A mimic waf isomer information arbitration method based on outlier detection

Abstract

The application provides a quasi-state WAF isomer information arbitration method based on an outlier detection, aims to monitor state information of a plurality of isomer executors in the quasi-state WAF at a fixed time, carries out voting calculation of an abnormal index of each isomer through an information arbitration module, determines that the isomer has been attacked to enter an abnormal state when the abnormal index exceeds a certain threshold, and thus the isomer is offline cleaned. For the abnormal determination problem in the information arbitration, the application provides an accurate and reliable abnormal arbitration method, so as to improve the abnormal determination accuracy, reduce the abnormal misjudgment rate, and effectively improve the self-defense capability of the quasi-state WAF.

Description

Technical Field

[0001] The present invention belongs to the technical field of mimetic defense of network security technology, and specifically relates to a mimetic WAF isomer information arbitration method based on outlier detection. Background Art

[0002] With the rapid development of the internet industry in recent years, network security issues have become increasingly severe. Various cyber attacks originating from the internet have emerged one after another, making the network security environment "easy to attack but difficult to defend." In particular, attacks targeting the application layer of web applications are increasingly posing a threat to internet business systems. Attacks at the web application layer are experiencing an explosive growth and continuous innovation, posing serious security risks to internet business systems.

[0003] Currently, the main protection method for web application systems is WAF, or Web Application Firewall. However, as a typical passive defense measure, traditional WAF mainly upgrades its defense capabilities by updating the filtering rule library. However, it has problems such as single filtering rules that are easy to bypass, and the WAF platform cannot defend against zero-day attacks against itself.

[0004] The mimetic WAF utilizes a dynamic, heterogeneous, redundant technical architecture to enable the WAF platform to defend against attacks targeting unknown backdoors and vulnerabilities within the WAF itself, enhancing its inherent security. A mimetic WAF contains multiple heterogeneous executors. To prevent attacks against the mimetic WAF itself, regular security checks on these heterogeneous executors are necessary. Accurately identifying abnormal conditions within these multiple heterogeneous executors is a key issue. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a mimetic WAF isomer information arbitration method based on outlier detection.

[0006] The present invention is achieved through the following technical solutions:

[0007] A method for adjudicating isomer information of a mimetic WAF based on outlier detection, the method comprising the following steps:

[0008] The beneficial effects of the present invention are as follows:

[0009] 1. Improve the self-defense capability of the mimetic WAF. The present invention uses outlier detection and information arbitration methods to monitor isomer status and judge anomalies. It can promptly detect abnormal isomer states and take them offline for cleaning, thereby effectively improving the self-defense capability of the mimetic WAF.

[0010] 2. Accurate and reliable anomaly adjudication method: The present invention provides an accurate and reliable anomaly adjudication method, which performs voting calculations based on the status information of multiple isomers, effectively avoiding misjudgment of the status information of a single isomer, improving the accuracy of anomaly judgment, and reducing the anomaly misjudgment rate.

[0011] 3. Improve system stability: The outlier detection and information arbitration method of the present invention can timely detect and clean up isomers in abnormal states, thereby avoiding their negative impact on system stability and improving system stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 is a diagram of the arbitration method architecture of the present invention;

[0013] Figure 2 It is a hierarchical structure model diagram constructed by the present invention. DETAILED DESCRIPTION

[0014] The present invention provides a mimetic WAF isomer information adjudication method based on outlier detection. By defining an anomaly index, a comprehensive information adjudication is performed on four types of information: the number of users, CPU usage, the last modification timestamp of the file / etc / passwd, and the last modification timestamp of the file / etc / crontab.

[0015] 1. If Figure 1 As shown in FIG, a mimetic WAF isomer information decision method based on outlier detection of the present invention specifically includes the following steps: establishing an information decision model, which can be specifically expressed as a 10-tuple,

[0016] M=(n,t,U,C,Pa,Cr,γ,w,s,S),

[0017] Where n is the number of heterogeneous executors of the mimic WAF, and t is the total number of model runs; is the number of users of each heterogeneous executor in the Tth information decision; The Tth information determines the CPU usage of each heterogeneous executor; It is the last modification timestamp of the file / etc / passwd of each executable in the Tth information decision; The timestamp of the last modification of the file / etc / crontab of each executable for the Tth information judgment; represents the information anomaly index of each type of information isomer in the Tth information judgment; w=(w U ,w C ,w Pa ,w pa ) is the weight coefficient of each type of abnormal index; represents the weighted anomaly index of each isomer in the Tth information judgment, S={S1,S2,...,S n} is the current set of anomaly indices of n isomers, S i The initial value of is 0.

[0018] 2. Use the analytic hierarchy process to construct a system model based on the number of heterogeneous users U, CPU usage C, the last modification timestamp Pa of the file / etc / passwd, and the last modification timestamp Cr of the file / etc / crontab.

[0019] (2.1) Establishing a hierarchical model

[0020] like Figure 2 As shown, the structural model of the present invention includes three levels: target level, decision level and solution level.

[0021] At the target level, the present invention aims to determine the abnormal index of the isomer, that is, to calculate whether the isomer is in an abnormal state through monitoring the isomer state and information judgment.

[0022] At the decision layer, the present invention uses four decision variables: / etc / passwd last modification timestamp Pa, / etc / crontab last modification timestamp Cr, number of users U and CPU usage C. These variables are key indicators used by the present invention to monitor the isomer status.

[0023] At the solution level, the present invention determines whether a heterogeneous entity is in an abnormal state by monitoring its status information, including the last modification timestamp Pa of / etc / passwd, the last modification timestamp Cr of / etc / crontab, the number of users U, and the CPU usage C. Specifically, the present invention employs an outlier detection and information adjudication method, performing voting calculations based on the status information of multiple heterogeneous entities. This effectively avoids misjudgments of the status information of a single heterogeneous entity, improves the accuracy of anomaly judgments, and reduces the rate of misjudgments. This allows for the timely detection and removal of abnormal heterogeneous entities, enhancing the mimetic WAF's inherent defense capabilities, and improving security performance and system stability.

[0024] (2.2) Constructing the judgment matrix

[0025] For the four indicators D1, D2, D3, and D4 at the decision-making level, the importance of solving the isomer anomaly index is compared in pairs:

[0026] D i : A=(a ij ) 4×4 , a ij >0,

[0027] If D i and D j Equally important, a ij =1; if D i than D j Important, a ij ∈{2,3,4,5,6,7,8,9}; if D i than D j Not important, a ij ∈{1 / 2,1 / 3,1 / 4,1 / 5,1 / 6,1 / 7,1 / 8,1 / 9};

[0028] (2.3) Perform consistency check

[0029] The maximum eigenvalue λ is calculated by the equation |A-λE|=0 max , further calculate the consistency index CI:

[0030]

[0031] Randomly construct k judgment matrices A1, A2, ..., A k , calculate their respective consistency indices CI1, CI2, ..., CI k , further calculate the random consistency index RI:

[0032]

[0033] Further calculate the consistency ratio CR:

[0034]

[0035] If CR<0.1, the consistency test is passed, otherwise return to step (2.2) to reconstruct the judgment matrix;

[0036] (2.4) Calculate the weight coefficient

[0037] Calculate the weight vector w using the arithmetic mean method i :

[0038]

[0039] Get the weight coefficient of each type of abnormal index w=(w U ,w C ,w Pa ,w pa )=(w1,w2,w3,w4).

[0040] 3. Regularly conduct information adjudication on n isomers

[0041] (3.1) For the number of users in each isomer, the user number anomaly index is calculated through information arbitration, which is characterized by solving the value set U with the largest number of user numbers in the Tth information arbitration. maxT (If the number of users is the same, U maxT =0), further, calculate the user number abnormality index obtained by the T-th information judgment Among them, if Then p i =1, otherwise p i =0, i=1,2,..,n;

[0042] (3.2) For the CPU usage of each isomer, a CPU usage anomaly index is calculated through information arbitration, wherein the CPU usage threshold is set as η, and the CPU usage anomaly index obtained by the T-th information arbitration is calculated;

[0043] Among them, if Then p i =1, otherwise p i =0, i=1,2,..,n;

[0044] (3.3) For the last timestamp of the file / etc / passwd of each isomer, the last timestamp of the file / etc / passwd is calculated by information arbitration, characterized in that the outlier deviation threshold is set to For the Tth information decision, σ T For Pa T The standard deviation of T For Pa T The average value of n isomers is calculated by the following formula

[0045]

[0046] Further calculate the abnormal index of the last timestamp of the file / etc / passwd obtained by the T-th information judgment: Among them, if Then p i =1, otherwise p i =0, i=1,2,..,n;

[0047] (3.4) For the last timestamp of the file / etc / crontab of each isomer, the last timestamp anomaly index of the file / etc / crontab is calculated by information judgment, which is characterized by setting the outlier deviation threshold to For the Tth information decision, σ T Cr T The standard deviation ofT Cr T The average value of n isomers is calculated by the following formula

[0048]

[0049] Furthermore, the abnormal index of the last timestamp of the file / etc / passwd obtained by the T-th information adjudication is calculated: Among them, if Then p i =1, otherwise p i =0, i=1,2,..,n;

[0050] (3.5) The anomaly index is calculated based on the four types of data: the number of users, CPU usage, the last timestamp of the file / etc / passwd, and the last timestamp of the file / etc / crontab for each isomer. The characteristic is that the weighted anomaly index s obtained by the T-th information judgment is calculated. T :

[0051] s T =w·γ T ;

[0052] Furthermore, the weighted anomaly index s obtained by the T-th information judgment is T Integrate into the current anomaly index S i , characterized in that the current abnormality index S is calculated i :

[0053]

[0054] Set the current abnormal index threshold to ρ, for S={S1,S2,...,S n}, determine each isomer regularly and in turn, if S i >ρ, then the heterogeneous executor numbered i is judged to be abnormal, and it is taken offline for cleaning and restored to its initial value S i =0.

[0055] Those skilled in the art will readily conceive of other embodiments of the present application after considering the specification and practicing the contents disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art that are not disclosed in this application.

[0056] It will be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A mimetic WAF isomer information adjudication method based on outlier detection, characterized in that: The method comprises the following steps: (1) Establish an information arbitration decision model, which is specifically represented by a 10-tuple M; the expression of the 10-tuple M is: M=(n,t,U,C,Pa,Cr,γ,w,s,S); Where n is the number of heterogeneous executors of the mimic WAF, and t is the total number of model runs; 1≤T≤t is the number of users of each heterogeneous executor in the Tth information arbitration; The Tth information determines the CPU usage of each heterogeneous executor; It is the last modification timestamp of the file / etc / passwd of each executable in the Tth information decision; The timestamp of the last modification of the file / etc / crontab of each executable for the Tth information judgment; represents the information anomaly index of each type of information isomer in the Tth information judgment; w=(w U ,w C ,w Pa ,w pa ) is the weight coefficient of each type of abnormal index; represents the weighted anomaly index of each isomer in the Tth information judgment, S={S1,S2,...,S n } is the current set of anomaly indices of n isomers, S i The initial value of is 0; (2) Using the analytic hierarchy process, we construct a system model based on the number of heterogeneous users U, CPU usage C, the last modification timestamp Pa of the file / etc / passwd, and the last modification timestamp Cr of the file / etc / crontab; (3) Regularly conduct T information decisions on n isomers; The weighted anomaly index s obtained from the T-th information judgment T Integrate into the current anomaly index S.

2. The method for adjudicating isomer information of a mimetic WAF based on outlier detection according to claim 1, characterized in that: The step (2) specifically includes the following sub-steps: (2.1) Establishing a hierarchical model The structural model includes three levels: goal level, decision level and program level; The target layer is used to solve the abnormal index of the isomer, that is, to calculate whether the isomer is in an abnormal state through monitoring the isomer state and information judgment; The decision layer uses four decision variables: / etc / passwd last modification timestamp Pa, / etc / crontab last modification timestamp Cr, user number U and CPU usage C, which are key indicators for monitoring the status of heterogeneous data. The solution layer determines whether the heterogeneous state is abnormal by monitoring the heterogeneous state information, including the last modification timestamp Pa of / etc / passwd, the last modification timestamp Cr of / etc / crontab, the number of users U and the CPU usage C. The monitoring of the isomer status information adopts an outlier detection and information arbitration method, and performs voting calculations based on the status information of multiple isomers to prevent misjudgment of the status information of a single isomer, and promptly discover and clean up isomers in abnormal states; (2.2) Constructing the judgment matrix For the four indicators D1, D2, D3, and D4 at the decision-making level, the importance of the isomer anomaly index is determined by comparing them two by two: A=(a ij ) 4×4 ,a ij >0, If D i and D j Equally important, a ij =1; if D i than D j Important, a ij ∈{2,3,4,5,6,7,8,9}; if D i than D j Not important, a ij ∈{1 / 2,1 / 3,1 / 4,1 / 5,1 / 6,1 / 7,1 / 8,1 / 9}; (2.3) Perform consistency check |A-γE|=0, calculate the maximum eigenvalue γ max , further calculate the consistency index CI: Randomly construct k judgment matrices A1, A2, ..., A k , calculate their respective consistency indices CI1, CI2, ..., CI k , further calculate the random consistency index RI: Calculate the consistency ratio CR: If CR<0.1, the consistency test is passed, otherwise return to step (2.2) to reconstruct the judgment matrix; (2.4) Calculate the weight coefficient Calculate the weight vector using the arithmetic mean method: Get the weight coefficient of each type of abnormal index w=(w U ,w C ,w Pa ,w pa )=(w1,w2,w3,w4).

3. The method for adjudicating isomer information of a mimetic WAF based on outlier detection according to claim 1, characterized in that: The step (3) specifically includes the following sub-steps: (3.1) For the number of users in each isomer, calculate the user number anomaly index through information judgment, and solve the value set U with the largest number of user numbers in the Tth information judgment. maxT ; If the number of users is the same, then U maxT =0; Calculate the user number anomaly index obtained by the T-th information judgment Among them, if but otherwise (3.2) For the CPU usage of each isomer, the CPU usage anomaly index is calculated through information arbitration, which sets the CPU usage threshold as η and calculates the CPU usage anomaly index obtained by the Tth information arbitration. Among them, if but otherwise (3.3) For the last timestamp of the file / etc / passwd of each isomer, the last timestamp of the file / etc / passwd is calculated by information arbitration, which sets the outlier deviation threshold as λ, where For the Tth information ruling, For Pa T The standard deviation of For Pa T The average value of n isomers is calculated by the following formula Calculate the abnormal index of the last timestamp of the file / etc / passwd obtained by the T-th information adjudication: Among them, if but otherwise (3.4) For the last timestamp of the file / etc / crontab of each isomer, the anomaly index of the last timestamp of the file / etc / crontab is calculated by information judgment, which sets the outlier deviation threshold as τ. For the Tth information ruling, Cr T The standard deviation of Cr T The average value of n isomers is calculated by the following formula Calculate the abnormal index of the last timestamp of the file / etc / passwd obtained by the T-th information adjudication: Among them, if but otherwise (3.5) The anomaly index is calculated based on the four types of data: the number of users, CPU usage, the last timestamp of the file / etc / passwd, and the last timestamp of the file / etc / crontab for each isomer. The characteristic is that the weighted anomaly index s obtained by the T-th information judgment is calculated. T : s T =w·γ T 。 4. The method for adjudicating isomer information of a mimetic WAF based on outlier detection according to claim 1, characterized in that: The weighted anomaly index s in step (4) T Integrate into the current anomaly index S i , calculate the current abnormal index S i The expression is as follows:

5. The method for adjudicating isomer information of a mimetic WAF based on outlier detection according to claim 1, characterized in that: The information adjudication decision model sets the current abnormal index threshold as ρ, for S = {S1, S2, ..., S n }, determine each isomer regularly and in turn, if S i >ρ, then the heterogeneous executor numbered i is judged to be abnormal, and it is taken offline for cleaning and restored to its initial value S i =0.

Images