Mimicry defense judgment method, device, electronic device and storage medium

Abstract

The embodiment of the present application discloses a mimicry defense adjudication method, device, electronic device and storage medium, the method comprising: obtaining first attribute information of the main execution program of each heterogeneous executor, and second attribute information of the backup execution program of each heterogeneous executor; based on the first attribute information and the second attribute information, determining whether the main execution program and the backup execution program of the heterogeneous executor have been tampered with to verify the security of the heterogeneous executor; based on the verification result, adjudicating the response information fed back by the multiple heterogeneous executors to obtain the adjudication result. The method can effectively identify attack behaviors on heterogeneous executors and avoid adjudication escape when the execution program of the heterogeneous executor is attacked but the normal operation of the execution program of the heterogeneous executor is not affected.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of security protection technology, and in particular to a mimicry defense decision method, a mimicry defense decision device, an electronic device, and a computer-readable storage medium. Background Art

[0002] The theory of mimicry defense was proposed by Academician Wu Jiangxing and includes theories, methods, and technologies of intrinsic security mechanisms based on dynamic heterogeneous redundant architecture. In order to increase the security of the network, the idea of ​​mimicry is combined, and the isolation between processes is increased through virtualization technology, which greatly improves the reliability and fault tolerance of the system. Executor heterogeneity is a new concept. It integrates multiple executors as much as possible to provide multiple services in a mimicry environment, which is conducive to the expansion of other platforms. In the conventional mimicry defense adjudication method, if the heterogeneous executor is attacked by vulnerabilities such as code injection after startup, resulting in code changes, but without affecting the normal operation of the heterogeneous executor, it is easy for the adjudication to escape during the adjudication process. Summary of the invention

[0003] In view of the above-mentioned problems existing in the prior art, the embodiments of the present application provide a mimicry defense decision method, a mimicry defense decision device, an electronic device and a computer-readable storage medium, so that it is possible to prevent the decision escape when the execution program of a heterogeneous execution body is attacked.

[0004] To solve the above problems, the technical solution provided by the embodiments of the present application is:

[0005] A mimicry defense adjudication method, comprising:

[0006] Acquire first attribute information of a main execution program of each heterogeneous execution body, and second attribute information of a backup execution program of each heterogeneous execution body;

[0007] Based on the first attribute information and the second attribute information, determining whether a main execution program and a backup execution program of the heterogeneous execution body have been tampered with, so as to verify the security of the heterogeneous execution body;

[0008] Based on the verification result, the response information fed back by the plurality of heterogeneous executors is adjudicated to obtain a decision result.

[0009] In some embodiments, determining whether a main execution program and a backup execution program of the heterogeneous execution body are tampered with based on the first attribute information and the second attribute information to verify the security of the heterogeneous execution body includes:

[0010] Based on the first attribute information and the second attribute information, performing consistency evaluation on a main execution program and a backup execution program of the heterogeneous execution body;

[0011] When the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, it is determined that the security verification of the heterogeneous execution body has passed.

[0012] In some embodiments, based on the first attribute information and the second attribute information, performing consistency evaluation on the main execution program and the backup execution program of the heterogeneous execution body includes:

[0013] Determine whether the most recent modification time of each file in the main executable program is the same;

[0014] Determine whether the most recent modification time of each file in the standby execution program is the same;

[0015] Determining whether the number of files of the primary execution program is the same as the number of files of the backup execution program;

[0016] Determine whether the most recent modification time of the file in the primary execution program is the same as the most recent modification time of the file in the standby execution program;

[0017] Accordingly, when the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, determining that the security verification of the heterogeneous execution body has passed includes:

[0018] When the most recent modification time of each file in the main execution program is the same, the most recent modification time of each file in the backup execution program is the same, the most recent modification time of a file in the main execution program and the most recent modification time of a file in the backup execution program are the same, and the number of files in the main execution program and the number of files in the backup execution program are the same, it is determined that the security verification of the heterogeneous execution body has passed.

[0019] In some embodiments, obtaining first attribute information of a main execution program of each heterogeneous execution body and second attribute information of a backup execution program of each heterogeneous execution body includes:

[0020] Determine the most recent modification time of each file in the primary execution program, the number of files in the primary execution program, the most recent modification time of each file in the backup execution program, and the number of files in the backup execution program;

[0021] A first identifier is generated based on the most recent modification time of each file in the primary execution program, and a second identifier is generated based on the most recent modification time of each file in the standby execution program; wherein the first identifier is used to identify the consistency of the most recent modification time of each file in the primary execution program, and the second identifier is used to identify the consistency of the most recent modification time of each file in the standby execution program;

[0022] The first attribute information is generated based on the first identifier, the number of files of the main execution program, and the most recent modification time of at least one file in the main execution program, and the second attribute information is generated based on the second identifier, the number of files of the backup execution program, and the most recent modification time of at least one file in the backup execution program.

[0023] In some embodiments, based on the verification result, adjudicating the response information fed back by the plurality of heterogeneous executors to obtain the adjudication result includes:

[0024] When the verification result indicates that at least one of the heterogeneous executives has not passed the verification, the corresponding heterogeneous executive is cleaned by a negative feedback controller, and an error notification is fed back to the terminal device to inform the terminal device of an access error.

[0025] In some embodiments, based on the verification result, adjudicating the response information fed back by the plurality of heterogeneous executors to obtain the adjudication result further includes:

[0026] When the verification result indicates that each of the heterogeneous executables has passed the verification, obtaining third attribute information of each of the response information;

[0027] Based on the third attribute information, determining whether the plurality of response information are the same;

[0028] If yes, the response information is fed back to the terminal device as target response information;

[0029] If not, an error notification is fed back to the terminal device to inform the terminal device that an access error occurs.

[0030] In some embodiments, determining whether the plurality of response information are the same based on the third attribute information includes:

[0031] Determine, based on the status code of the response information, whether the response status of each of the response information is a successful response;

[0032] Determining whether the response types of the response information are the same;

[0033] Determining whether the response encoding formats of the response information are the same;

[0034] When the response status of each of the response information is a successful response, the response type of each of the response information is the same, and the response encoding format of each of the response information is the same, determining whether the response content of each of the response information is the same, and determining whether the response length of each of the response information is the same;

[0035] When the response contents are the same and / or the response lengths are the same, it is determined that the multiple response information are the same.

[0036] A mimicry defense judgment device, comprising:

[0037] An acquisition module, used to acquire first attribute information of a main execution program of each heterogeneous execution body, and second attribute information of a backup execution program of each heterogeneous execution body;

[0038] a verification module, configured to determine whether a main execution program and a backup execution program of the heterogeneous execution body have been tampered with based on the first attribute information and the second attribute information, so as to verify the security of the heterogeneous execution body;

[0039] The decision module is used to decide the response information fed back by the plurality of heterogeneous executors based on the verification result to obtain a decision result.

[0040] An electronic device comprises at least a memory and a processor, wherein the memory stores a program, and the processor implements the above method when executing the program on the memory.

[0041] A computer-readable storage medium stores computer-executable instructions, and the method described above is implemented when the computer-executable instructions in the computer-readable storage medium are executed.

[0042] The mimic defense adjudication method of the embodiment of the present application obtains the first attribute information of the main execution program of each heterogeneous executor and the second attribute information of the backup execution program of each heterogeneous executor; based on the first attribute information and the second attribute information, determines whether the main execution program and the backup execution program of the heterogeneous executor have been tampered with to verify the security of the heterogeneous executor; based on the verification result, adjudicates the response information fed back by the multiple heterogeneous executors to obtain the adjudication result. It can effectively identify the attack behavior on the heterogeneous executor and avoid the adjudication escape when the execution program of the heterogeneous executor is attacked but the normal operation of the execution program of the heterogeneous executor is not affected. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0044] Figure 1 This is the system architecture diagram of the mimicry defense system;

[0045] Figure 2 A flowchart of a mimicry defense decision method according to an embodiment of the present application;

[0046] Figure 3 This is a flowchart of step S210 in the mimicry defense decision method according to an embodiment of the present application;

[0047] Figure 4 This is a flowchart of an embodiment of step S220 in the mimicry defense decision method of an embodiment of the present application;

[0048] Figure 5 This is a flowchart of another embodiment of step S220 in the mimicry defense decision method of the embodiment of the present application;

[0049] Figure 6 This is a flowchart of step S230 in the mimicry defense decision method according to an embodiment of the present application;

[0050] Figure 7 It is a structural block diagram of the mimicry defense decision device according to an embodiment of the present application;

[0051] Figure 8 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0053] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0054] The present application embodiment provides a mimicry defense decision method, which can be applied to a mimicry defense system. Figure 1 For the system architecture diagram of the mimicry defense system, see Figure 1As shown, the mimic defense system generally includes an input proxy module 110, a heterogeneous executor pool 120, a decision module 130, an output proxy module 140, and a negative feedback controller 150, etc. The heterogeneous executor pool 120 may include a plurality of heterogeneous executors such as a heterogeneous executor 121, a heterogeneous executor 122, and a heterogeneous executor 123. The plurality of heterogeneous executors may be constructed using different programming languages, system architectures, or other technologies, but may achieve the same functions. In theory, when the same input data is input to the plurality of heterogeneous executors, the response information output by the plurality of heterogeneous executors should be the same.

[0055] The input proxy module 110 is used to receive an access request sent by a terminal device, for example, an HTTP access request, and distribute the access request to more than two heterogeneous executors in the heterogeneous executor pool 120. The heterogeneous executors output response information based on the access request. The decision module 130 is used to make a decision on the response information and generate a decision result. The output proxy module 140 is used to send feedback information to the terminal device based on the decision result. The feedback information can be one of multiple response information, or an error notification for notifying the terminal device of access failure, etc.

[0056] It should be noted that the system architecture of the above-mentioned mimetic defense system is only exemplary, and the mimetic defense decision method of the embodiment of the present application is not only applicable to the mimetic defense system of the above-mentioned structure, but also can be applied to mimetic defense systems of other structures.

[0057] Figure 2 This is a flowchart of the mimicry defense decision method according to an embodiment of the present application. Figure 2 As shown, the mimicry defense decision method of the embodiment of the present application may specifically include the following steps.

[0058] S210, obtaining first attribute information of a main execution program of each heterogeneous execution body and second attribute information of a backup execution program of each heterogeneous execution body.

[0059] Each heterogeneous executor should at least include the heterogeneous executor selected to respond to the access request. For example, when two heterogeneous executors are selected from the heterogeneous executor pool to respond to the access request sent by the terminal device, the first attribute information and the second attribute information of the two heterogeneous executors can be obtained. Of course, all heterogeneous executors in the heterogeneous executor pool may also be included.

[0060] A heterogeneous executable body usually has a main executable program and a backup executable program. In the first application scenario, the backup executable program is stored in a first storage space, which can be a secure storage space that is not vulnerable to attacks. When constructing a heterogeneous executable body, the main executable program can be written into a carrier such as a container, a virtual machine, or an electronic device based on the backup executable program, thereby forming a heterogeneous executable body. In this scenario, the first attribute information can be obtained from the heterogeneous executable body, and the second attribute information can be obtained from the first storage space.

[0061] In the second application scenario, the main execution program and the backup execution program can back up each other, and when constructing a heterogeneous execution body, they can be written into a carrier such as a container, a virtual machine, or an electronic device at the same time and in exactly the same state, thereby forming a heterogeneous execution body. In this application scenario, the first attribute information and the second attribute information can be obtained from the heterogeneous execution body.

[0062] Of course, no matter which of the above application scenarios, when it is determined that the standby execution program is relatively safe, it can be considered that the second attribute information usually does not change, and the second attribute information of each standby execution program can be obtained in advance and stored in a second storage space different from the first storage space. If the security of heterogeneous execution bodies is required, the second attribute information can be obtained from the second storage space.

[0063] It should also be noted that the above two embodiments are only illustrative of the method for obtaining the first attribute information and the second attribute information. The mimicry defense determination method of the embodiment of the present application is not limited to application in the above two application scenarios, but can also be applied in other application scenarios.

[0064] Optionally, the first attribute information may include, for example, a file list, file name, modification time, file type, file size, and file quantity of the main execution program. Similarly, the second attribute information may include a file list, file name, modification time, file type, file size, and file quantity of the backup execution program. It should be noted that the specific contents of the first attribute information and the second attribute information are only exemplary, and in specific implementation, other parameters that can be used to determine whether the main execution program and the backup execution program have been tampered with may also be included.

[0065] Optionally, after obtaining the response information fed back by each heterogeneous executor, the first attribute information of the main execution program and the second attribute information of the standby execution program of each heterogeneous executor may be obtained. Alternatively, when selecting a corresponding heterogeneous executor to process an access request or sending an access request to a corresponding heterogeneous executor, the first attribute information of the main execution program and the second attribute information of the standby execution program of the corresponding heterogeneous executor may be obtained.

[0066] S220: Based on the first attribute information and the second attribute information, determine whether the main execution program and the backup execution program of the heterogeneous execution body are tampered with, so as to verify the security of the heterogeneous execution body.

[0067] Optionally, when the first attribute information and the second attribute information are obtained, the first attribute information and the second attribute information can be compared to determine whether the main execution program and the backup execution program in the heterogeneous execution body have been tampered with, so as to verify the security of the heterogeneous execution body. For example, in the first application scenario mentioned above, since the backup execution program is not easily tampered with, the second attribute information of the backup execution program is actually used as the target attribute information, and by comparing the first attribute information with the second attribute information, it can be determined whether the main execution program in the heterogeneous execution body has been tampered with. In the second application scenario mentioned above, if the backup execution program is stored in a carrier in a relatively secure state, or when the main execution program and the backup execution program are not easily tampered with at the same time and are tampered with to be exactly the same, it is also possible to determine whether the main execution program and the backup execution program of the heterogeneous execution body have been tampered with by comparing the first attribute information and the second attribute information.

[0068] Optionally, when the first attribute information and the second attribute information are obtained, the first attribute information and the second attribute information may be compared with the target attribute information to determine whether the main execution program and the backup execution program in the heterogeneous execution body have been tampered with, so as to verify the security of the heterogeneous execution body. For example, the target attribute information may record the attribute information when the heterogeneous execution body is constructed, and the first attribute information may be compared with the target attribute information to determine whether the main execution program has been tampered with, and the second attribute information may be compared with the target attribute information to determine whether the backup execution program has been tampered with.

[0069] Of course, in specific implementation, other analysis methods can also be used to determine whether the main execution program and the backup execution program of the heterogeneous execution body have been tampered with based on the first attribute information and the second attribute information. For example, a verification model for verifying the security of the heterogeneous execution body can be constructed, and the first attribute information and the second attribute information can be input into the verification model as input data, and the security of the heterogeneous execution body can be verified through the verification model.

[0070] S230: Based on the verification result, adjudicate the response information fed back by the plurality of heterogeneous executors to obtain an adjudication result.

[0071] Optionally, when the verification result indicates that the security of at least one heterogeneous executor among multiple heterogeneous executors has not been verified, the response information can be directly determined to be unreliable, the heterogeneous executor whose security has not been verified can be cleaned and rebuilt, and an error notification can be fed back to the terminal device to inform the terminal device of an access error. When the verification result indicates that multiple heterogeneous executors have all been verified, it indicates that the main execution program and the backup execution program of each heterogeneous executor have not been tampered with, and the heterogeneous executors have high security, and the third attribute information of the response information can be obtained, and the response information can be further determined based on the third attribute information.

[0072] The mimic defense adjudication method of the embodiment of the present application obtains the first attribute information of the main execution program of each heterogeneous executor and the second attribute information of the backup execution program of each heterogeneous executor; based on the first attribute information and the second attribute information, determines whether the main execution program and the backup execution program of the heterogeneous executor have been tampered with to verify the security of the heterogeneous executor; based on the verification result, adjudicates the response information fed back by the multiple heterogeneous executors to obtain the adjudication result. It can effectively identify the attack behavior on the heterogeneous executor and avoid the adjudication escape when the execution program of the heterogeneous executor is attacked but the normal operation of the execution program of the heterogeneous executor is not affected.

[0073] Cooperate Figure 3 As shown, in some embodiments, step S210, obtaining first attribute information of a main execution program of each heterogeneous execution body and second attribute information of a backup execution program of each heterogeneous execution body, may include the following steps.

[0074] S211, determining the most recent modification time of each file in the main execution program and the number of files of the main execution program.

[0075] S212, generating a first identifier based on the most recent modification time of each file in the main execution program; wherein the first identifier is used to identify the consistency of the most recent modification time of each file in the main execution program.

[0076] S213: Generate the first attribute information based on the first identifier, the number of files of the main executable program, and the most recent modification time of at least one file in the main executable program.

[0077] S214, determining the most recent modification time of each file in the standby execution program and the number of files in the standby execution program.

[0078] S215, generating a second identifier based on the latest modification time of each file in the standby execution program; wherein the second identifier is used to identify the consistency of the latest modification time of each file in the standby execution program.

[0079] S216: Generate the second attribute information based on the second identifier, the number of files of the standby execution program, and the most recent modification time of at least one file in the standby execution program.

[0080] Optionally, the most recent modification time (fileLastTime) of each file in the main executable program of the heterogeneous executable body and the number of files (fileCount) of the main executable program can be determined. Determine whether the most recent modification time (fileLastTime) of each file in the main executable program is the same. If they are the same, generate a first identifier that can identify that the most recent modification time of each file in the main executable program is the same. If they are different, generate a first identifier that can identify that the most recent modification time of each file in the main executable program is different. For example, when the fileLastTime of each file is the same, the first identifier (securityId) can be assigned a value of 1. When the fileLastTime of at least one file in the main executable program is different from the fileLastTime of other files, the first identifier (securityId) can be assigned a value of 0. Then, one of the fileLastTime of multiple files can be selected, for example, the fileLastTime of the first file, or the fileLastTime of the last file can be selected. Combine fileCount, fileLastTime and securityId into a string as the first attribute information (code-security). For example, the number of files (fileCount) may be 322, the timestamp of the most recent modification time (fileLastTime) of the file is 1652352143, and the first identifier is 1. Thus, the first attribute information (code-security) is 322-1652352143-1. Similar to the first attribute information (code-security), the second attribute information (code-security-safe) may be generated.

[0081] It should be noted that, when the second attribute information has been pre-generated, the pre-generated second attribute information may be directly acquired, for example, the second attribute information may be directly acquired from the second storage space without executing steps S214 to S216.

[0082] Cooperate Figure 4As shown, in some embodiments, step S220, based on the first attribute information and the second attribute information, determines whether the main execution program and the backup execution program of the heterogeneous execution body are tampered with to verify the security of the heterogeneous execution body, which may include the following steps.

[0083] S221: Based on the first attribute information and the second attribute information, a consistency evaluation is performed on a main execution program and a backup execution program of the heterogeneous execution body.

[0084] S222: When the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, determine that the security verification of the heterogeneous execution body has passed.

[0085] The possibility that the main execution program and the backup execution program are tampered with at the same time and tampered with to be exactly the same is extremely small. Therefore, determining whether the main execution program and the backup execution program are consistent can determine whether the heterogeneous execution body has been attacked. That is, when the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, it can be determined that the heterogeneous execution body has not been attacked, and the security verification of the heterogeneous execution has passed. When the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are inconsistent, it can be determined that the heterogeneous execution body has been attacked, and the security verification of the heterogeneous execution body has passed. Compared with directly identifying attack behaviors, it is easier to implement consistency evaluation of the main execution program and the backup execution program based on the first attribute information and the second attribute information, and it can effectively identify attack behaviors.

[0086] In some embodiments, based on the first attribute information and the second attribute information, performing consistency evaluation on the main execution program and the backup execution program of the heterogeneous execution body includes:

[0087] Determine whether the most recent modification time of each file in the main executable program is the same;

[0088] Determine whether the most recent modification time of each file in the standby execution program is the same;

[0089] Determining whether the number of files of the primary execution program is the same as the number of files of the backup execution program;

[0090] Determine whether the most recent modification time of the file in the primary execution program is the same as the most recent modification time of the file in the standby execution program;

[0091] Accordingly, when the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, determining that the security verification of the heterogeneous execution body has passed includes:

[0092] When the most recent modification time of each file in the main execution program is the same, the most recent modification time of each file in the backup execution program is the same, the most recent modification time of a file in the main execution program and the most recent modification time of a file in the backup execution program are the same, and the number of files in the main execution program and the number of files in the backup execution program are the same, it is determined that the security verification of the heterogeneous execution body has passed.

[0093] Regardless of the first application scenario or the second application scenario, if the main execution program and the backup execution program have not been tampered with, the file composition, number of files, and the most recent modification time of each file in the main execution program and the backup execution program should be exactly the same. Therefore, by comparing the most recent modification time of the files in the main execution program, the most recent modification time of the backup execution program, the number of files in the main execution program, and the number of files in the backup execution program, it is possible to accurately determine whether the main execution program and the backup execution program are consistent, and whether the main execution program and the backup execution program have been tampered with. Of course, in the first application scenario, the possibility of the backup execution program being tampered with is very small, so it is not certain whether the most recent modification time of each file in the backup execution program is the same.

[0094] Cooperate Figure 5 As shown, in some embodiments, step S220, based on the first attribute information and the second attribute information, determines whether the main execution program and the backup execution program of the heterogeneous execution body are tampered with to verify the security of the heterogeneous execution body, which may include the following steps.

[0095] S223, based on the first identifier and the second identifier, determine whether the most recent modification time of each file in the main execution program is the same, and determine whether the most recent modification time of each file in the standby execution program is the same. If yes, execute step S224; if not, execute step S227.

[0096] That is, if the most recent modification time of each file in the main execution program is the same, then step S224 is continued. If the most recent modification time of at least one file in the main execution program is different from the most recent modification time of other files, or if the most recent modification time of at least one file in the backup execution program is different from the most recent modification time of other files, it is determined that the main execution program or the backup execution program has been tampered with, and the security verification of the heterogeneous execution body has failed.

[0097] Optionally, it can be determined whether the value assigned to the first identifier (securityId) is 1, and whether the value assigned to the second identifier (securityId) is 1. When the value assigned to the first identifier (securityId) is 1, it can be determined that the fileLastTime of each file in the main executable program is the same. When the value assigned to the first identifier is 0, it can be determined that the fileLastTime of each file in the main executable program is different. Similarly, when the value assigned to the second identifier (securityId) is 1, it can be determined that the fileLastTime of each file in the backup executable program is the same, and when the value assigned to the second identifier is 0, it can be determined that the fileLastTime of each file in the backup executable program is different.

[0098] S224, determining whether the number of files of the main execution program is the same as the number of files of the standby execution program. If yes, executing step S225; if not, executing step S227.

[0099] That is, if the number of files of the main execution program is the same as the number of files of the backup execution program, then step S225 is continued. If the number of files of the main execution program is different from the number of files of the backup execution program, it can be determined that the main execution program or the backup execution program has been tampered with, and the security verification of the heterogeneous execution body has failed.

[0100] Optionally, the fileCount character segment may be extracted from the code-security string and the code-security-safe string respectively, and it is determined whether the two fileCount character segments are the same. If they are the same, it is determined that the number of files of the main execution program and the number of files of the backup execution program are the same; if they are different, it is determined that the number of files of the main execution program and the number of files of the backup execution program are different.

[0101] S225, determining whether the most recent modification time of the file in the primary execution program is the same as the most recent modification time of the file in the standby execution program. If yes, executing step S226; if not, executing step S227.

[0102] Optionally, the fileLastTime character segment may be extracted from the code-security string and the code-security-safe string respectively, and it is determined whether the two fileLastTime strings are the same. If they are the same, it is determined that the most recent modification time of the file in the primary execution program is the same as the most recent modification time of the file in the backup execution program; if they are different, it is determined that the most recent modification time of the file in the primary execution program is different from the most recent modification time of the file in the backup execution program.

[0103] S226, determining whether the security verification of the heterogeneous executable has passed.

[0104] S227, determining that the main execution program or the backup execution program has been tampered with, and the security verification of the heterogeneous execution body has failed.

[0105] By reasonably configuring the judgment process of each parameter in the first attribute information and the second attribute information, it is not only possible to accurately determine whether the main execution program and the backup execution program have been tampered with, but also helpful to reduce unnecessary judgment processes, reduce data processing volume, and improve data processing efficiency.

[0106] Cooperate Figure 6 As shown, in some embodiments, step S230, based on the verification result, adjudicating the response information fed back by the plurality of heterogeneous executors to obtain the adjudication result, may include the following steps.

[0107] S231, based on the verification result, determine whether the plurality of heterogeneous executables have all passed the verification, if yes, execute step S232, if no, execute step S235.

[0108] S232, obtaining third attribute information of each of the response information.

[0109] S233, based on the third attribute information, determine whether the multiple response information are the same, if yes, execute step S234, if not, execute step S235.

[0110] S234, feeding back the response information as target response information to the terminal device.

[0111] S235, cleaning and rebuilding the corresponding heterogeneous execution body through the negative feedback controller, and feeding back an error notification to the terminal device to inform the terminal device of the access error.

[0112] If any heterogeneous executor fails the security verification, the negative feedback controller can clean and rebuild the heterogeneous executor, and consider the response information fed back by these heterogeneous executors to be unreliable, and an error notification can be fed back to the terminal device to inform the terminal device of the access error. For example, a 404 status code can be fed back to the terminal device.

[0113] When all heterogeneous executors have passed security verification, it can be determined that none of the heterogeneous executors have been attacked, and at least the response information is credible from the perspective of the execution program of the heterogeneous executors. Continue to obtain the third attribute information of the response information itself, and determine whether each response information is the same based on the third attribute information. Since the original intention of the design of each heterogeneous executor is to output the same output data when the input data is the same, if all the response information is the same, it is determined that these response information are credible, and one of them can be selected to be fed back to the terminal device. If at least one response information is different from the other response information, it is considered that these response information are unreliable, and the corresponding heterogeneous executors are cleaned and rebuilt through the negative feedback controller, and an error notification is fed back to the terminal device to inform the terminal device of an access error.

[0114] In some embodiments, step S233, determining whether the plurality of response information are the same based on the third attribute information, may include the following steps.

[0115] Based on the status code of the response information, determine whether the response status of each response information is a successful response.

[0116] Determine whether the response types of the response information are the same.

[0117] Determine whether the response encoding formats of the response information are the same.

[0118] When the response status of each response information is a successful response, the response type of each response information is the same, and the response encoding format of each response information is the same, determine whether the response content of each response information is the same, and determine whether the response length of each response information is the same.

[0119] When the response contents are the same and / or the response lengths are the same, it is determined that the multiple response information are the same.

[0120] Optionally, the third attribute information may include the status code (status), response type (content-type), response encoding format (content-encoding), response content (content-body) and response length (content-length) of the response information, etc. Of course, the third attribute information is not limited to the above content, and may also include other parameters.

[0121] Optionally, five types of attribute information, including status code (status), response type (content-type), response encoding format (content-encoding), response content (content-body) and response length (content-length), can be used as decision items, and a decision result can be set for each decision item. The decision result can be assigned a value of 0 or 1.

[0122] Based on the status code of the response information, it can be determined whether the response status of each response information is a successful response. If the response is successful, the decision result is assigned a value of 1. If the response fails, the decision result is assigned a value of 0. Taking the response information in accordance with the Http protocol as an example, if the status code is "200", it indicates that the response status of the response information is a successful response, and the decision result can be assigned a value of 1. If the status code is "400", it indicates that the response is unsuccessful, and the decision result can be assigned a value of 0.

[0123] If there is at least one response information whose response status is response failure, it can be determined that the response information is unreliable, and the corresponding heterogeneous executor can be cleaned and rebuilt through the negative feedback controller, and an error notification can be fed back to the terminal device to inform the terminal device of an access error.

[0124] If the response status of each response information is a successful response, it is determined whether the response types of each response information are the same. For example, the response type of the response information can be determined based on a large number determination algorithm. If the response type is a large number, the determination result of the determination item is assigned a value of 1, otherwise, the determination result is assigned a value of 0.

[0125] If the response types of the various response messages are the same, the decision result of the decision item is assigned a value of 1, and it is determined whether the response encoding formats of the various response messages are the same. If the response types of the various response messages are different, the decision result of the decision item is assigned a value of 0, and it can be determined that the response information is unreliable, and the corresponding heterogeneous executor can be cleaned and rebuilt through the negative feedback controller, and an error notification is fed back to the terminal device to inform the terminal device of an access error.

[0126] If the response status of each response message is not a successful response, the response type of each response message is the same, and the response encoding format of each response message is the same, then continue to determine whether the corresponding content is the same, and whether the length of the corresponding information is the same. For example, the response message can be preprocessed, such as deleting special characters such as spaces and line breaks. Then, determine whether the response content of each response message is the same, and determine whether the response length of each response message is the same. Optionally, the response length of the response message can also be determined based on a large number determination algorithm. If the response length of the response message is a large number, the determination result of the determination item is assigned to 1, otherwise, the determination result is assigned to 0. Similarly, whether the response content is the same can also be determined by a large number determination algorithm, and a corresponding determination result can be generated.

[0127] On the basis of obtaining the decision results of each decision item, the sum of the decision results of each decision item can be obtained as the decision result of the response information. Determine whether the decision result of the corresponding information is greater than the preset threshold. For example, when the preset threshold is greater than or equal to 4, if the sum of the decision results of each decision item is greater than or equal to 4, it can be determined that the response lengths of each response information are the same, and one of the response information whose response results meet the preset threshold can be selected and fed back to the terminal device. If the decision results of each response information do not meet the requirements of the preset threshold, a 404 status code, for example, can be fed back to the terminal device to notify the terminal device of an access error. At the same time, the corresponding heterogeneous executors can also be cleaned and reconstructed by a negative feedback controller. In this way, not only can it be determined whether the response information is credible from the dimension of the execution degree of the heterogeneous executor, but it can also be determined whether the corresponding information is credible from the dimension of the response information itself, which is beneficial to further improve the security of the mimicry defense system.

[0128] See also Figure 7 As shown, the embodiment of the present application also provides a mimicry defense decision device, including:

[0129] The acquisition module 301 is used to acquire first attribute information of the main execution program of each heterogeneous execution body and second attribute information of the backup execution program of each heterogeneous execution body;

[0130] A verification module 302, configured to determine whether a main execution program and a backup execution program of the heterogeneous execution body have been tampered with based on the first attribute information and the second attribute information, so as to verify the security of the heterogeneous execution body;

[0131] The decision module 303 is used to decide the response information fed back by the plurality of heterogeneous executors based on the verification result to obtain a decision result.

[0132] In some embodiments, the verification module 302 is specifically used to:

[0133] Based on the first attribute information and the second attribute information, performing consistency evaluation on a main execution program and a backup execution program of the heterogeneous execution body;

[0134] When the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, it is determined that the security verification of the heterogeneous execution body has passed.

[0135] In some embodiments, the verification module 302 is specifically used to:

[0136] Determine whether the most recent modification time of each file in the main executable program is the same;

[0137] Determine whether the most recent modification time of each file in the standby execution program is the same;

[0138] Determining whether the number of files of the primary execution program is the same as the number of files of the backup execution program;

[0139] Determine whether the most recent modification time of the file in the primary execution program is the same as the most recent modification time of the file in the standby execution program;

[0140] Accordingly, when the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, determining that the security verification of the heterogeneous execution body has passed includes:

[0141] When the most recent modification time of each file in the main execution program is the same, the most recent modification time of each file in the backup execution program is the same, the most recent modification time of a file in the main execution program and the most recent modification time of a file in the backup execution program are the same, and the number of files in the main execution program and the number of files in the backup execution program are the same, it is determined that the security verification of the heterogeneous execution body has passed.

[0142] In some embodiments, the acquisition module 301 is specifically used for:

[0143] Determine the most recent modification time of each file in the primary execution program, the number of files in the primary execution program, the most recent modification time of each file in the backup execution program, and the number of files in the backup execution program;

[0144] A first identifier is generated based on the most recent modification time of each file in the primary execution program, and a second identifier is generated based on the most recent modification time of each file in the standby execution program; wherein the first identifier is used to identify the consistency of the most recent modification time of each file in the primary execution program, and the second identifier is used to identify the consistency of the most recent modification time of each file in the standby execution program;

[0145] The first attribute information is generated based on the first identifier, the number of files of the main execution program, and the most recent modification time of at least one file in the main execution program, and the second attribute information is generated based on the second identifier, the number of files of the backup execution program, and the most recent modification time of at least one file in the backup execution program.

[0146] In some embodiments, the adjudication module 303 is specifically used to:

[0147] When the verification result indicates that at least one of the heterogeneous executives has not passed the verification, the corresponding heterogeneous executive is cleaned by a negative feedback controller, and an error notification is fed back to the terminal device to inform the terminal device of an access error.

[0148] In some embodiments, the adjudication module 303 is specifically used to:

[0149] When the verification result indicates that each of the heterogeneous executables has passed the verification, obtaining third attribute information of each of the response information;

[0150] Based on the third attribute information, determining whether the plurality of response information are the same;

[0151] If yes, the response information is fed back to the terminal device as target response information;

[0152] If not, an error notification is fed back to the terminal device to inform the terminal device that an access error occurs.

[0153] In some embodiments, the adjudication module 303 is specifically used to:

[0154] Determine, based on the status code of the response information, whether the response status of each of the response information is a successful response;

[0155] Determining whether the response types of the response information are the same;

[0156] Determining whether the response encoding formats of the response information are the same;

[0157] When the response status of each of the response information is a successful response, the response type of each of the response information is the same, and the response encoding format of each of the response information is the same, determining whether the response content of each of the response information is the same, and determining whether the response length of each of the response information is the same;

[0158] When the response contents are the same and / or the response lengths are the same, it is determined that the multiple response information are the same.

[0159] See also Figure 8 As shown, an embodiment of the present application further provides an electronic device, comprising at least a memory 401 and a processor 402, wherein the memory 401 stores a program, and the processor 402 implements the method described in any of the above embodiments when executing the program on the memory 401.

[0160] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions in the computer-readable storage medium are executed, the method described in any of the above embodiments is implemented.

[0161] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, electronic equipment, computer-readable storage media or computer program products. Therefore, the present application may adopt the form of complete hardware embodiments, complete software embodiments or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code. When implemented by software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0162] The processor may be a general purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The general purpose processor may be a microprocessor or any conventional processor.

[0163] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0164] The above-mentioned readable storage medium can be a disk, an optical disk, a DVD, a USB, a read-only memory (ROM) or a random access memory (RAM), etc. This application does not limit the specific form of the storage medium.

[0165] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A mimicry defense decision method, characterized in that: include: Acquire first attribute information of a main execution program of each heterogeneous execution body, and second attribute information of a backup execution program of each heterogeneous execution body; Based on the first attribute information and the second attribute information, determining whether a main execution program and a backup execution program of the heterogeneous execution body have been tampered with, so as to verify the security of the heterogeneous execution body; Based on the verification result, adjudicating the response information fed back by the plurality of heterogeneous executors to obtain a adjudication result; The step of obtaining the first attribute information of the main execution program of each heterogeneous execution body and the second attribute information of the backup execution program of each heterogeneous execution body includes: Determine the most recent modification time of each file in the primary execution program, the number of files in the primary execution program, the most recent modification time of each file in the backup execution program, and the number of files in the backup execution program; A first identifier is generated based on the most recent modification time of each file in the primary execution program, and a second identifier is generated based on the most recent modification time of each file in the standby execution program; wherein the first identifier is used to identify the consistency of the most recent modification time of each file in the primary execution program, and the second identifier is used to identify the consistency of the most recent modification time of each file in the standby execution program; The first attribute information is generated based on the first identifier, the number of files of the main execution program, and the most recent modification time of at least one file in the main execution program, and the second attribute information is generated based on the second identifier, the number of files of the backup execution program, and the most recent modification time of at least one file in the backup execution program.

2. The method according to claim 1, characterized in that Determining whether a main execution program and a backup execution program of the heterogeneous execution body are tampered with based on the first attribute information and the second attribute information to verify the security of the heterogeneous execution body includes: Based on the first attribute information and the second attribute information, performing consistency evaluation on a main execution program and a backup execution program of the heterogeneous execution body; When the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, it is determined that the security verification of the heterogeneous execution body has passed.

3. The method according to claim 2, characterized in that Based on the first attribute information and the second attribute information, a consistency evaluation is performed on a main execution program and a backup execution program of the heterogeneous execution body, including: Determine whether the most recent modification time of each file in the main executable program is the same; Determine whether the most recent modification time of each file in the standby execution program is the same; Determining whether the number of files of the primary execution program is the same as the number of files of the backup execution program; Determine whether the most recent modification time of the file in the primary execution program is the same as the most recent modification time of the file in the standby execution program; Accordingly, when the evaluation result indicates that the main execution program and the backup execution program of the heterogeneous execution body are consistent, determining that the security verification of the heterogeneous execution body has passed includes: When the most recent modification time of each file in the main execution program is the same, the most recent modification time of each file in the backup execution program is the same, the most recent modification time of a file in the main execution program and the most recent modification time of a file in the backup execution program are the same, and the number of files in the main execution program and the number of files in the backup execution program are the same, it is determined that the security verification of the heterogeneous execution body has passed.

4. The method according to claim 1, characterized in that Based on the verification result, the response information fed back by the plurality of heterogeneous executors is judged to obtain a judgment result, including: When the verification result indicates that at least one of the heterogeneous executives has not passed the verification, the corresponding heterogeneous executive is cleaned by a negative feedback controller, and an error notification is fed back to the terminal device to inform the terminal device of an access error.

5. The method according to claim 4, characterized in that Based on the verification result, adjudicating the response information fed back by the plurality of heterogeneous executors to obtain a adjudication result, further comprising: When the verification result indicates that each of the heterogeneous executables has passed the verification, obtaining third attribute information of each of the response information; Based on the third attribute information, determining whether the plurality of response information are the same; If yes, the response information is fed back to the terminal device as target response information; If not, an error notification is fed back to the terminal device to inform the terminal device that an access error occurs.

6. The method according to claim 5, characterized in that Determining whether the plurality of response information are the same based on the third attribute information includes: Determine, based on the status code of the response information, whether the response status of each of the response information is a successful response; Determining whether the response types of the response information are the same; Determining whether the response encoding formats of the response information are the same; When the response status of each of the response information is a successful response, the response type of each of the response information is the same, and the response encoding format of each of the response information is the same, determining whether the response content of each of the response information is the same, and determining whether the response length of each of the response information is the same; When the response contents are the same and / or the response lengths are the same, it is determined that the multiple response information are the same.

7. A mimicry defense decision device, characterized in that: include: An acquisition module, used to acquire first attribute information of a main execution program of each heterogeneous execution body, and second attribute information of a backup execution program of each heterogeneous execution body; Determine the most recent modification time of each file in the primary execution program, the number of files in the primary execution program, the most recent modification time of each file in the backup execution program, and the number of files in the backup execution program; A first identifier is generated based on the most recent modification time of each file in the primary execution program, and a second identifier is generated based on the most recent modification time of each file in the standby execution program; wherein the first identifier is used to identify the consistency of the most recent modification time of each file in the primary execution program, and the second identifier is used to identify the consistency of the most recent modification time of each file in the standby execution program; generating the first attribute information based on the first identifier, the number of files of the primary executable program, and the most recent modification time of at least one file in the primary executable program, and generating the second attribute information based on the second identifier, the number of files of the backup executable program, and the most recent modification time of at least one file in the backup executable program; a verification module, configured to determine whether a main execution program and a backup execution program of the heterogeneous execution body have been tampered with based on the first attribute information and the second attribute information, so as to verify the security of the heterogeneous execution body; The decision module is used to decide the response information fed back by the plurality of heterogeneous executors based on the verification result to obtain a decision result.

8. An electronic device comprising at least a memory and a processor, wherein a program is stored in the memory, wherein: The processor implements the method according to any one of claims 1 to 7 when executing the program on the memory.

9. A computer-readable storage medium storing computer-executable instructions, characterized in that: When the computer executable instructions in the computer readable storage medium are executed, the method of any one of claims 1 to 7 is implemented.

Images