A method, device, storage medium and electronic device for preventing mimicry escape

Abstract

Some embodiments of the present application provide a method, device, storage medium and electronic device for defending against mimicry escape, the method comprising: obtaining a target executable set that serves a request of a network system, wherein the target executable set includes multiple executable groups; using each executable group in the target executable set to respond to the request of the network system and obtain a response result, wherein each executable group responds to different requests, and the response result characterizes whether the network system has an abnormal phenomenon of mimicry escape. Some embodiments of the present application can reduce the probability of escape and effectively ensure the security of the network system.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a method, device, storage medium and electronic device for defending against mimicry escape. Background Art

[0002] Cyber ​​Mimic Defense (CMD) is a set of cyberspace intrinsic security defense architecture that can defend against unknown vulnerability threats. The core framework of CMD is Dynamic Heterogeneous Redundancy (DHR). Its core implementation is a dynamic heterogeneous redundant structure based on the intrinsic security mechanism of cyberspace, which provides defense theories and methods with universal and innovative significance to deal with unknown threats such as unknown vulnerabilities, backdoors or viruses and Trojans in cyberspace.

[0003] At present, mimicry technology usually launches three service executors and one or more executors to be launched. Although in theory, the more service executors are launched, the better the defense against unknown threats, the consumption of hardware resources of the device increases, making the service executor's response time to requests longer. In addition, during the service process, there is a possibility that the service executor may be consistent on the heterogeneous layer, so that attackers can use the attack point on the heterogeneous layer to obtain consistent output. Therefore, it is difficult for the mimicry defense mechanism to prevent such escape phenomena from occurring.

[0004] Therefore, how to provide an efficient technical solution for the method of defending against mimicry escape has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a method, device, storage medium and electronic device for defending against mimicry escape. The technical solutions of the embodiments of the present application can reduce the probability of mimicry escape and ensure the security of the network system.

[0006] In a first aspect, some embodiments of the present application provide a method for defending against mimicry escape, comprising: obtaining a target execution body set that serves requests of a network system, wherein the target execution body set includes multiple execution body groups; using each execution body group in the target execution body set to respond to the request of the network system, and obtaining a response result, wherein each execution body group responds to different requests, and the response result characterizes whether there is an abnormal phenomenon of mimicry escape in the network system.

[0007] Some embodiments of the present application poll multiple execution groups in the target execution set to respond to requests from the network system and obtain response results. This embodiment can increase the number of execution bodies that serve the request, but does not increase the response time, thereby effectively reducing the probability of the occurrence of the mimic escape phenomenon. The polling processing of the request by each execution group also prevents continuous escape, which provides better security protection for the network system.

[0008] In some embodiments, the network system includes at least three heterogeneous layers, wherein obtaining a target set of executable bodies that serve requests to the network system includes: obtaining partial executable bodies that intersect between the heterogeneous layers in the heterogeneous layers, wherein the partial executable bodies include at least four executable bodies; and combining any three executable bodies among the partial executable bodies to obtain the multiple executable body groups in the target set of executable bodies.

[0009] Some embodiments of the present application construct an execution body group in a target execution body set by constructing partial execution bodies that intersect between heterogeneous layers, so as to obtain multiple execution body groups containing different heterogeneous layers. The probability of the occurrence of the mimic escape phenomenon can be reduced through multiple execution body groups.

[0010] In some embodiments, obtaining a target set of executable bodies for servicing requests to a network system includes: dividing the executable bodies in the heterogeneous layer into intersecting executable bodies, intersecting groups, and non-intersecting groups; combining the executable bodies in the intersecting groups and the non-intersecting groups with the intersecting executable bodies, respectively, to obtain a plurality of executable body sets; and selecting any one executable body group from the plurality of executable body sets as the target executable body set.

[0011] Some embodiments of the present application pre-construct multiple execution body sets through the relationship between heterogeneous layers, and then select the target execution body set from them, so as to achieve as many construction execution body groups as possible, thereby reducing the probability of mimicry escape phenomenon and effectively suppressing continuous attacks.

[0012] In some embodiments, the dividing of the executables in the heterogeneous layers into intersecting executables, intersecting groups and non-intersecting groups includes: taking the same executables contained in the heterogeneous layers as the intersecting executables; constructing the intersecting groups with the executables that intersect between the heterogeneous layers in the heterogeneous layers, wherein the intersecting executables are not included in the intersecting groups; and constructing the non-intersecting groups with the executables in the heterogeneous layers except the intersecting groups and the intersecting executables.

[0013] Some embodiments of the present application can provide data support for the subsequent construction of as many execution body groups as possible by acquiring intersecting execution bodies, intersecting groups, and non-intersecting groups.

[0014] In some embodiments, the intersecting group and the non-intersecting group include at least three executors, and each executor set in the multiple executor sets includes at least four executor groups, and each executor group contains three executors, wherein the executors in the intersecting group and the non-intersecting group are respectively combined with the intersecting executors to obtain multiple executor sets, including: combining any three executors in the intersecting group with the intersecting executors to obtain any one of the multiple executor sets; combining any three executors in the non-intersecting group with the intersecting executors to obtain any one of the multiple executor sets.

[0015] Some embodiments of the present application can obtain any one of multiple sets of executable bodies by combining any three executable bodies in intersecting groups or non-intersecting groups with intersecting executable bodies in a group of three to obtain a combination of different executable bodies, thereby obtaining multiple sets of executable bodies.

[0016] In some embodiments, the method of utilizing each execution body group in the target execution body set to respond to the request of the network system and obtain a response result includes: if there are at least two execution bodies in each execution body group that return the same result of the request to the network system, confirming that the response result is normal; if the execution bodies in each execution body group return different results of the request to the network system, confirming that the response result is abnormal.

[0017] In some embodiments, the method of utilizing each execution body group in the target execution body set to respond to the request of the network system and obtain a response result includes: if the return results of all execution bodies in each execution body group to the request of the network system are the same, then confirming that the response result is normal; if the return results of all execution bodies in each execution body group to the request of the network system are not exactly the same, then confirming that the response result is abnormal.

[0018] Some embodiments of the present application can efficiently determine whether a request is abnormal by determining whether the return results of each execution body group for the request are the same.

[0019] In some embodiments, after obtaining the response result, the method further includes: determining whether to replace the target execution body set based on the response result; or determining whether to replace the target execution body set based on the service time and scheduling cycle time of the target execution body set.

[0020] Some embodiments of the present application determine whether to schedule a target execution body set through response results and service time, which can effectively suppress continuous attacks and achieve the purpose of minimizing attack escape.

[0021] In some embodiments, determining whether to replace the target execution body set based on the response result includes: when it is confirmed that the response result is abnormal, or the service time reaches the scheduling cycle time, obtaining another execution body set and replacing the target execution body set with the another execution body set; using the execution body group in the another execution body set to continue polling and responding to the request of the network system to obtain the response result.

[0022] Some embodiments of the present application can reduce the probability of mimicry escape and achieve better defense against mimicry escape by replacing the target execution body set with another execution body set when the response result is abnormal, so that it continues to serve the request.

[0023] In some embodiments, the acquiring another executable set includes: taking a set of the multiple executable sets other than the target executable set as the another executable set.

[0024] Some embodiments of the present application directly select another set of executable bodies from multiple sets of executable bodies, which makes the acquisition method more convenient.

[0025] In some embodiments, obtaining another set of execution bodies includes: obtaining the remaining execution bodies in the heterogeneous layer except for the partial execution bodies, the remaining execution bodies including at least three execution bodies; combining the remaining execution bodies with any three of the intersecting execution bodies to obtain multiple execution body groups in the other set of execution bodies.

[0026] Some embodiments of the present application can also quickly obtain another set of executable bodies by combining the remaining executable bodies and the intersecting executable bodies in groups of three.

[0027] In a second aspect, some embodiments of the present application provide a device for defending against mimicry escape, comprising: an acquisition module, configured to acquire a set of target execution bodies that serve requests of a network system, wherein the target execution body set includes multiple execution body groups; a response module, configured to respond to requests of the network system using each execution body group in the target execution body set, and acquire a response result, wherein each execution body group responds to different requests, and the response result characterizes whether there is an abnormal phenomenon of mimicry escape in the network system.

[0028] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0029] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement a method as described in any embodiment of the first aspect when executing the program.

[0030] In a fifth aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 A system diagram for defending against mimicry escape provided for some embodiments of the present application;

[0033] Figure 2 A flow chart of a method for defending against mimicry escape provided in some embodiments of the present application;

[0034] Figure 3 One of the schematic diagrams of heterogeneous layer composition provided for some embodiments of the present application;

[0035] Figure 4 A second schematic diagram of heterogeneous layer composition provided for some embodiments of the present application;

[0036] Figure 5 A block diagram of a device for defending against mimicry escape provided in some embodiments of the present application;

[0037] Figure 6 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0038] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0039] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0040] First, some terms involved in some embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0041] Cyber ​​Mimic Defense (CMD) is a set of cyberspace intrinsic security defense architecture that can defend against unknown vulnerability threats. The core framework of CMD is Dynamic Heterogeneous Redundancy (DHR). Its core implementation is a dynamic heterogeneous redundant structure based on the intrinsic security mechanism of cyberspace, which provides defense theories and methods with universal and innovative significance to deal with unknown threats based on unknown vulnerabilities, backdoors or viruses and Trojans in cyberspace.

[0042] Heterogeneous executive (collection): physical functional units such as hardware and software structures, components, and devices in an information system, such as different types of operating systems, software components, and programming languages.

[0043] Heterogeneous layer: The layer where different heterogeneous executors have different compositions, such as the system layer and component layer.

[0044] Heterogeneous units: The same heterogeneous layer can show different units, such as Windows and Linux in the system layer.

[0045] Executor group: a set of heterogeneous executors that are not completely identical on the heterogeneous layers and a group of all such executors used in a loop response.

[0046] Adjudication: The process of making (majority) consistency judgments on the results of multiple executors and outputting the results.

[0047] Executor cleaning: Restoring the executable to its initial state can block unknown attacks from intruding into the serving executable, such as re-reading static configuration files to prevent parameters in memory from being tampered with.

[0048] Mimic escape (also known as escape phenomenon): The service executor outputs consistent erroneous results due to some unknown vulnerabilities, backdoors, viruses, Trojans and other threats, causing the arbitration mechanism to ignore the response and allow the attack to succeed.

[0049] Sustained escape: Escape phenomenon that does not stop for a long time.

[0050] The three core elements of dynamic heterogeneous redundant construction are:

[0051] Dynamic: Dynamic scheduling of heterogeneous executors ensures that the carriers that respond to requests at different times are no longer completely fixed. For attackers, uncertain attack targets will greatly hinder the attack.

[0052] Heterogeneity: Multiple heterogeneous executables are used as carriers to respond to requests. It is almost impossible for them to have the same response to unknown vulnerabilities, backdoors, viruses, Trojans, etc. With the mimicry adjudication mechanism, even if the attacker has mastered the attack method of a certain executable, the attack will still be blocked due to the inconsistent results of the other executables.

[0053] Redundancy: Multiple heterogeneous executors are the cornerstone of mimicry defense. When a service executor is no longer trustworthy, there are still other executors waiting for service that can be replaced, ensuring the continuity of business.

[0054] In the related technology, the current implementation of mimicry technology is mostly composed of three online service executors and one or more executors to be online. In theory, the more executors there are for online services, the better the defense against unknown threats. However, relatively speaking, the more executors there are, the greater the consumption of hardware resources by the device, and the longer the response time to the request (because it is necessary to wait for all service executors to execute the results before starting the judgment). Moreover, in the process of executor service, since the service executors may appear consistent on the heterogeneous layer, the attacker can use the attack point on the heterogeneous layer to obtain consistent output, and the mimicry defense mechanism is difficult to prevent such escape from occurring.

[0055] In response to the above problems, the prior art changes the number of online service executors from three to four, but this significantly increases the request response time to the network. Moreover, since the executor itself may have unknown vulnerabilities, backdoors, viruses, Trojans and other threats, it cannot be considered completely trustworthy. Another prior art uses a method of cleaning the executor to verify the majority of consistent results again. If the results are consistent, it is judged that there is no escape phenomenon; otherwise, it is judged that there is an escape phenomenon. However, this method only judges the escape phenomenon for the majority of consistent situations, and cannot judge the escape phenomenon for all consistent situations. The process of cleaning inconsistent executors and then going online to judge the consistency results will increase the response time.

[0056] In view of this, some embodiments of the present application provide a method for defending against mimicry escape, which constructs multiple executive groups in the target executive set so that the executives in each executive group are not completely consistent on each heterogeneous surface, thereby reducing the probability of escape transmission. In addition, the present application also adds a service executive group that responds to requests, but each executive group still maintains three executives, which does not increase the response time to the request.

[0057] The following is an illustrative introduction to a system structure for defending against mimicry escape provided by some embodiments of the present application.

[0058] like Figure 1 As shown, some embodiments of the present application provide a system for defending against mimicry escape, which includes a user 100 and a network security device 200 (as a specific example of a network system). Among them, the user 100 can obtain a target executable set by designing its heterogeneous layer and the executable body of the heterogeneous layer on the network security device 200, so that the executable body group in the target executable body set can respond to the request of the network security device 200 and obtain the response result.

[0059] In some embodiments of the present application, the network security device 200 may be a firewall, an industrial gateway, a website application-level intrusion prevention system (WAF), etc. The present application is not limited thereto.

[0060] The following is combined with Figure 2 An implementation process of defending against mimicry escape provided by some embodiments of the present application is exemplified.

[0061] Please see attached Figure 2 , Figure 2 A flow chart of a method for defending against mimicry escape provided in some embodiments of the present application, the method comprising:

[0062] S210, obtaining a target executable set for servicing a request of a network system, wherein the target executable set includes a plurality of executable groups.

[0063] In some embodiments of the present application, the network system includes at least three heterogeneous layers, wherein S210 may include: obtaining partial execution bodies that intersect between the heterogeneous layers in the heterogeneous layers, wherein the partial execution bodies include at least four execution bodies; combining any three execution bodies in the partial execution bodies to obtain the multiple execution body groups in the target execution body set.

[0064] For example, as a specific example of the present application, it is first necessary to distinguish the heterogeneous layers in the network security device 200. Figure 3 As shown in the figure, the three circles represent three heterogeneous layers, for example, the system layer, the component layer, and the programming language layer, and each layer has two heterogeneous units. A to g in the circle are executors, a total of 7. Figure 3The upper circle in the figure is the system layer, which is defined as System 1, and other executables (i.e., executables that do not completely belong to the system layer) are System 2; the component layer in the lower left circle is defined as Component 1, and other executables (i.e., executables that do not completely belong to the component layer) are Component 2; the programming language layer in the lower right circle is defined as Language 1, and other executables (i.e., executables that do not completely belong to the programming language layer) are Language 2. The specific structure of the heterogeneous executables in each executable group in Table 1 can be obtained:

[0065] Table 1

[0066] Executable Composition (system-components-programming language) a 1-2-2 b 1-1-2 c 1-1-1 / 2-2-2 d 1-2-1 e 2-1-2 f 2-1-1 g 2-2-1

[0067] Afterwards Figure 3 It can be seen that the intersecting executables between the three heterogeneous layers of the system layer, component layer and programming language layer are b, c, d and f. Grouping b, c, d and f into three groups, we get four executable groups: bcd, bcf, cdf and bdf, and the target executable set is {bcd, bcf, cdf, bdf}. It can be found that the executables in the four executable groups are not completely consistent on each heterogeneous layer, so this combination can achieve the effect of reducing the probability of escape.

[0068] For example, as another specific example of this application, Figure 4 As shown, the network security device 200 includes four heterogeneous layers: Figure 4 The rectangles ACKI, BDLJ, EGOM, and FHPN in the figure represent four heterogeneous layers, each of which has an intersection and intersects at the rectangle FGKJ. Figure 4 There are 9 executables from a to i, among which the intersecting executables are b, d, e, f, and h. Assuming that the first heterogeneous layer rectangle ACKI represents the heterogeneity at the system level, all the executables in the rectangle should be system 1 in the heterogeneous unit of the heterogeneous layer, and the remaining executables should be system 2, and so on. For details, please refer to the above Figure 3 The embodiments of the present application are not described in detail here. Specifically, if the executable e is not considered, b, d, f, and h can be grouped into three to obtain a target executable set {bdf, bdh, bfh, dfh}. If e is considered, b, d, e, f, and h can be grouped into three to obtain multiple executable groups. It should be noted that e needs to be determined based on the design cost and development cost to determine whether to add it to the process of building the executable group, and the specific situation can be analyzed specifically.

[0069] However, when e is considered, the components of e need to be replaced regularly. Figure 4It can be seen that each rectangle representing a heterogeneous layer contains three intersecting executables. The executable e inside only needs to select the second heterogeneous unit on the heterogeneous layer, and the remaining heterogeneous layers all select heterogeneous unit 1, and so on. Assuming that the rectangle ACKI represents the system layer, the executable inside the rectangle should select the Windows system, and the executable outside the rectangle should select the Linux system. However, in order to ensure that the three intersecting executables in the executable groups b, d, and e are not completely consistent at the system layer, the executables b and d are Windows systems, and the executable e should become the Linux system. Finally, the heterogeneous layers in each executable group are not completely consistent.

[0070] In some other embodiments of the present application, S210 may also include: S211, dividing the executors in the heterogeneous layer into intersecting executors, intersecting groups and non-intersecting groups; S212, combining the executors in the intersecting groups and the non-intersecting groups with the intersecting executors respectively to obtain multiple executor sets; S213, selecting any executor group from the multiple executor sets as the target executor set.

[0071] For example, in some other embodiments of the present application, multiple executable body sets may be designed first, and then any one of the multiple executable body sets may be used as a target executable body set.

[0072] In other embodiments of the present application, S211 may also include: taking the same execution body contained in the heterogeneous layers as the intersecting execution body; constructing the intersection group with the execution bodies that intersect between the heterogeneous layers in the heterogeneous layers, wherein the intersection group does not include the intersection execution body; and constructing the non-intersecting group with the execution bodies in the heterogeneous layers except the intersection group and the intersection execution body.

[0073] For example, as a specific example of this application, Figure 3 It can be seen that the executable body that intersects the system layer, component layer, and programming language layer is c, which is the intersecting executable body. The intersecting groups of the system layer, component layer, and programming language layer that intersect each other are b, d, and f. The non-intersecting groups are a, e, and g.

[0074] For example, as another specific example of the present application, Figure 4 It can be seen that the intersecting executors of the four heterogeneous layers are e, the intersecting groups are b, d, f, and h, and the non-intersecting groups are a, c, g, and i.

[0075] In some other embodiments of the present application, the intersecting group and the non-intersecting group include at least three executors, each executor set in the multiple executor sets includes at least four executor groups, and each executor group contains three executors, wherein S212 may also include: combining any three executors in the intersecting group with the intersecting executor to obtain any one of the multiple executor sets; combining any three executors in the non-intersecting group with the intersecting executor to obtain any one of the multiple executor sets.

[0076] For example, as a specific example of the present application, the intersection groups b, d and f are combined with c to obtain an executable set {bcd, bcf, cdf, bdf}, and the non-intersection groups a, e and g are combined with c to obtain an executable set {acg, ace, ecg, aeg}. The target executable set can be {bcd, bcf, cdf, bdf} or {acg, ace, ecg, aeg}.

[0077] For example, as another specific example of the present application, Figure 4 It can be seen that in the case of more than three heterogeneous layers, whether to consider the intersecting executor e can be confirmed according to the actual situation. If the executor e is considered, b, d, f, h, and e can be grouped into three to obtain a set in multiple executor sets. Or a, c, g, i, and e can be grouped into three to obtain a set in multiple executor sets. Alternatively, without considering the executor e, b, d, f, and h of the intersecting group can be directly grouped into three to obtain a set in multiple executor sets. The non-intersecting groups are grouped into a, c, g, and i into three to obtain a set in multiple executor sets. Each executor group in the present application is still composed of three executors, but the number of executor groups in an executor set is inconsistent.

[0078] It is understandable that some embodiments of the present application still use only three execution bodies each time when responding to a request, which does not affect the response time to the request. The increase in the number of execution body groups can poll and respond to multiple requests, achieving effective defense against the mimic escape phenomenon and reducing the probability of the mimic escape phenomenon.

[0079] It should be noted that the method for obtaining the target executable set may vary according to the number of heterogeneous layers, but the principle is similar to the above embodiment. For the sake of simplicity, this application only describes the case where there are three and four heterogeneous layers. However, this application is not limited thereto.

[0080] S220, using each executable body group in the target executable body set to respond to the request of the network system, and obtaining a response result, wherein each executable body group responds to different requests, and the response result indicates whether there is an abnormal phenomenon of mimicry escape in the network system.

[0081] For example, in some embodiments of the present application, each executive group in the target executive set performs polling response to requests in the network security device 200, that is, each executive group serves different requests.

[0082] For example, as a specific example of the present application, the target execution body set is {bcd, bcf, cdf, bdf}, and the network security device 200 receives six requests in succession, then the first request can be assigned to the bcd response, the second request to the bcf response, the third request to the cdf response, the fourth request to the bdf response, the fifth request to the bcd response, and the sixth request to the bcf response. If the network security device 200 receives six requests at the same time, the six requests can be assigned to the corresponding execution body groups in the order of polling. In practical applications, if the mimic escape problem occurs on a certain execution body (for example, on execution body b), it can also be guaranteed that in the four requests, there is one request that the execution body of the problem does not participate (for example, the execution body group cdf does not participate), so the continuous attack can be suppressed to a certain extent. Since three execution bodies are still used for each response, there is no increase in response time compared to the existing solution.

[0083] In some embodiments of the present application, S220 may include: if there are at least two executors in each executor group that have the same return result for the request to the network system, then confirming that the response result is normal; if the return results of the executors in each executor group for the request to the network system are all different, then confirming that the response result is abnormal. The arbitration module of the network security device 200 can use a variety of methods to confirm whether the response result is abnormal. For example, in some embodiments of the present application, a completely consistent judgment is adopted. When the return results of the three executors in each executor group for a request are consistent, a consistent result is output. Otherwise, the response result is confirmed to be abnormal and the request is intercepted.

[0084] In other embodiments of the present application, S220 may include: if the return results of the requests of all executors in each executor group to the network system are the same, confirming that the response result is normal; if the return results of the requests of all executors in each executor group to the network system are not exactly the same, confirming that the response result is abnormal.

[0085] In other embodiments of the present application, majority consensus judgment can be adopted. When at least two executors in each executor group return consistent results for a request, consistent results are output; otherwise, the response result is confirmed to be abnormal and the request is intercepted.

[0086] In some embodiments of the present application, after executing S220, the method for defending against mimicry escape also includes (not shown in the figure): S230, determining whether to replace the target execution body set based on the response result; or, determining whether to replace the target execution body set based on the service time and scheduling cycle time of the target execution body set.

[0087] In some embodiments of the present application, S230 may include: when it is confirmed that the response result is abnormal, or the service time reaches the scheduling cycle time, obtaining another set of execution bodies, and replacing the target set of execution bodies with the other set of execution bodies; using the execution body group in the other set of execution bodies to continue polling and responding to the request of the network system to obtain the response result.

[0088] For example, in some embodiments of the present application, when the response result is abnormal or dynamic scheduling is required (that is, the service time reaches the scheduling cycle time, for example, the scheduling cycle time is 2 hours, and dynamic scheduling is required when the service time reaches 2 hours), the current target execution body set can be offline after another execution body set is ready, and another execution body set can be online, and each execution body group in another execution body set can be used to continue to poll and respond to the request of the network security device 200. The specific polling method can refer to the method of each execution body group in the above-mentioned target execution body set. For the sake of brevity, this application will not elaborate on it here.

[0089] In some embodiments of the present application, S230 may include: taking a set of the multiple executable sets except the target executable set as the other executable set.

[0090] For example, as a specific example of this application, Figure 3 The obtained multiple executable combinations include: {bcd, bcf, cdf, bdf} or {acg, ace, ecg, aeg}. If the target executable set is {bcd, bcf, cdf, bdf}, then the other executable set is {acg, ace, ecg, aeg}. If the target executable set is {acg, ace, ecg, aeg}, then the other executable set is {bcd, bcf, cdf, bdf}. It can be understood that Figure 4 Methods for obtaining another set of executables and Figure 3 Similarly, it is only necessary to select one of the multiple executable sets except the target executable set, which is not elaborated in this application.

[0091] In some embodiments of the present application, S230 may include: obtaining the remaining executable bodies in the heterogeneous layer except the partial executable bodies, the remaining executable bodies including at least three executable bodies; combining the remaining executable bodies with any three of the intersecting executable bodies to obtain the other set of executable bodies.

[0092] For example, as a specific example of this application, Figure 3 The remaining executable bodies except the intersecting executable bodies are a, e, and g. The executable bodies a, e, g, and c can be combined in groups of three to obtain multiple executable body groups in another executable body combination, that is, {acg, ace, ecg, aeg}.

[0093] For example, as another specific example of this application, Figure 4 The method for obtaining another set of executable bodies needs to be distinguished according to the executable body e. Without considering e, a, c, g, and i can be grouped into three to obtain multiple executable body groups in another executable body combination. Other sets of executable bodies can also be obtained by considering the case of executable body e. The more heterogeneous layers there are, the more executable body sets can be selected, and the specific ones can be selected according to the actual situation. Since there are more executable body groups to choose from, scheduling can also schedule multiple executable body groups according to the heterogeneous situation. This application is not specifically limited here.

[0094] Some embodiments of the present application can be used for mimicry execution body business processing, and the probability of escape phenomenon can be reduced as much as possible and continuous escape can be prevented as much as possible without increasing the response time of the original technology. The following takes 3 heterogeneous layers and 2 heterogeneous units as an example to illustrate the process of defending against mimicry escape by using any set of execution bodies as the target execution body.

[0095] First, assume that the three heterogeneous layers are system, component, and programming language. The heterogeneous units of the system layer are CentOS and Debian; the heterogeneous units of the component layer are Apache and IIS; and the heterogeneous units of the programming language layer are Java and Python.

[0096] Secondly, according to the above Figure 2 The embodiment can obtain two sets of executive bodies {bcd, bcf, cdf, bdf} and {acg, ace, ceg, aeg}. The specific composition structure of the heterogeneous executive bodies of each executive body group is shown in Table 2:

[0097] Table 2

[0098] Executable Composition (system-components-programming language) a CentOS - IIS - Python b CentOS - Apache - Python c CentOS-Apache-Java / Debian-IIS-Python d CentOS - IIS - Java e Debian - Apache - Python f Debian - Apache - Java g Debian - IIS - Java

[0099] Finally, the principles of defending against mimicry escape in some embodiments of the present application are explained using the following situations.

[0100] 1) Assume that there is an unknown vulnerability in the Apache component. An attacker can use this vulnerability to tamper with the component information of Apache. When any of the above two execution groups is responding to the service, a 2:1 request result will always be obtained. Regardless of whether it is the result obtained by 2 votes through the vulnerability or the result of 2 votes of normal response, the adjudication module will obtain inconsistent results.

[0101] Among them, the 2:1 request result is valid in any execution group, because the component layer in the execution body is either Apache or IIS. However, the three execution bodies selected in this application must not be completely consistent in each heterogeneous layer. Therefore, the distribution of its component layer must be Apache:IIS=1:2 or 2:1, and the response result must also be 2:1 (there is no subjective right or wrong in the output result of the execution body, only consistency or inconsistency).

[0102] 2) For the situation in 1), when the decision module adopts a completely consistent judgment (i.e., if the three execution bodies return the same result, the result is output, otherwise it is intercepted), when the returned results are all inconsistent, or only two are consistent, the request will be intercepted regardless of when it comes. When the decision module adopts a majority consistent judgment (i.e., if two execution bodies return the same result and the other is inconsistent, the result is output, otherwise it is intercepted), the request will be intercepted when both execution body components in the response execution body are IIS. This reduces the probability of escape.

[0103] 3) According to the description in 2), the attacker exploits the Apache vulnerability to tamper with the information. When the arbitration module chooses the majority consensus judgment, and two of the responding executables happen to use Apache, the Apache information may be tampered with. The tampered Apache response result will be even more unconventional, and it is easy for the arbitration module to intercept after multiple request responses. When an interception problem occurs or the periodic scheduling time (that is, the scheduling cycle time) is reached, the scheduling module will perform operations such as executable cleaning, online and offline operations on the current target executable set in accordance with the above embodiment. At this time, the Apache of the online executable will be in a normal state (that is, the state of restoring factory settings), which can prevent continuous escape.

[0104] 4) Assume that there is an unknown vulnerability in the combination of Apache and the programming language Python. An attacker can tamper with the component information of Apache through this vulnerability. In Table 2, only executable b and executable e exist. Since executable b and executable e are in two executable groups respectively, even if the arbitration module uses the majority consensus arbitration method, it will not let go of the request through this vulnerability, because at most only one executable responds to the vulnerable request.

[0105] 5) Based on the example in 2), it can be inferred that any vulnerability generated by combining two heterogeneous layers cannot pass the adjudication because there are only two executables that meet the conditions. More importantly, the two executables are in two executable groups and will not respond to each other in the same request. This reduces the probability of escape.

[0106] 6) Assuming that there is an unknown vulnerability in the combination of the system CentOS, the component Apache and the programming language Python, only one executable body meets the conditions, but the error result of one executable body cannot be determined by complete consensus and majority consensus, so the probability of escape can also be reduced here.

[0107] Through some of the embodiments of the present application described above, it can be known that the present application can reduce the probability of escape phenomenon; can prevent continuous escape; and, without increasing the response time, supplement a safer execution method based on the existing technology. By defining heterogeneous layers and combining heterogeneous units of each layer, heterogeneous execution bodies are obtained, and then the execution bodies are selected through a specific selection method to form an execution body group, and the execution body groups are combined into an execution body set, the probability of escape phenomenon that may be judged by the execution body group is reduced. By scheduling the execution body and changing the execution body combination of each response, the probability of continuous escape phenomenon can be reduced.

[0108] Please refer to Figure 5 , Figure 5 The following is a block diagram of the components of the device for defending against mimicry escape provided by some embodiments of the present application. It should be understood that the device for defending against mimicry escape corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for defending against mimicry escape can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0109] Figure 5 The device for defending against mimicry escape includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for defending against mimicry escape, and the device for defending against mimicry escape includes: an acquisition module 510, configured to obtain a target execution body set that serves a request of a network system, wherein the target execution body set includes multiple execution body groups; a response module 520, configured to use each execution body group in the target execution body set to respond to the request of the network system and obtain a response result, wherein each execution body group responds to different requests, and the response result indicates whether there is an abnormal phenomenon of mimicry escape in the network system.

[0110] In some embodiments of the present application, the network system includes at least three heterogeneous layers, wherein the acquisition module 510 is configured to: obtain partial execution bodies that intersect between the heterogeneous layers in the heterogeneous layers, wherein the partial execution bodies include at least four execution bodies; and combine any three execution bodies in the partial execution bodies to obtain the target execution body set.

[0111] In some embodiments of the present application, the acquisition module 510 is configured to: divide the execution bodies in the heterogeneous layer into intersecting execution bodies, intersecting groups and non-intersecting groups; combine the execution bodies in the intersecting groups and the non-intersecting groups with the intersecting execution bodies respectively to obtain multiple execution body sets; and select any one execution body group from the multiple execution body sets as the target execution body set.

[0112] In some embodiments of the present application, the acquisition module 510 is configured to divide the execution bodies in the heterogeneous layers into intersecting execution bodies, intersecting groups and non-intersecting groups, including: taking the same execution body contained in the heterogeneous layers as the intersecting execution body; constructing the intersecting group with the execution bodies that intersect between the heterogeneous layers in the heterogeneous layers, wherein the intersecting execution body is not included in the intersecting group; and constructing the non-intersecting group with the execution bodies in the heterogeneous layers except the intersecting group and the intersecting execution body.

[0113] In some embodiments of the present application, the intersecting group and the non-intersecting group include at least three execution bodies, wherein the acquisition module 510 is configured to: combine any three execution bodies in the intersecting group with the intersecting execution body to obtain any one of the multiple execution body sets; combine any three execution bodies in the non-intersecting group with the intersecting execution body to obtain any one of the multiple execution body sets.

[0114] In some embodiments of the present application, the response module 520 is configured as follows: if there are at least two executors in each executor group that return the same result for the request to the network system, then confirm that the response result is normal; if the executors in each executor group return different results for the request to the network system, then confirm that the response result is abnormal.

[0115] In other embodiments of the present application, the response module 520 is configured to: if the return results of the requests of all the executors in each executor group to the network system are the same, then confirm that the response result is normal; if the return results of the requests of all the executors in each executor group to the network system are not exactly the same, then confirm that the response result is abnormal.

[0116] In some embodiments of the present application, after the response module 520, the device also includes a scheduling module, which is configured to: determine whether to replace the target execution body set based on the response result; or determine whether to replace the target execution body set based on the service time and scheduling cycle time of the target execution body set.

[0117] In some embodiments of the present application, the scheduling module is configured to: determine whether to replace the target execution body set based on the response result, including: when it is confirmed that the response result is abnormal, or the service time reaches the scheduling cycle time, obtain another execution body set and replace the target execution body set with the other execution body set; use the execution body group in the other execution body set to continue polling and responding to the request of the network system to obtain the response result.

[0118] In some embodiments of the present application, the scheduling module is configured to: use a set of the multiple executable sets except the target executable set as the other executable set.

[0119] In some embodiments of the present application, the scheduling module is configured to: obtain the remaining executable bodies in the heterogeneous layer except the partial executable bodies, and the remaining executable bodies include at least three executable bodies; combine the remaining executable bodies with any three of the intersecting executable bodies to obtain the other set of executable bodies.

[0120] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0121] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0122] like Figure 6 As shown, some embodiments of the present application provide an electronic device 700, which includes: a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 can implement a method as described in any of the above embodiments when reading the program from the memory 610 through a bus 630 and executing the program.

[0123] Processor 620 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 620 can be a microprocessor.

[0124] The memory 610 may be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 620 of the disclosed embodiment may be used to execute instructions in the memory 610 to implement the method shown above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0125] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0126] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0127] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for defending against mimicry escape, characterized in that: include: Acquire a target executable set for servicing a request of the network system, wherein the target executable set includes a plurality of executable groups; Using each executive body group in the target executive body set to respectively poll and respond to the request of the network system to obtain a response result, wherein each executive body group responds to different requests, and the response result indicates whether there is an abnormal phenomenon of mimicry escape in the network system; The step of obtaining a target executable set for servicing a request of the network system includes: Obtaining partial executable bodies intersecting between heterogeneous layers in the heterogeneous layer, wherein the partial executable bodies include at least four executable bodies; combining any three executable bodies in the partial executable bodies to obtain the multiple executable body groups in the target executable body set.

2. The method according to claim 1, characterized in that The network system includes at least three heterogeneous layers.

3. The method according to claim 2, characterized in that The step of obtaining a target executable set for servicing a request of the network system includes: Dividing the executables in the heterogeneous layer into intersecting executables, intersecting groups and non-intersecting groups; Combining the executables in the intersecting group and the non-intersecting group with the intersecting executables respectively to obtain a plurality of executable sets; Any one of the plurality of executable sets is selected as the target executable set.

4. The method according to claim 3, characterized in that The dividing the executables in the heterogeneous layer into intersecting executables, intersecting groups and non-intersecting groups includes: The same execution body contained in the heterogeneous layers is used as the intersecting execution body; The intersecting executable bodies between the heterogeneous layers in the heterogeneous layers are used to construct the intersecting group, wherein the intersecting executable body is not included in the intersecting group; The non-intersecting group is constructed by using the execution bodies in the heterogeneous layer except the intersecting group and the intersecting execution body.

5. The method according to claim 4, characterized in that The intersecting group and the non-intersecting group include at least three executables, each executable set in the multiple executable sets includes at least four executable groups, and each executable group includes three executables, wherein the executables in the intersecting group and the non-intersecting group are respectively combined with the intersecting executables to obtain multiple executable sets, including: Combining any three executables in the intersection group with the intersection executable to obtain any one of the multiple executable sets; Any three executables in the non-intersecting groups are combined with the intersecting executables to obtain any one of the multiple executable sets.

6. The method according to claim 5, characterized in that The using each executable body group in the target executable body set to respond to the request of the network system and obtain the response result includes: If at least two executors in each executor group return the same result to the request to the network system, confirming that the response result is normal; If the return results of the execution bodies in each execution body group to the request of the network system are all different, it is determined that the response result is abnormal.

7. The method according to claim 5, characterized in that The using each executable body group in the target executable body set to respond to the request of the network system and obtain the response result includes: If the return results of the requests to the network system from all the executable bodies in the executable body groups are the same, confirming that the response results are normal; If the return results of the requests to the network system from all the executables in the executable groups are not completely the same, the response result is confirmed to be abnormal.

8. The method according to any one of claims 6 to 7, characterized in that: After obtaining the response result, the method further includes: Determine whether to replace the target execution body set according to the response result; or, Whether to replace the target executable set is determined according to the service time and the scheduling cycle time of the target executable set.

9. The method according to claim 8, characterized in that The determining whether to replace the target executable set according to the response result includes: When it is confirmed that the response result is abnormal, or the service time reaches the scheduling cycle time, another set of executable bodies is obtained, and the target set of executable bodies is replaced with the another set of executable bodies; The execution body group in the another execution body set is used to continuously poll and respond to the request of the network system to obtain the response result.

10. The method according to claim 9, characterized in that The obtaining another executable set includes: One of the plurality of executable sets except the target executable set is used as the other executable set.

11. The method according to claim 9, characterized in that The obtaining another executable set includes: Acquire the remaining executable bodies in the heterogeneous layer except the partial executable bodies, wherein the remaining executable bodies include at least three executable bodies; The remaining executables are combined with any three of the intersecting executables to obtain the other executable set.

12. A device for preventing mimicry escape, characterized in that: The device is used to perform the method according to claim 1, comprising: An acquisition module is configured to acquire a target executable set for servicing a request of the network system, wherein the target executable set includes a plurality of executable groups; The response module is configured to use each execution body group in the target execution body set to respond to the request of the network system and obtain a response result, wherein each execution body group responds to different requests, and the response result represents whether there is an abnormal phenomenon of mimicry escape in the network system.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 11 when executed by a processor.

14. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 11 when being run by the processor.

Images