sends a cleanup command to the executor. S4. Execute the cleaning instruction: The executor retrieves the image file from the image repository and loads it to clean and restore the abnormal executor; S5. Return to step S2, and the image data in each image repository will be synchronized in real time.

[0007] A second aspect of the present invention provides a mimicry actuator cleaning and recovery device, comprising: The scheduled backup module is pre-installed in the distribution agent module and communicates with the executor to send system image backup commands to the executor at regular intervals. The image repository communicates with the executor and is used to store image files. It is also used to provide an image file to the executor for loading after the executor receives a cleaning command, so as to clean and restore the abnormal executor. The image file is generated by the executor based on the current state of its operating system after receiving the backup command. The arbiter, which communicates with the executor, is used to make consistency decisions regarding the processing results of the executor. The scheduling module communicates with the executor and the arbiter. When it receives abnormal executor information from the arbiter, it sends a cleaning command to the corresponding executor.

[0008] A third aspect of the present invention provides an apparatus including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the mimicry execution body cleaning and recovery method as described above.

[0009] A fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions for performing the mimicry execution body cleaning and recovery method as described above.

[0010] The beneficial effects of this invention are as follows: By introducing a mirror repository into the distribution agent module and the executable, the system enables timed backups of the executable's state, thus solving the problem that traditional restart operations cannot resolve changes in the executable's file state.

[0011] Additional aspects and advantages of the invention will become apparent in the following description or may be learned by practice of the invention. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the present invention. Detailed Implementation

[0013] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0014] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0015] Example 1 like Figure 1 As shown, this embodiment provides a method for cleaning and restoring a mimicry execution entity, including the following steps: S1. Initialization: A scheduled backup module is preset in the distribution agent module. The scheduled backup module sends system image backup commands to the executor at regular intervals.

[0016] S2. Real-time synchronization of image data in each image repository: After receiving the backup command, the executable generates an image file of its current operating system state and backs it up to the image repository; the current operating system state includes the kernel and file system; Specifically, a virtual machine snapshot method is used to generate an image file of the current state of the executable operating system and back it up to the image repository: Creating operating system restore points: snapshot1 is a single snapshot, and snapshot2 creates a restore point based on snapshot1, taking snapshots of newly added content on top of snapshot1. Snapshots are typically around 40GB and can be backed up using a solid-state drive (SSD), usually taking about 5 minutes. Alternatively, if the backup data volume is large, the backup can be performed by backing up the file system step-by-step in the background. For example, backing up only one directory file at a time, and then gradually traversing and backing up the entire file system.

[0017] S3. The arbiter detects problems with the executor and performs cleanup: The arbiter makes a consistent decision based on the processing results of each executor. If an abnormal executor is found, the scheduling module sends a cleanup command to the executor.

[0018] S4. Execute the cleaning instruction: The executor retrieves the image file from the image repository and loads it to clean and restore the abnormal executor; The specific steps for executing the cleaning command are as follows: The executable retrieves the latest image file from the image repository and loads it. After successful loading, the executable is restored to the state of the latest image file. The executable's state is then checked. If the executable is still abnormal, the image file is rolled back to the previous image file, restoring the executable to the state of the previous image file, and the problematic image file is deleted. The executable's state is checked again until the executable returns to normal, at which point the cleaning step ends. If Executor 1 creates three snapshots (restore points): snap1, snap2, and snap3; when the mimicry system detects a problem with Executor 1, it will perform a cleanup operation on Executor 1. However, the mimicry system only detects the problem at this moment and does not know whether the problem already exists in snap1, snap2, and snap3. Perhaps the attack file has already been implanted in snap2 and snap3. In this case, it is necessary to use the backup image files to perform a trial-and-error rollback step by step to determine if the backup image files are problematic. For example, if it first restores to the state of snap3, and Executor 1 continues to have problems, it proves that the snap3 backup file has been infected. Then, if Executor 1 continues to roll back to the state of snap2, and Executor 1 continues to have problems, it proves that the snap2 backup file has been infected. When it rolls back to the state of snap1, the problem with Executor 1 disappears, proving that the snap1 backup file has not been infected. By employing a step-by-step recovery approach, it is helpful to gradually pinpoint the infected mirror sites, preventing attack files from being hidden through the accumulation of mirror files.

[0019] S5. Return to step S2, and the image data in each image repository will be synchronized in real time.

[0020] Example 2 This embodiment provides a mimicry actuator cleaning and restoration device, including: The scheduled backup module is pre-installed in the distribution agent module and communicates with the executor to send system image backup commands to the executor at regular intervals. The image repository communicates with the executor and is used to store image files. It is also used to provide an image file to the executor for loading after the executor receives a cleaning command, so as to clean and restore the abnormal executor. The image file is generated by the executor based on the current state of its operating system after receiving the backup command. The arbiter, which communicates with the executor, is used to make consistency decisions regarding the processing results of the executor. The scheduling module communicates with the executor and the arbiter. When it receives abnormal executor information from the arbiter, it sends a cleaning command to the corresponding executor.

[0021] It should be noted that, for the sake of convenience and brevity, the specific working process of the mimicry execution body cleaning and restoration device can be referred to the corresponding process of the method described in Embodiment 1 above, and will not be repeated here.

[0022] Example 3 A third aspect of the present invention provides an apparatus including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the mimicry execution body cleaning and recovery method as described above.

[0023] Example 4 A fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions for performing the mimicry execution body cleaning and recovery method as described above.

[0024] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0025] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for cleaning and restoring a mimicry execution entity, characterized in that, Includes the following steps: S1. Initialization: A scheduled backup module is preset in the distribution agent module. The scheduled backup module sends system image backup commands to the executor at regular intervals. S2. Real-time synchronization of image data in each image repository: After receiving the backup command, the executable generates an image file of its current operating system state and backs it up to the image repository; the current operating system state includes the kernel and file system; The mirror repository backs up the file system image files by backing up the file system step by step in the background; S3. The arbiter detects problems with the executor and performs a cleanup: The arbiter makes a consistency decision based on the processing results of each executor. If an abnormal executor is found, the scheduling module sends a cleanup command to the executor. S4. Execute the cleaning instruction: The executor retrieves the image file from the image repository and loads it to clean and restore the abnormal executor; The specific steps for executing the cleaning command are as follows: The executable retrieves the latest image file from the image repository and loads it. After successful loading, the executable restores itself to the state of the latest image file. The status of the execution body is determined. If the execution body is still abnormal, the image file is rolled back to the previous image file, so that the execution body is restored to the state of the previous image file, and the problematic image file is deleted. Continue to assess the status of the execution unit until it returns to normal, then end the cleaning step; S5. Return to step S2, and the image data in each image repository will be synchronized in real time.

2. The method for cleaning and restoring a mimicry execution body according to claim 1, characterized in that: In step S2, the current state of the executable operating system is generated into an image file and backed up to the image repository using a virtual machine snapshot method.

3. The method for cleaning and restoring a mimicry execution body according to claim 2, characterized in that: In step S2, the image repository uses solid-state drives to back up image files.

4. A mimicry actuator cleaning and restoration device, characterized in that, include: The scheduled backup module is pre-installed in the distribution agent module and communicates with the executor to send system image backup commands to the executor at regular intervals. The image repository communicates with the executor and is used to store image files. It is also used to provide an image file to the executor for loading after the executor receives a cleaning command, so as to clean and restore the abnormal executor. The image file is generated by the executor based on the current state of its operating system after receiving the backup command. The image repository backs up the file system image files by backing up the file system in the background step by step. The arbiter, which communicates with the executor, is used to make consistency decisions regarding the processing results of the executor. The scheduling module communicates with the executor and the arbiter. When it receives abnormal executor information from the arbiter, it sends a cleaning command to the corresponding executor. The specific steps for executing the cleaning command are as follows: The executable retrieves the latest image file from the image repository and loads it. After successful loading, the executable restores itself to the state of the latest image file. The status of the execution body is determined. If the execution body is still abnormal, the image file is rolled back to the previous image file, so that the execution body is restored to the state of the previous image file, and the problematic image file is deleted. Continue to assess the status of the execution unit until it returns to normal, then end the cleaning step.

5. The mimicry actuator cleaning and restoration device according to claim 4, characterized in that: The image repository uses solid-state drives to back up image files.

6. A device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the mimicry execution body cleaning and recovery method as described in any one of claims 1-3.

7. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions for performing the mimicry execution body cleaning and recovery method as described in any one of claims 1-3.

Images