A method and apparatus for mimicry defense

Abstract

The application discloses a mimicry defense method and device. First, target software data is acquired, and then the target software data is subjected to isomerization processing to obtain target isomer variants. Then, a target mimicry container image is constructed by using the target isomer variants, and then the target mimicry container is run based on the target mimicry container image. Then, the target software is controlled to run in the target mimicry container, and target output of the target software running in the target mimicry container is acquired, wherein the target output comprises first output of a first execution area of the target mimicry container, second output of a second execution area of the target mimicry container and third output of a third execution area of the target mimicry container. Then, the output state of the target output is determined according to the above three outputs. If the output state of the target output is an abnormal output state, the target output is blocked and the running of the target software is stopped, and then the above three execution areas are cleaned based on a preset cleaning strategy. In this way, the vulnerability attack can be timely defended.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, and in particular to a mimicry defense method, apparatus, device, and readable storage medium. Background Technology

[0002] The rapid development of cyberspace technology has brought speed, efficiency, and convenience to all aspects of modern society, but it has also brought enormous security risks, such as privacy leaks, data tampering, and information theft. In a world heavily reliant on internet information technology, traditional cybersecurity defense models are gradually becoming inadequate to address the ever-changing vulnerability attack methods employed by hackers.

[0003] Existing defense methods rely on control flow integrity to defend against control flow hijacking based on code reuse. However, this approach makes it difficult to detect and defend against vulnerability attacks in a timely manner. Summary of the Invention

[0004] In view of this, this application provides a mimicry defense method and apparatus that can defend against vulnerability attacks in a timely manner.

[0005] Firstly, this application provides a mimicry defense method, the method comprising:

[0006] Acquire target software data;

[0007] The target software data is heterogeneously processed to obtain a target heterogeneous variant;

[0008] Construct a target-mimicking container image using the target heterogeneous variant;

[0009] Run the target mimic container based on the target mimic container image;

[0010] Control the target software to run within the target mimicry container;

[0011] Obtain the target output of the target software running in the target mimicry container. The target output includes a first output of a first execution region of the target mimicry container, a second output of a second execution region of the target mimicry container, and a third output of a third execution region of the target mimicry container. The first execution region, the second execution region, and the third execution region are heterogeneous but functionally equivalent.

[0012] The output state of the target output is determined based on the first output, the second output, and the third output;

[0013] If the output state of the target output is abnormal, the target output is blocked and the operation of the target software is stopped. The first execution region, the second execution region and the third execution region are cleaned based on a preset cleaning strategy.

[0014] In one possible implementation, the heterogeneous processing of the target software data includes:

[0015] If the target software data includes the source code of the target software, then the target software data is heterogeneously processed using diversified compilation.

[0016] In one possible implementation, the heterogeneous processing of the target software data includes:

[0017] If the target software data does not include the source code of the target software, then the target software is heterogeneously processed by binary obfuscation or disassembly recompilation.

[0018] In one possible implementation, determining the output state of the target output based on the first output, the second output, and the third output includes:

[0019] If the first output, the second output, and the third output are determined to be different based on a preset voting algorithm, then the output state of the target output is determined to be an abnormal output state.

[0020] In one possible implementation, the method further includes:

[0021] If the target output is in a normal output state, redundancy is removed from the first output, the second output, and the third output to determine the target output.

[0022] Secondly, this application also provides a mimicry defense device, the device comprising:

[0023] The first acquisition unit is used to acquire target software data;

[0024] The processing unit is used to perform heterogeneous processing on the target software data to obtain a target heterogeneous variant;

[0025] Construction unit, used to construct a target mimicry container image using the target heterogeneous variant;

[0026] The running unit is used to run the target mimicry container based on the target mimicry container image;

[0027] A control unit is used to control the target software to run in the target mimicry container;

[0028] The second acquisition unit is used to acquire the target output of the target software running in the target mimicry container. The target output includes the first output of the first execution area of ​​the target mimicry container, the second output of the second execution area of ​​the target mimicry container, and the third output of the third execution area of ​​the target mimicry container. The first execution area, the second execution area, and the third execution area are heterogeneous but functionally equivalent.

[0029] The determining unit is configured to determine the output state of the target output based on the first output, the second output, and the third output;

[0030] The cleaning unit is used to block the target output and stop the operation of the target software if the output state of the target output is abnormal, and to clean the first execution area, the second execution area and the third execution area based on a preset cleaning strategy.

[0031] In one possible implementation, the processing unit is configured to perform heterogeneous processing on the target software data, including:

[0032] The processing unit is further configured to perform heterogeneous processing on the target software data by using diversified compilation if the target software data includes the source code of the target software.

[0033] In one possible implementation, the processing unit is used to perform heterogeneous processing on the target software data, including:

[0034] The processing unit is configured to perform heterogeneous processing on the target software by using binary obfuscation or disassembly recompilation if the target software data does not include the source code of the target software.

[0035] In one possible implementation, the determining unit includes:

[0036] If the first output, the second output, and the third output are determined to be different based on a preset voting algorithm, then the output state of the target output is determined to be an abnormal output state.

[0037] In one possible implementation, the device further includes:

[0038] A redundancy removal unit is used to remove redundancy from the first output, the second output, and the third output if the output state of the target output is a normal output state, in order to determine the target output.

[0039] Therefore, this application has the following beneficial effects:

[0040] This application provides a mimicry defense method and apparatus. First, target software data is acquired, and then heterogeneous processing is performed on the target software data to obtain a target heterogeneous variant. Next, a target mimicry container image is constructed using the target heterogeneous variant, and then the target mimicry container is run based on the target mimicry container image. The target software is then controlled to run within the target mimicry container. The target output of the target software running in the target mimicry container is acquired. The target output includes a first output from a first execution region of the target mimicry container, a second output from a second execution region of the target mimicry container, and a third output from a third execution region of the target mimicry container. The first, second, and third execution regions are heterogeneous but functionally equivalent. The output state of the target output is then determined based on the first, second, and third outputs. If the output state of the target output is an abnormal output state, the target output is blocked and the execution of the target software is stopped. The first, second, and third execution regions are then cleaned based on a preset cleaning strategy. In this way, vulnerability attacks can be defended against in a timely manner. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 A schematic flowchart illustrating a mimicry defense method provided in an embodiment of this application;

[0043] Figure 2 This is a schematic diagram of the structure of a mimicry defense device provided in an embodiment of this application. Detailed Implementation

[0044] To facilitate understanding and explanation of the technical solutions provided in the embodiments of this application, the background technology of this application will be described first.

[0045] Mimicry Defense: Mimicry defense is a proactive defense strategy against unknown vulnerabilities and backdoors. Its core is the construction of dynamic heterogeneous redundancy (DHR). While the functions of each executor are equivalent, their behavior differs after being attacked. A voter determines whether an attack has occurred by comparing the behavior of all executors in the online set. Once the voter determines an attack, it uses a dynamic selection algorithm to choose a suitable component from the offline heterogeneous component set to replace the online executor; this process is called mimicry transformation. The portion between the input agent and the voter is called the mimicry bound. The DHR construction and voting mechanism of the mimicry bound are the root of the inherent security capabilities of the mimicry defense system.

[0046] To defend against process control flow hijacking attacks based on binary vulnerabilities, this paper, inspired by the concept of mimicry defense, employs dynamic heterogeneous redundancy to execute programs. Based on heterogeneous redundancy, and combined with a voting mechanism, it effectively detects attack behaviors, blocks the attacks, and issues alerts and feedback. Ultimately, this achieves an intrinsically secure software operating environment.

[0047] Redundancy: Everything within the mimicry boundary needs to remain transparent to the outside; this is an inherent requirement of mimicry. This necessitates: automatic redundancy of inputs to mimicry software, automatic de-redundancy of outputs from mimicry software, and one software executor being unaware of the existence of other software executors.

[0048] Heterogeneity: Heterogeneity stems from two dimensions. One dimension is the difference in the operating environment. The other dimension is the heterogeneous processing of the software itself.

[0049] Mimic container images: Mimic container images differ from traditional container images. Traditional container images only contain the runtime environment required by the container, while mimic container images contain the redundancy information of the mimic container and the runtime environment required for each redundancy (region). This makes the runtime environment of the software heterogeneous when running in a mimic container image.

[0050] Existing defense methods rely on control flow integrity to defend against control flow hijacking based on code reuse. However, this approach makes it difficult to detect and defend against vulnerability attacks in a timely manner.

[0051] Based on this, this application provides a mimicry defense method and apparatus. First, target software data is acquired, and then heterogeneous processing is performed on the target software data to obtain a target heterogeneous variant. Then, a target mimicry container image is constructed using the target heterogeneous variant, and the target mimicry container is run based on the target mimicry container image. The target software is then controlled to run within the target mimicry container. The target output of the target software running in the target mimicry container is acquired. The target output includes a first output of a first execution region of the target mimicry container, a second output of a second execution region of the target mimicry container, and a third output of a third execution region of the target mimicry container. The first, second, and third execution regions are heterogeneous but functionally equivalent. The output state of the target output is then determined based on the first, second, and third outputs. If the output state of the target output is an abnormal output state, the target output is blocked and the operation of the target software is stopped. The first, second, and third execution regions are then cleaned based on a preset cleaning strategy. In this way, vulnerability attacks can be defended against in a timely manner.

[0052] To facilitate understanding of the technical solutions provided in the embodiments of this application, the following description, in conjunction with the accompanying drawings, illustrates a mimicry defense method and apparatus provided in the embodiments of this application.

[0053] S101: Obtain target software data.

[0054] In this embodiment, target software data can be obtained using web crawling technology. Alternatively, it can be obtained directly from a database. No limitation is placed on the method of obtaining target software data.

[0055] S102: Perform heterogeneous processing on the target software data to obtain a target heterogeneous variant.

[0056] Understandably, target software data can include runtime data and source code of the target software. After obtaining the target software data, it is determined whether the target software data includes the source code. If the target software data includes the source code, heterogeneous processing can be used to obtain a target heterogeneous variant through diversified compilation. If the target software data does not include the source code, binary obfuscation or disassembly recompilation can be used to heterogeneously process the target software to obtain a target heterogeneous variant.

[0057] S103: Construct a target mimicry container image using the target heterogeneous variant.

[0058] After obtaining the target heterogeneous variant, a target mimic container image can be built using a preset mimic container image building method.

[0059] S104: Run the target mimic container based on the target mimic container image.

[0060] In this embodiment of the application, the constructed target mimicry container image is used as the runtime environment of the target mimicry container, so that the target mimicry container can run in the mimicry container image.

[0061] S105: Control the target software to run in the target mimicry container.

[0062] After the target mimic container successfully runs in the mimic container image, control the target software to run in the target mimic container.

[0063] S106: Obtain the target output of the target software running in the target mimicry container, the target output including the first output of the first execution area of ​​the target mimicry container, the second output of the second execution area of ​​the target mimicry container, and the third output of the third execution area of ​​the target mimicry container, wherein the first execution area, the second execution area, and the third execution area are heterogeneous and functionally equivalent.

[0064] After the target software runs in the target mimicry container, the first output of the target software in the first execution region of the target mimicry container, the second output of the target software in the second execution region of the target mimicry container, and the third output of the target software in the third execution region of the target mimicry container can be obtained. Among them, the first execution region, the second execution region, and the third execution region are heterogeneous but functionally equivalent.

[0065] S107: Determine the output state of the target output based on the first output, the second output, and the third output.

[0066] Understandably, after obtaining the first, second, and third outputs, a preset voting algorithm is used to determine whether the first, second, and third outputs are the same. If the preset voting algorithm determines that the first, second, and third outputs are exactly the same, then the target output's output state is normal. If the preset voting algorithm determines that the first and second outputs are the same, but the first and second outputs are different from the third output, then the target output's output state is abnormal. Alternatively, if the preset voting algorithm determines that the second and third outputs are the same, but the second and third outputs are different from the first output, then the target output's output state is abnormal. Alternatively, if the preset voting algorithm determines that the first and third outputs are the same, but the first and third outputs are different from the second output, then the target output's output state is abnormal. Alternatively, if the preset voting algorithm determines that the first, second, and third outputs are all different, then the target output's output state is abnormal.

[0067] S108: If the output state of the target output is an abnormal output state, block the target output and stop the operation of the target software, and clean the first execution area, the second execution area and the third execution area based on a preset cleaning strategy.

[0068] Once the target's output is determined to be in an abnormal state, it can be considered under attack. At this point, the target's output is blocked, and the target software's operation is stopped. Blocking the target's output halts data transmission, thus breaking the attack chain. After stopping the target software, the first, second, and third execution regions are cleaned based on a preset cleaning strategy. This cleaning of the execution regions effectively defends against vulnerability attacks and improves data transmission security.

[0069] Based on the relevant content of S101-S108, vulnerability attacks can be defended in a timely manner, improving the security of data transmission.

[0070] The specific implementation processes and derivative methods of the above embodiments are all within the protection scope of this application.

[0071] and Figure 1 Corresponding to the method described above, this application also provides a mimicry defense device for... Figure 1 The specific implementation of the method, the mimicry defense device provided in this application embodiment can be applied to computer terminals or various mobile devices, and its structural schematic diagram is shown below. Figure 2 As shown, the mimicry defense device specifically includes:

[0072] The first acquisition unit 201 is used to acquire target software data;

[0073] Processing unit 202 is used to perform heterogeneous processing on the target software data to obtain a target heterogeneous variant;

[0074] Construction unit 203 is used to construct a target mimicry container image using the target heterogeneous variant;

[0075] The running unit 204 is used to run the target mimic container based on the target mimic container image;

[0076] Control unit 205 is used to control the target software to run in the target mimicry container;

[0077] The second acquisition unit 206 is used to acquire the target output of the target software running in the target mimicry container. The target output includes the first output of the first execution area of ​​the target mimicry container, the second output of the second execution area of ​​the target mimicry container, and the third output of the third execution area of ​​the target mimicry container. The first execution area, the second execution area, and the third execution area are heterogeneous but functionally equivalent.

[0078] The determining unit 207 is used to determine the output state of the target output based on the first output, the second output, and the third output;

[0079] The cleaning unit 208 is used to block the target output and stop the operation of the target software if the output state of the target output is abnormal, and to clean the first execution area, the second execution area and the third execution area based on a preset cleaning strategy.

[0080] In one possible implementation, the processing unit 202 is configured to perform heterogeneous processing on the target software data, including:

[0081] The processing unit is further configured to perform heterogeneous processing on the target software data by using diversified compilation if the target software data includes the source code of the target software.

[0082] In one possible implementation, the processing unit 202 is configured to perform heterogeneous processing on the target software data, including:

[0083] The processing unit 202 is used to perform heterogeneous processing on the target software by using binary obfuscation or disassembly recompilation if the target software data does not include the source code of the target software.

[0084] In one possible implementation, the determining unit 207 includes:

[0085] If the first output, the second output, and the third output are determined to be different based on a preset voting algorithm, then the output state of the target output is determined to be an abnormal output state.

[0086] In one possible implementation, the device further includes:

[0087] A redundancy removal unit is used to remove redundancy from the first output, the second output, and the third output if the output state of the target output is a normal output state, in order to determine the target output.

[0088] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

[0089] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0090] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0091] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of mimicry defense, characterized in that, The method comprises: acquiring target software data; performing isomerization processing on the target software data to obtain a target isomer; the isomerization processing on the target software data comprises: if the target software data does not include source code of the target software, performing isomerization processing on the target software by using binary obfuscation or disassembly recompilation; constructing a target quasiparticle container image by using the target isomer; running a target quasiparticle container based on the target quasiparticle container image; the target quasiparticle container image contains redundancy information of the target quasiparticle container and a running environment required by each redundancy, so that the running environment of software is heterogeneous when the software runs in the target quasiparticle container image; controlling the target software to run in the target quasiparticle container; acquiring a target output of the target software running in the target quasiparticle container, the target output comprising a first output of a first execution area of the target quasiparticle container, a second output of a second execution area of the target quasiparticle container, and a third output of a third execution area of the target quasiparticle container, the first execution area, the second execution area, and the third execution area being heterogeneous and functionally equivalent; determining an output state of the target output according to the first output, the second output, and the third output; if the output state of the target output is an abnormal output state, blocking the target output and stopping running of the target software, and cleaning the first execution area, the second execution area, and the third execution area based on a preset cleaning strategy; the determination of the output state of the target output according to the first output, the second output, and the third output comprises: if it is determined based on a preset voting algorithm that the first output, the second output, and the third output are not the same, determining that the output state of the target output is an abnormal output state; the method further comprises: if the output state of the target output is a normal output state, performing deduplication on the first output, the second output, and the third output to determine the target output.

2. The method of claim 1, wherein, the isomerization processing on the target software data comprises: if the target software data includes source code of the target software, performing isomerization processing on the target software data by using diversified compilation.

3. A mimicry defense device, characterized in that The device comprises: a first acquisition unit configured to acquire target software data; a processing unit configured to perform isomerization processing on the target software data to obtain a target isomer; the isomerization processing on the target software data comprises: if the target software data does not include source code of the target software, performing isomerization processing on the target software by using binary obfuscation or disassembly recompilation; a construction unit configured to construct a target quasiparticle container image by using the target isomer; a running unit configured to run a target quasiparticle container based on the target quasiparticle container image; the device further comprises that the target quasiparticle container image contains redundancy information of the target quasiparticle container and a running environment required by each redundancy, so that the running environment of software is heterogeneous when the software runs in the target quasiparticle container image; A control unit is configured to control the target software to run in the target quasi-state container; A second obtaining unit is configured to obtain a target output of the target software running in the target quasi-state container, the target output comprising a first output of a first execution area of the target quasi-state container, a second output of a second execution area of the target quasi-state container, and a third output of a third execution area of the target quasi-state container, the first execution area, the second execution area, and the third execution area being heterogeneous and functionally equivalent; A determination unit is configured to determine an output state of the target output according to the first output, the second output, and the third output; A cleaning unit is configured to, if the output state of the target output is an abnormal output state, block the target output and stop running of the target software, and clean the first execution area, the second execution area, and the third execution area based on a preset cleaning strategy. The determination unit comprises: If it is determined based on a preset voting algorithm that the first output, the second output, and the third output are not identical, it is determined that the output state of the target output is an abnormal output state. The apparatus further comprises: A redundancy removal unit is configured to, if the output state of the target output is a normal output state, remove redundancy from the first output, the second output, and the third output, and determine the target output.

4. The apparatus of claim 3, wherein, The processing unit is configured to perform heterogeneous processing on the target software data, comprising: The processing unit is further configured to, if the target software data comprises source code of the target software, perform heterogeneous processing on the target software data by using diversified compilation.

Images