A random file system for mimicking executives

Abstract

The present invention provides a random file system of a mimetic executable body, comprising: a benchmark parameter generator, embedded in a scheduler, which provides different benchmark parameters to each online executable body at the same time during the system initialization phase, and provides benchmark parameters different from those of each online executable body to a newly-launched executable body during the executable body scheduling phase; a randomized directory generator, embedded in the online executable body, which dynamically generates file directories and files based on a random generation algorithm according to the benchmark parameters provided by the scheduler; and a randomized directory creator, embedded in the online executable body, which creates instances in a user directory and a system directory respectively according to the file directories and files provided by the randomized directory generator, and loads an application into a specified directory after the instance is created.

Description

Technical Field

[0001] The present invention relates to the field of mimicry, and in particular to a random file system of a mimicry executive. Background Art

[0002] Mimicry defense technology has changed the game in cyberspace defense, providing a novel solution for network device network security. In engineering practice, mimicry systems often use Linux as a heterogeneous executable. However, Linux systems with different distributions and kernel versions often have similar file system directories. This allows directory browsing vulnerabilities to penetrate the mimicry defense system, reducing the mimicry system's ability to defend against file system directory-based attacks. Ensuring that online executables within a mimicry system have distinct directory structures is crucial for improving the system's resistance to coordinated attacks.

[0003] In order to solve the above problems, people have been seeking an ideal technical solution. Summary of the Invention

[0004] The purpose of the present invention is to address the deficiencies of the existing technology and thus provide a random file system for a mimetic executable body, dynamically change the content of the user file directory of the online executable body, ensure that the user directory of the online executable body is random and different, avoid the directory intersection function of the online executable body, and improve the heterogeneity of the file directory between the mimetic system executable bodies.

[0005] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a random file system of a mimicking executable, comprising:

[0006] The benchmark parameter generator is embedded in the scheduler and provides different benchmark parameters to each online executor at the same time during the system initialization phase. During the executor scheduling phase, it provides different benchmark parameters to the newly launched executor.

[0007] A randomized directory generator, embedded in the online executable, dynamically generates file directories and files based on a random generation algorithm according to benchmark parameters provided by the scheduler;

[0008] The randomized directory creator is embedded in the online executable body, and creates instances in the user directory and the system directory according to the file directory and files provided by the randomized directory creator, and loads the application to the specified directory after the instance is created.

[0009] Compared with the existing technology, the present invention has outstanding substantial features and significant progress. Specifically, the present invention introduces a randomized directory generator and a randomized directory creator on the execution body, and uses a scheduler to generate benchmark parameters to dynamically change the user file directory and file content of the online execution body, thereby ensuring that the online execution body has inconsistent file directories and file contents, avoiding the directory intersection function of the online execution body, improving the heterogeneity of the file directories between the execution bodies of the mimetic system, ensuring that the online execution body has inconsistent file directories and file contents, and improving the ability of the mimetic system to resist collaborative attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a structural schematic diagram of the present invention. DETAILED DESCRIPTION

[0011] The technical solution of the present invention is further described in detail below through specific implementation methods.

[0012] like Figure 1 As shown, the present invention provides a random file system of a mimic execution body, including:

[0013] The benchmark parameter generator is embedded in the scheduler and provides different benchmark parameters to each online executor at the same time during the system initialization phase. During the executor scheduling phase, it provides different benchmark parameters to the newly launched executor.

[0014] A randomized directory generator, embedded in the online executable, dynamically generates file directories and files based on a random generation algorithm according to benchmark parameters provided by the scheduler;

[0015] The randomized directory creator is embedded in the online executable body, and creates instances in the user directory and the system directory according to the file directory and files provided by the randomized directory creator, and loads the application to the specified directory after the instance is created.

[0016] It can be understood that the random file system of the mimetic executor also includes a benchmark parameter recorder, which is embedded in the scheduler and is used to record all benchmark parameters sent by the benchmark parameter generator to each online executor, so as to provide a generation basis to the benchmark parameter generator and ensure that the benchmark parameters of the newly online executor are different from those of each online executor.

[0017] Furthermore, the specific steps for the benchmark parameter recorder to provide the newly online executor with benchmark parameters different from those of each online executor during the executor scheduling stage are as follows: during the executor scheduling stage, the benchmark parameter generator generates benchmark parameters, and searches the benchmark parameter recorder based on the generated benchmark parameters. If a consistent benchmark parameter record is found, the benchmark parameters are regenerated; if not found, the benchmark parameters are sent to the newly online executor, and the benchmark parameters are recorded in the benchmark parameter recorder.

[0018] In the specific implementation, the benchmark parameters generated by the benchmark parameter generator in the scheduler include the execution body serial number, the characters constituting the file name and directory name, the length range of the file name and directory name, the file content characters and the file size. Specifically, it can be represented by varlist={ID, var1, var2, var3, var4}, where varlist represents the benchmark parameters, ID represents the execution body serial number, var1 represents the characters constituting the file name and directory name, var2 represents the length range of the file name and directory name, var3 represents the file content characters, and var4 represents the file size.

[0019] Specifically, the steps for generating the benchmark parameters are as follows: randomly select 2 numbers from 1-36 as the length range of the directory and file name var2; based on the maximum value max in the length range of the directory and file name, randomly select max characters from the English letters az and the numbers 1-9 as the file name and directory name composition characters var1 and the file content characters var3; randomly select a number from 2, 4, 6, 8, .... 1024 as the file size, in KB, and construct a file size set after multiple selections.

[0020] During specific implementation, the randomized directory generator on each execution body has the same random generation algorithm to maintain the consistency of the system files on each execution body.

[0021] For example, in the initial state, online executable 1 uses the CentOS operating system, with the system directories being / bin, / sbin, / etc, and / var, the user directories being / root and / home, the application being mimic, the configuration being mimic.conf, and both mimic and mimic.conf being located in the / home directory; online executable 2 uses the Fedor operating system, with the system directories being / bin, / sbin, / etc, and / var, the user directories being / root and / home, the application being mimic, the configuration being mimic.conf, and both mimic and mimic.conf being located in the / home directory; online executable 3 uses the Ubuntu operating system, with the system directories being / bin, / sbin, / etc, and / var, the user directories being / root and / home, the application being mimic, the configuration being mimic.conf, and both mimic and mimic.conf being located in the / home directory;

[0022] The above initial state is represented by a vector, and sytem={ID, dir, userFile} is obtained, where ID represents the execution body number, dir represents the system directory, and userFile represents the file generated by the randomized directory generator. The initial state userFile is NULL.

[0023] user={ID, userdir, userFile, appDIR}, where ID represents the executable serial number, userdir represents the file directory generated by the random directory generator, userFile represents the file generated by the random directory generator, and appDIR represents the application storage directory. AppDIR is specified by the random directory generator based on the formula appDIR = random(userdir), that is, a path is randomly selected in the generated userdir directory as the application storage directory.

[0024] Use userdir=(random(userdir0)+random(var1,random(var2)))t to generate a file directory, where userdir is the file directory generated by the randomized directory generator and userdir0 is the randomly selected parent file directory. Var1 is the characters that make up the file name and directory name, var2 is the length range of the file name and directory name, and t is the system time parameter, accurate to ms. Ensure that the values ​​generated in each time range are different and are directly appended to the string.

[0025] Suppose var1={a,b,c,1,2,3,4},var2=[1,4]={1,2,3,4}; random(var2) means randomly selecting a number from 1 to 4. If the selected number is 2, then random(var1,2) means randomly selecting 2 characters from var1. If the 2 characters selected are a and 1, then random(var1,random(var2)))=a1.

[0026] For another example, var1 = {a, b, c, 1}, var2 = {1, 2, 3, 4}, and userdir0 = / root / . At time t0, userdir = / root / abc2021122718195921, where 2021122718195921 is the system time parameter. At time t1, userdir = / root / ab12021122718195922, where 2021122718195922 is the system time parameter. At time t2, userdir = / root / abc2021122718195921 / ac12021122718195923, where 2021122718195923 is the system time parameter.

[0027] That is, at time t0, the first-level directory is generated, then at time t1, the first-level directory is entered, and then the second-level directory is generated. At time t2, the second-level directory is entered again, and then the third-level directory is generated, and so on. The file directories are generated in a dynamic and randomly nested manner.

[0028] Use userFile=((random(var1,var2)+MD5(random(var3)*random(var4)))t to generate a file, where userFile is the file, var1 and var2 are the baseline parameters for generating the file name, var3 and var4 are the baseline parameters for generating the file content, var3 is the characters to be written to the file and encrypted using MD5, and var4 is the file size set. The file size is used to limit the number of times characters can be written.

[0029] Randomly select a directory under the file directory, create a file based on the file name random(var1,var2), and write the file content MD5(random(var3)*random(var4)) into the file;

[0030] For files in the system directory, randomly select a system directory and store the created file random(var1,var2) in the system directory. At the same time, write the file content MD5(random(var3)*random(var4)) into the file (random(var1,var2).

[0031] For example, if var1 = {a, b, c, 1}, var2 = {1, 2, 3, 4}, var3 = {a, b, c, 1}, and var4 = {8, 16, 24}, at time t0, fileName = abc123 and fileContent = MD5(a)*16, a random directory is selected within the userdir directory, fileName is created, and fileContent is written to fileNname. For files in system directories, a random system directory is selected from the system collection, the generated fileName is stored there, and fileContent is written to fileName.

[0032] In particular, it is pointed out that since random changes in the executable system directory may affect the stable operation of the system, this embodiment only randomly adds new files to the files in the system directory.

[0033] The present invention proposes a randomized file system of a mimetic executable body. By introducing a randomized directory generator and a randomized directory creator on the executable body and generating benchmark parameters with the help of a scheduler, it ensures that the online executable body has inconsistent file directories and file contents, enhances the heterogeneity of the file system, and improves the mimetic system's ability to resist coordinated attacks.

[0034] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present invention. They should all be included in the scope of the technical solution for protection of the present invention.

Claims

1. A random file system of a mimetic executable, characterized in that: include: The benchmark parameter generator is embedded in the scheduler and provides different benchmark parameters to each online executor at the same time during the system initialization phase. During the executor scheduling phase, it provides different benchmark parameters to the newly launched executor. A randomized directory generator is embedded in the online executable, dynamically generates file directories and files based on a random generation algorithm according to the benchmark parameters provided by the scheduler, and creates instances in the system directory; The randomized directory creator is embedded in the online executable body, creates an instance in the user directory according to the file directory and files provided by the randomized directory creator, and loads the application into the specified file directory after the instance is created.

2. The random file system of the mimicking executable according to claim 1, characterized in that: The randomization directory generator on each executable has the same random generation algorithm.

3. The random file system of the mimicking executable according to claim 1, characterized in that: It also includes a benchmark parameter recorder embedded in the scheduler, which is used to record all benchmark parameters sent by the benchmark parameter generator to each online executor, so as to provide a generation basis for the benchmark parameter generator and ensure that the benchmark parameters of the newly online executor are different from those of the online executors.

4. The random file system of the mimicking executable according to claim 3, characterized in that: The specific steps of providing the newly launched executor with different benchmark parameters from those of the online executors in the executor scheduling phase are as follows: in the executor scheduling phase, the benchmark parameter generator generates benchmark parameters, and searches the benchmark parameter recorder based on the generated benchmark parameters. If a consistent benchmark parameter record is found, the benchmark parameters are regenerated; If not found, the benchmark parameters are sent to the new online execution body and the benchmark parameters are recorded in the benchmark parameter recorder.

5. The random file system of the mimicking executable according to claim 1, characterized in that: The benchmark parameters include the executable serial number, the characters constituting the file name and directory name, the length range of the file name and directory name, the characters in the file content, and the file size.

6. The random file system of the mimic execution body according to claim 5, characterized in that: The steps for generating the benchmark parameters are as follows: Randomly select 2 numbers from 1-36 as the length range of the directory and file name; Randomly select max characters from the English letters a-z and numbers 1-9 based on the maximum value max in the length range of directory and file names as the characters constituting the file name, directory name, and file content; Randomly select a number from 2, 4, 6, 8, .... 1024 as the file size, in KB, and construct a file size set after multiple selections.

7. The random file system of the mimicking executable according to claim 5, characterized in that: Use userdir=(random(userdir0)+random(var1,random(var2)))t to generate a file directory, where userdir is the file directory generated by the randomized directory generator, userdir0 is the randomly selected parent file directory; t is the system time parameter, var1 is the characters that make up the file name and directory name, and var2 is the length range of the file name and directory name.

8. The random file system of the mimicking executable according to claim 7, characterized in that: Use userFile=((random(var1,var2)+MD5(random(var3)*random(var4)))t to generate a file, where userFile is the file, MD5() is the encryption function; var3 is the file content character, and var4 is the file size set; Randomly select a directory under the file directory, create a file based on the file name random(var1,var2), and write the file content MD5(random(var3)*random(var4)) into the file; For files in the system directory, randomly select a system directory and store the created file random(var1,var2) in the system directory. At the same time, write the file content MD5(random(var3)*random(var4)) into the file (random(var1,var2).

9. The random file system of the mimicking executable according to claim 5, characterized in that: Randomly select a path in the generated file directory as the application storage directory and load the application.

Images