A mimicry defense system and method, electronic device and storage medium

Abstract

The application provides a mimicry defense system, method, electronic equipment and storage medium, the system comprises: a variation generation module, which is used for instantaneously varying a preset original application program and an original execution platform according to a preset variation rule, and / or performing application program pre-generation variation on a source program of the original application program to generate one or more variation running instances; the variation running instance comprises a variation application program and a variation execution platform used for running the variation application program; and an execution deployment module, the execution deployment module comprises a running instance unit, the running instance unit is used for storing and running at least one variation running instance, each variation running instance is used for independently executing a same to-be-processed task assigned and outputting corresponding execution data; the execution data is data used for data decision to obtain system output results. The system has high safety, high comprehensiveness of security defense and high self-adaptability.

Description

Technical Field

[0001] This invention relates to the field of computer software technology, and in particular to a mimicry defense system, method, electronic device, and storage medium. Background Technology

[0002] Software system security threats are ubiquitous, and hackers are constantly developing new attack methods. In response, corresponding defense measures have been developed and commercialized to address various forms of security threats.

[0003] However, various hacking techniques and methods continue to emerge, posing a constant threat to information security, from defense, industry, and academia to individuals' daily email communication. Furthermore, the increasing complexity of software systems means that patching security vulnerabilities often lags behind the release of new systems. Existing software system security defense methods and systems are relatively insecure, unable to promptly meet the security defense needs of newly released software systems, and ineffective in responding to emerging hacking techniques, exhibiting poor comprehensiveness and adaptability. Summary of the Invention

[0004] This invention provides a mimicry defense system, method, electronic device, and storage medium to address the problems of low security, inability to meet the security defense needs of newly launched software systems in a timely manner, poor ability to cope with emerging hacker attack methods, and poor comprehensiveness and adaptability in existing security defense methods.

[0005] This invention provides a mimicry defense system, comprising:

[0006] The mutation generation module is used to perform real-time mutation on a preset original application and original execution platform according to preset mutation rules, and / or perform application pre-generation mutation on the source program of the original application to generate one or more mutated running instances; the mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the real-time mutation refers to mutating the original application and the original execution platform just before loading the original application; the application pre-generation mutation refers to mutating the source program of the original application in advance.

[0007] The execution deployment module includes a running instance unit, which stores and runs at least one of the mutated running instances. Each mutated running instance is used to independently execute the same assigned task and output corresponding execution data. The execution data is used for data judgment to obtain system output results.

[0008] Optionally, the mutation generation module includes an instant mutation unit, which is used to perform instant mutation on the original application and the original execution platform according to the mutation rules when the original application is about to be loaded, thereby generating one or more of the mutated runtime instances.

[0009] Optionally, the mutation generation module further includes: a pre-generation mutation unit, which includes a pre-generation mutant and a matcher; the pre-generation mutant is used to perform pre-generation mutation on the source program of the original application according to the pre-generation mutation method in the mutation rules, to generate one or more pre-generation applications, which serve as input to the instant mutation unit or as input to the matcher; the matcher is used to match the pre-generation applications with a corresponding mutation execution platform to generate one or more mutation execution instances.

[0010] Optionally, the instantaneous mutation unit includes:

[0011] An instant mutation generator is used to generate one or more of the aforementioned mutation execution instances in real time.

[0012] An instant defense scheduler is used to acquire and store the mutation rules. When the instant mutation generator needs to perform an instant mutation operation, the stored mutation rules are input into the instant mutation generator. The mutation rules include: address morphology mutation, instruction morphology mutation, and pre-generated mutation methods. The pre-generated mutation methods are the corresponding rules when the application pre-generates mutations. The pre-generated mutation methods include at least one of the following: diversified compilation mutation, link morphology mutation, and heterogeneous software / hardware configuration mutation. Furthermore, the instant defense scheduler is also used to receive runtime exception data fed back by the execution deployment module, and adjust the mutated runtime instances according to the runtime exception data and preset runtime instance adjustment rules.

[0013] Optionally, the execution deployment module further includes a data decision unit, which is used to make a decision on the execution data output by the mutation execution platform for each mutation running case, so as to obtain the system output results and the abnormal data of the running case, and to feed back the abnormal data of the running case to the mutation generation module.

[0014] Optionally, the mutation execution platform includes: an operating system, memory configuration, a central processing unit, and input / output port types; the mutation execution platform is either a homogeneous execution platform or a heterogeneous execution platform.

[0015] The present invention also provides a mimicry defense method, comprising:

[0016] According to preset mutation rules, the preset original application and original execution platform are mutated in real time, and / or the source code of the original application is mutated in advance to generate one or more mutated running instances; the mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the real-time mutation refers to mutating the original application and the original execution platform just before the original application is loaded; the application pre-generation mutation refers to mutating the source code of the original application in advance.

[0017] Each of the mutated execution instances is controlled to independently execute the same assigned task and output corresponding execution data. The mutated execution instances and the execution data are in one-to-one correspondence. Based on the execution data, data judgment is performed to obtain the system output results.

[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the mimicry defense method as described above.

[0019] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the mimicry defense method as described above.

[0020] This invention provides a mimicry defense system, method, electronic device, and storage medium. It includes a mutation generation module for performing real-time mutations on a preset original application and execution platform according to preset mutation rules, and / or performing application pre-generation mutations on the source code of the original application to generate one or more mutated execution instances. Each mutated execution instance includes a mutated application and a mutated execution platform for running the mutated application. Real-time mutation refers to mutating the original application and the original execution platform just before loading the original application; application pre-generation mutation refers to pre-mutating the source code of the original application. Furthermore, an execution deployment module is included, comprising a execution instance unit for storing and running at least one mutated execution instance. Each mutated execution instance independently executes the same assigned task and outputs corresponding execution data. The execution data is used for data judgment and obtaining system output results. This significantly improves the security of the mimicry defense system, providing comprehensive and highly adaptable security defense. It can promptly meet the security defense needs of newly launched software systems and effectively counter emerging hacker attack methods. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the mimicry defense system provided by the present invention;

[0023] Figure 2 This is a schematic diagram of the address morphology variation defense mechanism in the mimicry defense system provided by the present invention;

[0024] Figure 3 This is a schematic diagram of the command morphology variation defense mechanism in the mimicry defense system provided by the present invention;

[0025] Figure 4 This is a schematic diagram illustrating the process of the mimicry defense system provided by the present invention undergoing real-time mutation.

[0026] Figure 5 This is a schematic diagram illustrating the pre-generation mutation process of the mimicry defense system provided by the present invention;

[0027] Figure 6 This is a schematic diagram of the structure of a first embodiment of the mimicry defense system provided by the present invention;

[0028] Figure 7 This is a schematic diagram of the structure of Embodiment 2 of the mimicry defense system provided by the present invention;

[0029] Figure 8 This is a schematic diagram of the structure of Embodiment 3 of the mimicry defense system provided by the present invention;

[0030] Figure 9 This is a flowchart illustrating the mimicry defense method provided by the present invention;

[0031] Figure 10 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0033] With the continuous development of information technology, people's lives are becoming increasingly inseparable from computer software, and software system security has thus received increasing attention. Software system security threats are ubiquitous, and common software attack methods have evolved from the more prevalent buffer overflow and return-oriented programming (ROP) attacks that alter software control flow, and man-in-the-middle attacks, to more sophisticated code injection. Correspondingly, defensive measures have also evolved from initial authentication and firewall settings to runtime memory block boundary checks, address space layout randomization (ASLR), operating system data execution protection (DEP), and CPU-level control flow enhancement (CFE), etc., to address security threats to various forms of software systems. However, various hacker attack techniques and methods continue to emerge. Existing software security defense methods and systems have relatively low security, cannot effectively cope with newly emerging hacker attack methods, and lack comprehensiveness and adaptability. Therefore, this invention proposes a mimicry defense system, method, electronic device, and storage medium. It includes a mutation generation module for performing real-time mutations on a preset original application and execution platform according to preset mutation rules, and / or performing application pre-generation mutations on the source code of the original application to generate one or more mutated execution instances. Each mutated execution instance includes: a mutated application and a mutated execution platform for running the mutated application. Real-time mutation refers to mutating the original application and the original execution platform just before recording the original application; application pre-generation mutation refers to pre-mutating the source code of the original application. Furthermore, an execution deployment module is provided, including: a execution instance unit for storing and running at least one mutated execution instance. Each mutated execution instance is used to independently execute the same assigned task and output corresponding execution data. The execution data is used for data judgment and obtaining system output results. This invention can significantly improve the security of the mimicry defense system, providing comprehensive security defense, high adaptability, and the ability to effectively respond to emerging hacker attack methods. It also exhibits high adaptability, feasibility, and stability.

[0034] To facilitate understanding of the technical solutions of this invention, the technical terms involved in this invention are explained below:

[0035] Mimic Defense (MD): A proactive defense strategy. Because its concepts have been applied to the field of cyberspace security, it is often shortened to Cyber ​​Mimic Defense (CMD). The core implementation of CMD is a Dynamic Heterogeneous Redundancy (DHR) structure based on the mechanism of Cyberspace Endogenous Safety and Security (CESS). It provides a relatively universal defense theory and method to address unknown threats in cyberspace based on unknown vulnerabilities, backdoors, or viruses and Trojans.

[0036] The following examples illustrate this approach. Figures 1-10 This invention describes the mimicry defense system, method, electronic device, and storage medium of the present invention.

[0037] Please refer to Figure 1 The mimicry defense system provided in this embodiment includes:

[0038] The mutation generation module 12 is used to perform real-time mutation on a preset original application and original execution platform according to preset mutation rules, and / or perform application pre-generation mutation on the source code of the original application to generate one or more mutated running instances; the mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the real-time mutation refers to mutating the original application and the original execution platform just before loading the original application, in other words, before loading the original application onto the original execution platform; the pre-generation mutation refers to mutating the source code of the original application in advance.

[0039] It should be noted that the mutation rules include: address type mutation, instruction type mutation, and pre-generated mutation methods. The pre-generated mutation methods include at least one of the following: diversified compilation mutation, link type mutation, and heterogeneous software / hardware configuration mutation. Real-time mutation is based on at least one of the above mutation rules. The application pre-generated mutation uses at least one of the following mutation rules among the pre-generated methods: diversified compilation mutation, link type mutation, and heterogeneous software / hardware configuration mutation. The above mutation rules are shown in Table 1 below:

[0040] Table 1. Variation Rules

[0041]

[0042]

[0043] Table 1 lists the attack forms defended against, referring to the attack forms protected by the corresponding mutation defense mechanisms. For example, address form mutation defense protects against ROP attacks that cause stack overflows. Defense method characteristics refer to the features of the methods employed by the corresponding mutation defense mechanisms. For example, instruction form mutation methods involve instruction set mutation, which is a mutation method that performs XOR operations, encryption operations, or pre-agreed instruction correspondence conversions on the instruction set or operands to complete instruction form mutation. Regarding the mutation methods or approaches for address form mutation and instruction form mutation, selection can be made according to the actual situation, such as Address Space Layout Randomization (ASLR) or Instruction Set Randomization (ISR) techniques. This invention does not limit these approaches and will not elaborate further here.

[0044] Figure 2 A schematic diagram of the address morphology mutation defense mechanism is shown. For example... Figure 2 As shown, based on the preset address mutation recipe / rules, when the original application is loaded to the mutation execution platform, different memory segments of the application are mutated (memory mapping) to generate n mutated execution instances.

[0045] Figure 3 A schematic diagram of the instruction morphology variation defense mechanism is shown. For example... Figure 3 As shown, based on a preset instruction mutation recipe / rule, the original application is mutated to generate k mutated applications. The result of instruction mutation is a mutated application with a mutated instruction set. Then, a corresponding mutated execution platform is matched or assigned to generate k mutated runtime instances.

[0046] Specifically, the mutation execution platform includes: operating system, memory configuration, central processing unit, input / output port type, and other software and hardware required to run the mutation application. The mutation execution platform can be obtained by combining the various software and hardware components within the platform. The type of the mutation execution platform is: homogeneous execution platform or heterogeneous execution platform.

[0047] It should also be noted that both the original application and the mutated application are binary applications. Each mutated runtime instance is a functionally equivalent runtime instance. The source code of the original application represents the source code of the original application. By employing on-the-fly mutation and / or pre-generated mutation techniques, one or more mutated runtime instances for executing the same task can be generated, which can effectively achieve the construction of a mimicry redundancy system with strong randomness and high security.

[0048] The execution deployment module 11 includes a running instance unit 111, which stores and runs at least one of the mutated running instances. Each mutated running instance independently executes the same assigned task and outputs corresponding execution data. The execution data is used for data judgment to obtain system output results. That is, each mutated running instance outputs corresponding execution data, and data judgment is performed based on the execution data to obtain system output results, thereby achieving mimicry defense, reducing the risk of system attacks, and improving system security. The data judgment method can adopt multiple judgment, for example: obtaining the execution data of each mutated running instance, using the same execution data of multiple mutated running instances as the system output results, and treating other mutated running instances as abnormal running instances, generating corresponding abnormal running instance data and providing feedback.

[0049] Please refer to Figure 4 In some embodiments, the mutation generation module 12 includes an instant mutation unit 121, which is used to perform instant mutation on the original application and the original execution platform according to the mutation rules just before the original application is loaded, generating one or more mutated execution instances. That is, before loading the original application into the memory space of the original execution platform, the original application undergoes address-mode mutation and / or instruction-mode mutation to obtain a mutated application, and then a corresponding execution platform is matched or allocated as the mutated execution platform to generate one or more mutated execution instances. By performing instant mutation before loading the original application into the memory space of the original execution platform, it is convenient to generate corresponding mutated execution instances in real time during system operation, making implementation easier.

[0050] Furthermore, in some embodiments, the instantaneous mutation unit 121 includes:

[0051] Instant mutation generator 1211, used to generate one or more of the said mutation execution instances in real time;

[0052] The real-time defense scheduler 1212 is used to acquire and store address-type mutations and / or instruction-type mutations in the mutation rules. When the real-time mutation generator needs to perform a real-time mutation operation, the stored mutation rules are input into the real-time mutation generator. It is also used to receive runtime exception data fed back by the execution deployment module 11, and adjust the mutated runtime instances according to the runtime exception data and preset runtime instance adjustment rules. The adjustment method can be uninstalling or adding mutated runtime instances. The real-time defense scheduler 1212 can also be used to combine mutated applications and mutated execution platforms based on mutation rules. Through the dynamic adjustment of the abnormal runtime instances in the above steps, the dynamic reconfigurable mobility target of this system can be better achieved, effectively improving the system's security and flexibility, and enhancing the comprehensiveness of system defense.

[0053] To further enhance the security of this system, this invention proposes pre-generation mutation in addition to instant mutation. That is, when the source code of the original application is available, pre-generation mutation is performed on the source code of the original application. Please refer to... Figure 5 In some embodiments, the mutation generation module 12 further includes a pre-generation mutation unit 122, which includes a pre-generation mutant 1221 and a matcher 1222. The pre-generation mutant 1221 is used to perform pre-generation mutation on the source program of the original application according to the pre-generation mutation method (pre-generation mutation recipe) in the mutation rules, generating one or more pre-generated applications. That is, generating functionally equivalent mutated object code during the compilation stage of the source program of the original application, thereby generating pre-generated applications. The pre-generated applications serve as input to the immediate mutation unit 121 or as input to the matcher 1222. The matcher 1222 is used to match the pre-generated applications with a corresponding mutation execution platform to generate one or more mutated execution instances. It is understood that the pre-generated applications are mutated applications that have undergone pre-generation mutation. The hardware environment for pre-generation mutation can be a heterogeneous environment.

[0054] It should be noted that when only application pre-generation mutation is performed, the pre-generated application generated by the pre-generation mutant serves as the input to the matcher. When both application pre-generation mutation and instant mutation are performed, the pre-generated application serves as the input to the instant mutation unit 121, that is, as the input to the instant mutation generator 1211.

[0055] In some embodiments, the execution deployment module further includes a task dispatcher 112, which is used to copy an input single task to be processed and distribute the copied task to each mutation run instance. The task to be processed can be input by a user through a terminal device. By setting the task dispatcher, it is convenient to distribute each single task to each mutation run instance.

[0056] In some embodiments, the execution deployment module 11 further includes a data decision unit 113, which is used to make decisions on the execution data output by the mutation execution platform for each mutation running instance to obtain system output results and abnormal running instance data, and to feed back the abnormal running instance data to the mutation generation module. The data decision method can employ multiple decision-making, etc., which will not be elaborated here.

[0057] In some embodiments, before executing the task to be processed, the mutation execution platform in the mutation execution instance needs to perform demutation operations, that is, to perform operations such as instruction extraction, instruction decoding, and operand extraction on the relevant instructions of the task to be processed, and restore the original instructions. If a demutator is set, the demutator performs demutation operations based on the mutation rules. After completing the above demutation operations, the original instructions are executed, and execution data is obtained.

[0058] Example 1:

[0059] Please refer to Figure 6 When only instant mutation is performed, the mimicry defense system of this embodiment includes: an instant mutation generator 1211, an instant defense scheduler 1212, a task dispatcher 112, a running instance unit 111, and a data decision unit 113. Before loading the original application into the memory space of the original execution platform, the instant mutation generator 1211 performs instant mutation on the original application and the original execution platform according to the mutation rules in the instant defense scheduler, generating n mutated running instances. The running instance unit 111 is a redundant architecture including multiple sets of functionally equivalent mutated running instances. Each mutated running instance includes a mutated application and a mutated execution platform for running the mutated application, such as mutated application k, mutated execution platform k, etc., 1≤k≤n. The task dispatcher 112 copies the input single pending task I and dispatches the copied pending task to each mutated running instance. Each mutated instance executes the received pending tasks and outputs its own execution data (O1, O2, O3...O...). nIt should be noted that before executing the task to be processed, the mutated execution platform in the mutated execution instance of the instruction form mutation defense mechanism needs to perform demutation operations, that is, to perform operations such as instruction extraction, instruction decoding, and arithmetic element extraction on the relevant instructions of the task to be processed, and restore the original instructions. After completing the above demutation operations, the original instructions are executed to obtain execution data. The data decision unit 113 makes a decision on the execution data output by the mutated execution platform of each mutated execution instance, obtains the system output result O and the execution instance abnormal data, and feeds back the execution instance abnormal data to the real-time defense scheduler 1212. The real-time defense scheduler 1212 adjusts the abnormal execution instance according to the execution instance abnormal data and the preset execution instance adjustment rules, such as unloading or adding abnormal execution instances, to realize the dynamic reconfigurability of the mimicry defense system. For example, when it is discovered that server A of the mutation execution platform of a certain mutated execution instance is attacked, the mutated execution instance containing server A is unloaded. Then, the real-time defense scheduler 1212 generates a mutated execution instance with server B based on the heterogeneous software / hardware configuration mutation in the mutation rules, and adds it to the execution instance unit 111. In this embodiment, the execution platform (original execution platform, mutated execution platform) can be a homogeneous execution platform. The mimicry defense system in this embodiment uses real-time mutation combined with dynamic reconfigurability technology to achieve adaptive reconfigurability of the mimicry defense system, which improves the security of mimicry defense, has high flexibility, and a wide coverage of attack defense.

[0060] Example 2:

[0061] Please refer to Figure 7 When only application pre-generation mutation is performed, the mimicry defense system in this embodiment includes: a pre-generation mutant 1221, a matcher 1222, a task dispatcher 112, a running instance unit 111, and a data decision unit 113. The pre-generation mutant 1221 pre-generates mutations the source code of the original application based on pre-generation mutation methods (pre-generation mutation recipes) in the mutation rules, generating one or more pre-generated applications. The pre-generated applications serve as input to the matcher 1222. The pre-generation mutation methods include at least one of the following: diversified compilation mutation, linking mode mutation, heterogeneous software / hardware configuration mutation (such as cross-platform diversified compilation). The matcher 1222 matches the mutated application with a corresponding mutation execution platform (homogeneous / heterogeneous), generating one or more mutated running instances. The task dispatcher 112 copies the input single task to be processed I and dispatches the copied task to each mutated running instance. Each mutated instance executes the received pending tasks and outputs its own execution data (O1, O2, O3...O...). nThe data decision maker 113 makes a decision on the execution data output by the mutation execution platform for each mutated execution instance, and obtains the system output result O. In this embodiment, the execution platform (original execution platform, mutated execution platform) can be a heterogeneous execution platform. The mimicry defense system in this embodiment has high security and strong feasibility.

[0062] Example 3:

[0063] Please refer to Figure 8 When performing both real-time mutation and application pre-generation mutation, the pre-generated application output by the matcher 1222 of the pre-generation mutation unit 122 is used as the input to the real-time mutation unit 121. The real-time mutation unit 121 connects to at least one mutation application (here, the mutation application refers to the pre-generated application output by the pre-generation mutation unit) and at least one homogeneous / heterogeneous execution platform. Based on the mutation rules in the real-time defense scheduler 1212, it performs real-time mutation on the connected pre-generated applications, then matches or assigns the corresponding mutation execution platform to generate one or more mutation execution instances. By combining real-time mutation with pre-generation mutation, the system's mutation level is increased, effectively improving the security and operational reliability of the mimicry defense system.

[0064] The mimicry defense method provided by the present invention will be described below by way of embodiments. The mimicry defense method described below can be referred to in correspondence with the mimicry defense system described above.

[0065] Please refer to Figure 9 This embodiment provides a mimicry defense method, including:

[0066] S901: According to preset mutation rules, perform real-time mutation on preset original application and original execution platform, and / or perform application pre-generation mutation on the source program of original application to generate one or more mutated running instances; the mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the real-time mutation refers to mutating the original application and the original execution platform just before the original application is recorded; the application pre-generation mutation refers to mutating the source program of the original application in advance.

[0067] S902: Control each of the mutated execution instances to independently execute the same assigned task and output corresponding execution data. Each mutated execution instance corresponds one-to-one with the execution data. Based on the execution data, perform data judgment and obtain the system output result. The mimicry defense method in this embodiment can effectively improve the security of mimicry defense, has strong comprehensiveness and high adaptability, and can meet the security defense needs of newly launched software systems in a timely manner.

[0068] In some embodiments, the instant mutation step includes: performing instant mutation on the original application and the original execution platform according to the mutation rules just before the original application is loaded, generating one or more of the mutated runtime instances.

[0069] In some embodiments, the application pre-generation mutation step includes: pre-generating mutations on the source code of the original application according to the pre-generation mutation methods in the mutation rules to generate one or more pre-generated applications; the pre-generated applications are used for immediate mutations or for matching the corresponding mutation execution platform (homogeneous / heterogeneous) to generate one or more mutation execution instances. Specifically, when only immediate mutations are performed, the above-described immediate mutation steps are used; when only application pre-generation mutations are performed, the pre-generated applications are matched with the corresponding mutation execution platform to generate one or more mutation execution instances; when both immediate mutations and application pre-generation mutations are performed, the pre-generated applications are used for immediate mutations. This effectively improves the security of mimicry defense, provides broad defense coverage, and has strong adaptability.

[0070] In some embodiments, the method further includes: performing data judgment based on the execution data to obtain abnormal running case data; and adjusting the mutated running case based on the abnormal running case data and preset running case adjustment rules.

[0071] In some embodiments, the mutation rules include: address morphology mutation, instruction morphology mutation, and pre-generated mutation means. The pre-generated mutation means are the corresponding rules when the application pre-generates mutations. The pre-generated mutation means include at least one of the following: diversified compilation mutation, link morphology mutation, and heterogeneous software / hardware configuration mutation.

[0072] In some embodiments, the task assignment step includes:

[0073] The acquired single task to be processed is copied, and the copied task to be processed is then assigned to each mutated running instance.

[0074] In some embodiments, the mutation execution platform includes: an operating system, memory configuration, a central processing unit, and input / output port types; the type of the mutation execution platform is: a homogeneous execution platform or a heterogeneous execution platform.

[0075] Figure 10 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 10As shown, the electronic device may include: a processor 1010, a communications interface 1020, a memory 1030, and a communication bus 1040, wherein the processor 1010, the communications interface 1020, and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 can call logical instructions in the memory 1030 to execute a mimicry defense method, which includes: performing immediate mutation on a preset original application and original execution platform according to preset mutation rules, and / or performing application pre-generation mutation on the source program of the original application to generate one or more mutated running instances; the mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the immediate mutation refers to mutating the original application and the original execution platform just before loading the original application; the application pre-generation mutation refers to mutating the source program of the original application in advance; controlling each mutated running instance to independently execute the same assigned task to be processed, and outputting corresponding execution data, wherein the mutated running instance corresponds one-to-one with the execution data; and performing data judgment based on the execution data to obtain system output results.

[0076] Furthermore, the logical instructions in the aforementioned memory 1030 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0077] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the mimicry defense method provided by the above-described methods. The method includes: performing real-time mutation on a preset original application and an original execution platform according to preset mutation rules, and / or performing pre-generation mutation on the source program of the original application to generate one or more mutated running instances; the mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the real-time mutation refers to mutating the original application and the original execution platform just before loading the original application; the application pre-generation mutation refers to pre-mutating the source program of the original application; controlling each mutated running instance to independently execute the same assigned task to be processed and outputting corresponding execution data, wherein the mutated running instance corresponds one-to-one with the execution data; and performing data judgment based on the execution data to obtain system output results.

[0078] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the mimicry defense method provided by the above methods. This method includes: performing immediate mutation on a preset original application and an original execution platform according to preset mutation rules, and / or performing application pre-generation mutation on the source program of the original application to generate one or more mutated running instances; each mutated running instance includes: a mutated application and a mutated execution platform for running the mutated application; the immediate mutation refers to mutating the original application and the original execution platform just before loading the original application; the application pre-generation mutation refers to pre-mutating the source program of the original application; controlling each mutated running instance to independently execute the same assigned task and output corresponding execution data, wherein each mutated running instance corresponds one-to-one with the execution data; and performing data judgment based on the execution data to obtain system output results.

[0079] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0080] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A mimicry defense system, characterized in that, include: The mutation generation module is used to perform real-time mutations on the preset original application and original execution platform according to preset mutation rules, and / or perform application pre-generation mutations on the source program of the original application to generate one or more mutated runtime instances. The mutation execution instance includes: a mutated application and a mutated execution platform for running the mutated application; the instant mutation refers to mutating the original application and the original execution platform just before the original application is loaded; the application pre-generation mutation refers to mutating the source code of the original application in advance. The execution deployment module includes a running instance unit, which stores and runs at least one of the mutated running instances. Each mutated running instance is used to independently execute the same assigned task and output corresponding execution data. The execution data is used for data judgment to obtain system output results.

2. The mimicry defense system according to claim 1, characterized in that, The mutation generation module includes an instant mutation unit, which is used to perform instant mutation on the original application and the original execution platform according to the mutation rules when the original application is about to be loaded, and generate one or more of the mutated running instances.

3. The mimicry defense system according to claim 2, characterized in that, The mutation generation module further includes a pre-generation mutation unit, which includes a pre-generation mutant and a matcher. The pre-generation mutant is used to perform pre-generation mutation on the source program of the original application according to the pre-generation mutation method in the mutation rules, generating one or more pre-generation applications. The pre-generation applications are used as input to the instant mutation unit or as input to the matcher. The matcher is used to match the pre-generation applications with a corresponding mutation execution platform to generate one or more mutation execution instances.

4. The mimicry defense system according to claim 2, characterized in that, The instantaneous mutation unit includes: An instant mutation generator is used to generate one or more of the aforementioned mutation execution instances in real time. An instant defense scheduler is used to acquire and store the mutation rules. When the instant mutation generator needs to perform an instant mutation operation, the stored mutation rules are input into the instant mutation generator. The mutation rules include: address morphology mutation, instruction morphology mutation, and pre-generated mutation methods. The pre-generated mutation methods are the corresponding rules when the application pre-generates mutations. The pre-generated mutation methods include at least one of the following: diversified compilation mutation, link morphology mutation, and heterogeneous software / hardware configuration mutation. Furthermore, the instant defense scheduler is also used to receive runtime exception data fed back by the execution deployment module, and adjust the mutated runtime instances according to the runtime exception data and preset runtime instance adjustment rules.

5. The mimicry defense system according to claim 1, characterized in that, The execution deployment module further includes a task dispatcher, which is used to copy the input single task to be processed and dispatch the copied task to each mutated running instance.

6. The mimicry defense system according to claim 1, characterized in that, The execution deployment module further includes a data decision unit, which is used to make decisions on the execution data output by the mutation execution platform for each mutation running case, so as to obtain the system output results and abnormal running case data, and to feed back the abnormal running case data to the mutation generation module.

7. The mimicry defense system according to claim 1, characterized in that, The mutation execution platform includes: operating system, memory configuration, central processing unit, and input / output port type; the mutation execution platform is either a homogeneous execution platform or a heterogeneous execution platform.

8. A mimicry defense method, characterized in that, include: Based on preset mutation rules, perform real-time mutations on the preset original application and original execution platform, and / or perform application pre-generation mutations on the source code of the original application to generate one or more mutated runtime instances. The mutation execution instance includes: a mutated application and a mutated execution platform for running the mutated application; the instant mutation refers to mutating the original application and the original execution platform just before the original application is loaded; the application pre-generation mutation refers to mutating the source code of the original application in advance. Each of the mutated execution instances is controlled to independently execute the same assigned task and output corresponding execution data. The mutated execution instances and the execution data are in one-to-one correspondence. Based on the execution data, data judgment is performed to obtain the system output results.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the mimicry defense method as described in claim 8.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the mimicry defense method as described in claim 8.

Images