A method for building a trusted adjudication environment in a mimic WAF

Abstract

This invention discloses a method for constructing a trusted adjudication environment within a mimetic WAF. By introducing heterogeneity and credibility metrics to quantify the heterogeneity between executors and the reliability of their adjudication, the method selects executors with high heterogeneity and low vulnerability for adjudication, continuously removing untrusted and low-heterogeneity executors to construct a trusted adjudication environment and ensure the reliability of adjudication results. This method does not increase the system's software and hardware overhead, resulting in a low defense cost. It can effectively reduce the likelihood of common-mode vulnerabilities in adjudication executors, thereby improving the security of the mimetic defense system.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, relates to the field of mimicry defense technology, and specifically relates to a method for constructing a trusted adjudication environment in a mimicry WAF. Background Art

[0002] Mimicry defense is a dynamic, proactive defense technology that increases the cost of attack for attackers by deploying heterogeneous, dynamic, and redundant systems and defense strategies. In a general mimicry architecture, multiple heterogeneous executors perform their own arbitration. The mimicry controller, based on a deployed arbitration fusion strategy, combines the arbitration results of individual executors to output a final decision. Therefore, the reliability of individual executor arbitration results and the arbitration fusion strategy are crucial. However, in an untrusted arbitration environment, individual executors may produce inaccurate arbitration results due to inherent software and hardware vulnerabilities or external attacks. Incorrect executor outputs may result in the passage of attack traffic, posing a significant threat to system security and significantly reducing the effectiveness of mimicry defense. Therefore, it is crucial to build a trusted arbitration environment and select highly trusted executors for arbitration. This, to a certain extent, determines the performance of mimicry defense applications. Summary of the Invention

[0003] The purpose of the present invention is to address the deficiencies of the existing technology and provide a method for constructing a trusted adjudication environment in a pseudo-WAF.

[0004] The objective of the present invention is achieved through the following technical solution: a method for constructing a trusted adjudication environment in a mimic WAF, the method comprising the following steps:

[0005] (1) Generate the set E of available WAF heterogeneous executables. The specific steps are as follows:

[0006] (1.1) Deploy M servers S = {s i |i=1,2,...,M}, where s i is the i-th server, and in s i Deploy heterogeneous service platforms on

[0007] (1.2) On each server i Deploy N microcontainers f = {t j |j=1, 2, ..., N}, where t j Represents the jth microcontainer, at t j The heterogeneous container platform is deployed on the platform; the available heterogeneous executable set consists of multiple executables built by the heterogeneous container platform, denoted as E = {e k |i=1,2,...,M*N},where e k is the kth heterogeneous executive;

[0008] (2) Based on the types of heterogeneous components deployed between the executors, calculate the heterogeneity between the executors in E, denoted as H = {h i，j |0≤h i，j ≤1, i=1, 2, ..., M*N, j=1, 2, ..., M*N}, the correlation between heterogeneity and execution body is recorded as L h ={(i, j, h i，j )|i=1, 2, ..., M*N, j=1, 2, ..., M*N};

[0009] (3) Calculate the credibility of each executive body. The specific steps are as follows:

[0010] (3.1) Assume that the execution body e i Completely credible, its credibility i =1;

[0011] (3.2) Inject test traffic, schedule each executor, use the consensus voting algorithm to obtain the final decision result, compare the decision results of each executor, find the arbitrator with inconsistent results, and reduce its credibility according to the variation coefficient α;

[0012] (3.3) Repeat step (3.2) k times to get the latest credibility, denoted as R = {r i |i=1,2,...,M*N}, the relationship between credibility and execution body is recorded as L r ={(i, r i )|i=1, 2, ..., M*N};

[0013] (4) Select B highly heterogeneous and highly reliable executors to join the trusted adjudication set ER and build a trusted adjudication environment. The specific steps are as follows:

[0014] (4.1) According to the heterogeneity h i，j Permutation L h , filter out isomer combinations with heterogeneity lower than the threshold μ1, and generate an ordered set of heterogeneity Where A=M*N,u k The heterogeneity association relationship of the execution body with heterogeneity ranking k;

[0015] (4.2) According to the credibility r i Permutation L r , filter out isomers whose credibility is lower than the threshold μ2, and generate a credibility ordered set UR={u k |k=1, 2,...,W}, where W≤M*N, u k The credibility association relationship of the executor with credibility ranking k;

[0016] (4.3) Starting from the first element in UH, check u in turnk Associated executable e i and executive body e j Are the credibility rankings of all within ranking B? If so, e i and e i Join the trusted decision set ER, otherwise join the self-cleaning execution set EU;

[0017] (4.4) When the number of ER elements is B or the UH traversal is completed, the checking operation is terminated; if the number of ER elements is lower than the threshold μ3 at this time, the cleaning operation is performed on the EU, and steps (2) to (4) are repeated until the number of ER elements is not lower than the threshold μ3;

[0018] (5) Traffic is adjudicated in a trusted adjudication environment. Each executor makes a decision on whether to pass or fail, and uses a consistent voting algorithm to calculate and output the final decision result. Based on the decision result, it is decided whether to forward the traffic.

[0019] Furthermore, in the step (1.1), the heterogeneous service platform includes an operating system, a virtualization tool, and microcontainer software.

[0020] Furthermore, in the step (1.2), the heterogeneous container platform includes an operating system, a WAF platform, a database, and a rule set.

[0021] Furthermore, in step (2), the degree of heterogeneity between the two executors is calculated according to formula (1):

[0022]

[0023] Where D is the number of deployed heterogeneous components, P i，j For the executive body e i and e j The difference of the dth heterogeneous component; α d represents the influence weight of the dth heterogeneous component, satisfying:

[0024]

[0025] When i=j, the two isomers are completely isomorphic, h i，j =0; when i≠j, h i，j =h j，i , are represented as executive body executive body e i and e j The degree of heterogeneity between .

[0026] Furthermore, in step (3.2), according to formula (3), its credibility is reduced:

[0027] r′ i =(1-α)*r i (3)

[0028] where r′ i For the executive body e i Adjusted reliability, α is the coefficient of variation, r i For the executive body e i Credibility before adjustment.

[0029] Furthermore, in the steps (4.1) and (4.2), the ordering of heterogeneity and credibility is in descending order, and the ordered set of heterogeneity is to remove the equivalent heterogeneous values ​​h i，j and h j，i The number of elements in the set after , does not exceed

[0030] Compared with existing technologies, the present invention offers the following advantages: by selecting highly trusted, highly heterogeneous executors for arbitration, and eliminating untrusted and low-heterogeneity executors, a trusted arbitration environment is constructed, resulting in reliable arbitration results. This method balances trustworthiness and heterogeneity, effectively reducing the likelihood of common-mode vulnerabilities in arbitration executors at a minimal defense cost, and thus improving the security of the mimicry defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a flowchart for building a trusted adjudication environment in a mimic WAF;

[0032] Figure 2 This is a schematic diagram of the application of the trusted adjudication environment in the mimic WAF. DETAILED DESCRIPTION

[0033] The present invention will be described in detail below with reference to the accompanying drawings. Unless there is any conflict, the features of the following embodiments and implementations may be combined with each other.

[0034] The present invention provides a method for constructing a trusted adjudication environment in a pseudo-WAF. By selecting highly trusted and highly heterogeneous executors to participate in adjudication and cleaning untrusted and low-heterogeneous executors, a trusted adjudication environment is constructed and a trusted adjudication result is output.

[0035] like Figure 1 and Figure 2 As shown in FIG, a method for constructing a trusted adjudication environment in a mimic WAF according to the present invention includes the following steps:

[0036] (1) Generate a set of available WAF heterogeneous executables E and perform heterogeneous processing on the executables. The specific steps are as follows:

[0037] (1.1) Deploy M servers S = {s i |i=1,2,...,M}, where s i is the i-th server, and on server si Deploy heterogeneous service platforms on the same platform to make them functionally equivalent;

[0038] (1.2) On each server i Deploy N microcontainers T = {t j |j=1, 2, ..., N}, where t j Represents the Jth microcontainer, in microcontainer t j The heterogeneous container platform is deployed on the network to build functionally equivalent executables. The set of available heterogeneous executables consists of multiple constructed executables, denoted as E = {e k |i=1,2,...,M*N},where e k is the kth heterogeneous executive;

[0039] (2) Based on the types of heterogeneous components deployed between the executors, the degree of heterogeneity between the executors in the executor set E is calculated, denoted as H = {h i，j |0≤h i，j ≤1, i=1, 2, ..., M*N, j=1, 2, ..., M*N}, the correlation between heterogeneity and execution body is recorded as L h ={(i, j, h i，j )|i=1, 2, ..., M*N, j=1, 2, ..., M*N};

[0040] (3) Calculate the credibility of each executor. This indicator can reflect the trustworthiness of the executor's decision-making results. The specific steps are as follows:

[0041] (3.1) Assume that the execution body e i Completely credible, its credibility k =1;

[0042] (3.2) Inject test traffic, schedule each executor, use the consensus voting algorithm to obtain the final decision result, compare the decision results of each executor, find the arbitrator with inconsistent results, and reduce its credibility according to the variation coefficient α;

[0043] (3.3) Repeat step (3.2) k times to get the latest credibility, denoted as R = {r i |i=1,2,...,M*N}, the relationship between credibility and execution body is recorded as L r ={(i, r i )|i=1, 2, ..., M*N};

[0044] (4) The trusted scheduling module selects B highly heterogeneous and highly trusted executors to join the trusted decision set ER and build a trusted decision environment. The specific steps are as follows:

[0045] (4.1) According to the heterogeneity h i，jPermutation L h , filter out isomer combinations with heterogeneity lower than the threshold μ1, and generate an ordered set of heterogeneity Where A=M*N,u k The heterogeneity association relationship of the execution body with heterogeneity ranking k;

[0046] 4.2) According to the credibility r i Permutation L r , filter out isomers whose credibility is lower than the threshold μ2, and generate a credibility ordered set UR={u k |k=1, 2,...,W}, where W≤M*N, u k The credibility association relationship of the executor with credibility ranking k;

[0047] (4.3) Starting from the first element in the heterogeneous ordered set UH, check u in turn k Associated executable e i and executive body e j Are the credibility rankings of all within ranking B? If so, e i and e j Join the trusted decision set ER, otherwise join the self-cleaning execution set EU;

[0048] (4.4) When the number of elements in the trusted decision set ER is B or the traversal of the heterogeneous ordered set UH is completed, the check operation is terminated. If the number of elements in the trusted decision set ER is lower than the threshold μ3, the cleaning operation is performed on the self-cleaning execution body set EU, that is, eu i Re-perform the isomerization process and repeat steps (2), (3), and (4) until the number of elements in the trusted decision set ER is not less than the threshold μ3.

[0049] (5) Traffic is adjudicated in a trusted adjudication environment. Each executor makes a decision on whether to pass or fail, and uses a consistent voting algorithm to calculate and output the final decision result. Based on the decision result, it is decided whether to forward the traffic.

[0050] Furthermore, in the step (1.1), the heterogeneous service platform includes an operating system, a virtualization tool, and microcontainer software.

[0051] Furthermore, in the step (1.2), the heterogeneous container platform includes an operating system, a WAF platform, a database, and a rule set.

[0052] Furthermore, in step (2), the degree of heterogeneity between the two executors is calculated according to formula (1):

[0053]

[0054] Where D is the number of deployed heterogeneous components, Pi，j For the executive body e i and e j The difference of the dth heterogeneous component is 0 if they are the same and 1 if they are different; α d It represents the influence weight of the dth heterogeneous component. The weight is determined according to the actual situation and satisfies:

[0055]

[0056] In particular, when i=j, the two isomers are completely isomorphous, h i，j =0; when i≠j, h i，j =h j，i , are represented as executive body executive body e i and e j The degree of heterogeneity between .

[0057] The higher the heterogeneity, the lower the possibility of common mode vulnerabilities between executors and the higher the security level.

[0058] Furthermore, in step (3.2), according to formula (3), its credibility is reduced:

[0059] r′ i =(1-α)*r i (3)

[0060] where r′ i For the executive body e i Adjusted reliability, α is the coefficient of variation, r i For the executive body e i Credibility before adjustment.

[0061] Furthermore, in the steps (4.1) and (4.2), the ordering of heterogeneity and credibility is in descending order, and the ordered set of heterogeneity is to remove the equivalent heterogeneous values ​​h i，j and h j，i The number of elements in the set after , does not exceed Where A=M*N.

[0062] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0063] The above embodiments are intended only to illustrate the design concepts and features of the present invention. Their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The scope of protection of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design concepts disclosed in the present invention are within the scope of protection of the present invention.

Claims

1. A method for constructing a trusted adjudication environment in a mimic WAF, characterized in that: The steps include: (1) Generate the set E of available WAF heterogeneous executables. The specific steps are as follows: (1.1) Deploy M servers S = {s i |i=1,2,…,M}, where s i is the i-th server, and in s i Deploy heterogeneous service platforms on (1.2) On each server i Deploy N microcontainers T = {t j |j=1,2,…,N}, where t j Represents the jth microcontainer, at t j The heterogeneous container platform is deployed on the platform; the available heterogeneous executable set consists of multiple executables built by the heterogeneous container platform, denoted as E = {e i |i=1,2,…,M*N}, where e i is the i-th heterogeneous executive; (2) Based on the types of heterogeneous components deployed between the executors, calculate the heterogeneity between the executors in E, denoted as H = {h i,j |0≤h i,j ≤1,i=1,2,…,M*N,j=1,2,…,M*N}, the correlation between heterogeneity and execution body is denoted as L h ={(i,j,h i,j )|i=1,2,…,M*N,j=1,2,…,M*N}; (3) Calculate the credibility of each executive body. The specific steps are as follows: (3.1) Assume that the execution body e i Completely credible, its credibility i =1; (3.2) Inject test traffic, schedule each executor, use the consensus voting algorithm to obtain the final decision result, compare the decision results of each executor, find the arbitrator with inconsistent results, and reduce its credibility according to the variation coefficient α; (3.3) Repeat step (3.2) n times to get the latest credibility, denoted as R = {r i |i=1,2,…,M*N}, the relationship between credibility and execution body is recorded as L r ={(i,r i )|i=1,2,…,M*N}; (4) Select B highly heterogeneous and highly reliable executors to join the trusted adjudication set ER and build a trusted adjudication environment. The specific steps are as follows: (4.1) According to the heterogeneity h i,j Permutation L h , filter out isomer combinations with heterogeneity lower than the threshold μ1, and generate an ordered set of heterogeneity Where A=M*N,u k The heterogeneity association relationship of the execution body with heterogeneity ranking k; (4.2) According to the credibility r i Permutation L r , filter out isomers whose credibility is lower than the threshold μ2, and generate a credibility ordered set UR={u k |k=1,2,…,W}, where W≤M*N, u k The credibility association relationship of the executor with credibility ranking k; (4.3) Starting from the first element in UH, check u in turn k Associated executable e i and executive body e j Are the credibility rankings of all within ranking B? If so, e i and e j Join the trusted decision set ER, otherwise join the self-cleaning execution set EU; (4.4) When the number of ER elements is B or the UH traversal is completed, the checking operation is terminated; if the number of ER elements is lower than the threshold μ3 at this time, the cleaning operation is performed on the EU, and steps (2) to (4) are repeated until the number of ER elements is not lower than the threshold μ3; (5) Traffic is adjudicated in a trusted adjudication environment. Each executor makes a decision on whether to pass or fail, and uses a consistent voting algorithm to calculate and output the final decision result. Based on the decision result, it is decided whether to forward the traffic.

2. The method for constructing a trusted adjudication environment in a mimic WAF according to claim 1, wherein: In the step (1.1), the heterogeneous service platform includes an operating system, a virtualization tool, and microcontainer software.

3. The method for constructing a trusted adjudication environment in a mimic WAF according to claim 1, wherein: In the step (1.2), the heterogeneous container platform includes an operating system, a WAF platform, a database, and a rule set.

4. The method for constructing a trusted adjudication environment in a mimic WAF according to claim 1, wherein: In step (2), the degree of heterogeneity between the two executors is calculated according to formula (1): Where D is the number of deployed heterogeneous components, P i,j For the executive body e i and e j The difference of the dth heterogeneous component; α d represents the influence weight of the dth heterogeneous component, satisfying: When i=j, the two isomers are completely isomorphic, h i,j =0; when i≠j, h i,j =h j,i , are all represented as executive bodies e i and e j The degree of heterogeneity between .

5. The method for constructing a trusted adjudication environment in a mimic WAF according to claim 1, wherein: In step (3.2), according to formula (3), its credibility is reduced: r′ i ＝(1-α)*r i (3) where r′ i For the executive body e i Adjusted reliability, α is the coefficient of variation, r i For the executive body e i Credibility before adjustment.

6. The method for constructing a trusted adjudication environment in a mimic WAF according to claim 1, wherein: In the steps (4.1) and (4.2), the ordering of heterogeneity and credibility is in descending order. The ordered set of heterogeneity is the set with equivalent heterogeneity values ​​h removed. i,j and h j,i The number of elements in the set after , does not exceed

Images