Mimicry defense method, system and equipment based on lightweight architecture, medium and product

Abstract

The invention relates to the technical field of network space security, in particular to a mimicry defense method, system and device based on a lightweight architecture, a medium and a product, and the method comprises the steps: obtaining an input data message; service processing is carried out on the data message through the first execution body in the online state to obtain a first result, the first result is transmitted to the second execution body in the silent state, and the second execution body and the outside are in an isolated state; calling a second executor to perform service processing on the obtained data message to obtain a second result; judging whether the first result is consistent with the second result or not through a second executor, and if not, determining that the judgment result is the second result; otherwise, determining that the judgment result is any one of the first result and the second result; outputting a judgment result through the second execution body; by deploying the two execution body modules, the system processing flow is reduced, the occupation of system resources is reduced, the logic is simple, and the processing efficiency of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security technology, and in particular to a mimicry defense method, system, device, medium and product based on a lightweight architecture. Background Art

[0002] The intrinsic security mimicry defense architecture, namely mimicry defense (MD), is an active defense behavior. In general, the main components of the fully quantitative intrinsic security mimicry defense architecture include input agents, redundant heterogeneous executor pools, arbiters, and schedulers. The redundant heterogeneous executor pool contains several redundant executors with equivalent functions and different structures, and is divided into online and offline categories. The full-scale mimicry defense system architecture has many modules, among which the executor pool theoretically requires at least four or more executors; in addition, the multi-mode arbiter's decision calculation algorithm and the multi-executor dynamic scheduling algorithm of the scheduler have high processing logic complexity. It can be seen that the deployment of more modules leads to more occupation of system resources such as computing and storage, and the complex algorithm logic reduces the system operation efficiency. Summary of the invention

[0003] The purpose of this application is to provide a mimetic defense method, system, device, medium and product based on a lightweight architecture. By deploying two execution modules, the system processing flow is reduced, the occupation of system resources is reduced, and the logic is simple, which improves the processing efficiency of the system.

[0004] In a first aspect, a mimicry defense method based on a lightweight architecture is provided, wherein the lightweight architecture includes a first execution body and a second execution body connected in series,

[0005] The mimicry defense method based on lightweight architecture includes:

[0006] Get the input data message;

[0007] Performing business processing on the data message through the first execution body in the online state to obtain a first result, and transmitting the first result to the second execution body in the silent state, where the second execution body is isolated from the outside;

[0008] Calling the second execution body to perform business processing on the obtained data message to obtain a second result;

[0009] determining, by the second execution body, whether the first result and the second result are consistent; if they are inconsistent, determining the decision result to be the second result; otherwise, determining the decision result to be any one of the first result and the second result;

[0010] The decision result is outputted by the second execution body.

[0011] In a preferred example, the present application may be further configured as follows: after calling the second execution body to perform service processing on the obtained data message to obtain the second result, the configuration further includes:

[0012] When the second execution body determines that the first result has not been received within a preset time period, outputting the second result;

[0013] When the second execution body receives the first result, a step of determining whether the first result and the second result are consistent is performed by the second execution body.

[0014] In a preferred example, the present application may be further configured as follows: the first execution body and the second execution body are heterogeneous execution bodies, and the method further includes:

[0015] Determining, by the second execution body, whether a preset condition is met;

[0016] If the preset condition is met, calling the second execution body to perform the scheduling operation;

[0017] The scheduling operation includes: after performing a cleaning operation on the first execution body, exchanging the states of the first execution body and the second execution body, so as to use the first execution body as a new second execution body and the second execution body as a new first execution body;

[0018] The preset condition includes any of the following:

[0019] When the second executor determines that the first result and the second result are inconsistent;

[0020] When it is determined by the second executor that the first result has not been received within the preset time period;

[0021] When the current moment reaches the preset exchange cycle.

[0022] In a preferred example, the present application may be further configured as follows: after calling the second execution body to perform the scheduling operation, the following further includes:

[0023] Performing business processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state;

[0024] Calling the new second execution body to perform business processing on the obtained data message to obtain a fourth result;

[0025] The second result is verified by a new second execution body based on the third result and the fourth result.

[0026] In a preferred example, the present application may be further configured as follows: before the second execution body determines whether the first result and the second result are consistent, the following further includes:

[0027] Get the output mode;

[0028] If the output mode is the priority output mode, outputting the second result through the second execution body;

[0029] If the output mode is a normal output mode, a step of determining, by the second execution body, whether the first result and the second result are consistent is performed.

[0030] In a preferred example, the present application may be further configured as follows: calling the second execution body to perform service processing on the obtained data message to obtain a second result, including:

[0031] Calling the second execution body to monitor the network interface of the first execution body to obtain a data message by bypassing the replication mode, and performing business processing on the obtained data message to obtain the second result;

[0032] or,

[0033] Using the input agent to copy the data message to obtain a copied data message; calling the second execution body to perform business processing on the copied data message to obtain the second result;

[0034] or,

[0035] The second execution body is called to perform business processing on the data message sent by the first execution body to obtain the second result.

[0036] In a second aspect, a mimicry defense system based on a lightweight architecture is provided, wherein the lightweight architecture includes a first actuator and a second actuator connected in series,

[0037] The mimicry defense system based on lightweight architecture includes:

[0038] A data message acquisition module, used to acquire input data messages;

[0039] A first execution module, configured to perform business processing on a data message through the first execution body in an online state, obtain a first result, and transmit the first result to the second execution body in a silent state, wherein the second execution body is isolated from the outside;

[0040] The second execution module is used to call the second execution body to perform business processing on the obtained data message to obtain a second result; determine whether the first result and the second result are consistent through the second execution body, if not, determine the decision result to be the second result; otherwise, determine the decision result to be any one of the first result and the second result; output the decision result through the second execution body.

[0041] In a third aspect, an electronic device is provided, including:

[0042] one or more processors;

[0043] Memory;

[0044] One or more applications, wherein one or more applications are stored in a memory and configured to be executed by one or more processors, and one or more programs are configured to: perform operations corresponding to the method shown in any possible implementation of the first aspect.

[0045] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded by a processor and executes the steps of the method shown in any possible implementation of the first aspect.

[0046] In a fifth aspect, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, operations corresponding to the method shown in any possible implementation manner in the first aspect are implemented.

[0047] In summary, the mimicry defense method based on a lightweight architecture provided by the present application has the following beneficial technical effects: constructing a lightweight architecture, which includes a first executor in an online state and a second executor in an isolated state from the outside in series, wherein the first executor in the online state performs business processing on the data message to obtain a first result, and transmits the first result to the second executor in a silent state; the second executor performs business processing on the obtained data message to obtain a second result, and makes a decision based on the first result and the second result; the present application deploys two executor modules, which reduces the system processing flow, reduces the occupancy of system resources, and has simple logic, thereby improving the processing efficiency of the system.

[0048] In addition, the present application also provides a mimicry defense system, equipment, medium and product based on a lightweight architecture, which has the above-mentioned beneficial technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 A schematic diagram of the fully quantified endogenous security mimicry defense architecture of the relevant technologies;

[0051] Figure 2 An overall schematic diagram of a lightweight mimicry defense deployment method provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of a flow chart of a mimicry defense method based on a lightweight architecture provided in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of a specific application scenario provided by an embodiment of the present application;

[0054] Figure 5 A schematic diagram of the structure of a mimicry defense system based on a lightweight architecture provided in an embodiment of the present application;

[0055] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make modifications to the present embodiment without any creative contribution as needed, but as long as they are within the scope of the present application, they are protected by the patent law.

[0057] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0058] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0060] In cyberspace, the endogenous security mimicry defense architecture greatly improves the system's ability to deal with security risks brought by unknown vulnerabilities and unknown backdoors, effectively ensures the safe and stable operation of data communications and business processing, and provides a universal theory and method for dealing with unknown network threats.

[0061] See also Figure 1 , Figure 1 The schematic diagram of the fully quantized endogenous security mimetic defense architecture of the related technology is shown in FIG. The main components include an input agent, a redundant heterogeneous executor pool, a arbiter, and a scheduler. The redundant heterogeneous executor pool contains several redundant executors with equivalent functions and different structures, and is divided into two categories: online and offline. The operation mechanism of the architecture is described as follows: When external input data enters the system, it first passes through the input agent module. The input agent copies the input data in multiple copies, and the number of copies is equal to the number of online executors. After that, the input agent distributes the copied data to each online executor for specific business processing. After the business processing of each executor receiving the data is completed, the generated output result is sent to the arbiter. The arbiter performs a decision calculation on the received executor data based on a multi-mode decision algorithm. Under normal circumstances, since the functions of each executor are equivalent, the business processing results they send to the arbiter should be consistent. In this case, the decision calculation is passed, and the arbiter arbitrarily selects a business processing result as the final decision result and outputs it to the backend process.

[0062] If executor N suffers an unknown attack, causing errors in the output results of its business processing, then when the arbiter performs the arbitration calculation, it will find that only the output results of executor N are different from the data of other executors, and thus conclude that executor N is abnormal. The arbiter will discard the data of executor N, select a business processing result from other normal executors as the arbitration result and output it to the backend, and at the same time send a message to the scheduler to inform it that executor N is abnormal. The scheduler will perform a cleaning operation to take executor N offline, and then randomly select a new executor from the offline executors to go online to ensure that the number of online executors remains unchanged.

[0063] The full-scale mimetic defense system architecture has many modules, requiring input agents, arbitrators, schedulers, and redundant heterogeneous executor pools. Theoretically, at least four or more executors are required in the executor pool; in addition, the processing logic complexity of the arbitrator's multi-mode decision calculation algorithm and the scheduler's multi-executor dynamic scheduling algorithm is relatively high.

[0064] In view of the above situation, firstly, the deployment of more modules leads to more occupation of system resources such as computing and storage; secondly, the complex algorithm logic increases the difficulty of software implementation and reduces the system operation efficiency; thirdly, more process processing will affect the real-time performance of the business; finally, the heavy system architecture brings certain difficulties to the actual environment deployment.

[0065] Therefore, the full-scale endogenous security mimicry defense architecture has certain limitations when deployed in actual applications. For scenarios with limited hardware resources and lightweight equipment, such as smart connected car on-board terminals and small drone on-board terminals, the applicability of the system architecture is significantly restricted.

[0066] In response to the above problems, this application proposes a lightweight system based on the idea of ​​endogenous security mimicry defense, which specifically solves the problems that are difficult to solve under the traditional architecture, broadens the practical application scenarios of the endogenous security mimicry defense theory, and provides a new method for the practice of the endogenous security mimicry defense theory. First, the independent input proxy module, arbitrator, and scheduler are cancelled, and the redundant heterogeneous executor pool is replaced by a dual redundant heterogeneous executor. After the modules are streamlined, the system processing flow is reduced and the occupation of system resources is reduced; secondly, since only two executors are deployed, the number of redundant heterogeneous executors is reduced, and the logical complexity of the arbitration algorithm and the dynamic scheduling algorithm is simplified, which greatly reduces the difficulty of software implementation and improves the system processing efficiency; finally, the lightweight deployment retains the core concepts of the endogenous security mimicry defense theory such as "redundant heterogeneous executors", "arbitration calculations", and "dynamic scheduling" to the greatest extent, ensuring its ability to deal with unknown threats.

[0067] Therefore, the lightweight mimetic defense deployment method proposed in this application reduces the consumption of system resources, reduces the difficulty of algorithm implementation, and improves processing efficiency while ensuring its ability to resist unknown network threats. It provides a solution for lightweight application scenarios and a new idea and method for the theoretical practice of endogenous security mimetic defense.

[0068] In order to better understand and illustrate the solution of the embodiment of the present application, see Figure 2 , Figure 2 The overall schematic diagram of a lightweight mimicry defense deployment method provided for the embodiment of the present application. Compared with the full mimicry defense architecture, this solution cancels the independent input proxy module, arbitrator, and scheduler, changes the multi-redundant heterogeneous executor pool to a dual executor mode, and changes each executor from a parallel structure to a series structure.

[0069] The first executor (executor 1) is in an online state, responsible for directly receiving external input data packets and carrying the actual business processing function, that is, after receiving the external input data packets, it performs the normal business processing flow and generates the first processed result (business output result) and sends it to the second executor (executor 2).

[0070] Executor 2 is in a silent state. In this state, the execution body is isolated from the outside of the entire system, that is, the outside cannot access, log in, or perform other communication and interaction operations on the execution body. After the execution body 2 obtains the data message, it synchronously performs the internal business processing flow. The way for execution body 2 to obtain the data message can be to actively monitor the network interface of execution body 1 to receive the message, and obtain a copy of the external input business-related data message through bypass replication; or, use the input agent to copy the data message to obtain the copied data message; or, the execution body 1 forwards the data message after receiving it, and the embodiment of the present application is no longer limited to this.

[0071] Executor 2 performs arbitration calculation on the second result generated by the operation and the first result output by executor 1, outputs the arbitration result and passes it to the subsequent process.

[0072] In one embodiment, the present application provides a mimicry defense method based on a lightweight architecture, such as Figure 3 As shown, the method provided in the embodiment of the present application can be executed by an electronic device, the electronic device can be a server or a terminal device, the terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent networked car terminal, a small drone terminal, etc., but is not limited to this. The embodiment of the present application is not limited here. The lightweight architecture includes a first actuator and a second actuator connected in series. The method includes:

[0073] S101, obtaining input data message;

[0074] Among them, an external input data message is obtained, and the data message includes data. Of course, if the electronic device is provided with multiple service processing types, it may also include a processing service type.

[0075] Exemplarily, the remote service cloud platform can send control instructions to the vehicle through T-BOX, such as vehicle start, vehicle door opening and closing, vehicle window opening and closing, etc. At this time, the electronic device is T-BOX, and the data message includes parsed service type and control data, so that T-BOX can perform data parsing and message format conversion after receiving the control message sent. It should be noted that different electronic devices may have different service types, which can be adjusted according to actual conditions. The above is only an example and is not limited to this embodiment.

[0076] S102, performing business processing on the data message by a first execution body in an online state to obtain a first result, and transmitting the first result to a second execution body in a silent state, wherein the second execution body is isolated from the outside;

[0077] S103, calling the second execution body to perform business processing on the obtained data message to obtain a second result;

[0078] The first execution body in the online state is the execution body displayed externally. What is exposed externally is the first execution body. When the system is attacked from the outside, since what is exposed externally is the first execution body, the attack target is generally the first execution body.

[0079] The second execution body in the silent state is isolated from the outside and shielded inside the system. Therefore, it is generally not attacked or interfered by the outside. At this time, the second result obtained by the second execution body has a higher credibility.

[0080] In some embodiments, the second result can be obtained in a variety of ways:

[0081] Method 1: calling the second execution body to monitor the network interface of the first execution body to obtain the data message by bypassing the replication mode, and performing business processing on the obtained data message to obtain the second result.

[0082] The second execution body actively monitors the network interface of the first execution body for receiving messages. When it is found that the first execution body receives a message, it obtains a copy of the externally input business-related data message through bypass replication and simultaneously performs the internal business processing flow.

[0083] Method 2: using the input proxy to copy the data message to obtain the copied data message; calling the second execution body to perform business processing on the copied data message to obtain the second result.

[0084] Among them, an input agent is added. When the data message is transmitted to the input agent, the input agent will copy the data. Since it only includes the first execution body and the second execution body, only one copy is needed at this time.

[0085] Method three: calling the second execution body to perform business processing on the data message sent by the first execution body to obtain the second result.

[0086] In one case, after the first execution body receives the data message, it immediately sends it to the second execution body; in another case, after obtaining the first result, the first execution body sends the first result and the data message to the second execution body at the same time; of course, there may be other times for sending message data, which are no longer limited in the embodiments of the present application, and users can set them according to actual needs.

[0087] It is understandable that, in addition to the above three implementation methods, other technologies may also be used for implementation, which are not limited here.

[0088] S104, determining, by the second execution body, whether the first result and the second result are consistent, if they are inconsistent, determining the decision result to be the second result; otherwise, determining the decision result to be any one of the first result and the second result;

[0089] The decision result is outputted by the second execution body.

[0090] For external objects, only the online first executor interacts directly with it, and is externally manifested as a single business subject. The second executor is hidden in the system backend and is invisible to the outside world. Since the second executor is in a silent isolation state, the business processing process is not interfered by external abnormal factors, and its business processing results are reliable. Furthermore, when the second executor determines that the first result and the second result are inconsistent, the credibility of the second result is high, so the second result can be output as the ruling result; when the second executor determines that the first result and the second result are consistent, the ruling result is determined to be any one of the first result and the second result.

[0091] It can be seen that the embodiment of the present application constructs a lightweight architecture, which includes a first executor in an online state and a second executor in an isolated state from the outside in series, wherein the first executor in the online state performs business processing on the data message to obtain a first result, and transmits the first result to the second executor in a silent state; the second executor performs business processing on the obtained data message to obtain a second result, and makes a decision based on the first result and the second result; the present application deploys two executor modules, which reduces the system processing flow, reduces the occupancy of system resources, and has simple logic, thereby improving the processing efficiency of the system.

[0092] Further, in a possible implementation of the embodiment of the present application, after S104 calls the second execution body to perform service processing on the obtained data message to obtain the second result, the method further includes:

[0093] When the second execution body determines that the first result has not been received within a preset time period, outputting a second result;

[0094] When the second execution body receives the first result, a step of determining whether the first result and the second result are consistent is performed by the second execution body.

[0095] Among them, the preset duration can be set by the user according to actual business needs.

[0096] In some cases, some data messages may have higher requirements for time sensitivity. If they are judged first, the timeliness may be reduced. Therefore, since the second result has a higher reliability, when the second executor obtains the second result, it can output the second result. At the same time, when the second executor receives the first result, it can make a judgment. If the second executor determines that the first result and the second result are consistent, it means that the second result output first is correct; if the second executor determines that the first result and the second result are inconsistent, it means that the first executor may be subject to external interference or attack, and the system stability is insufficient. A prompt message can be generated so that the user can focus on it.

[0097] It can be seen that in the embodiment of the present application, when the first result is not received within the preset time period, it can be output first and then determined to improve the timeliness of business processing.

[0098] Furthermore, in a possible implementation of the embodiment of the present application, the mimicry defense method based on the lightweight architecture further includes:

[0099] Determining whether a preset condition is met through the second execution body;

[0100] If the preset conditions are met, the second execution body is called to perform the scheduling operation;

[0101] The scheduling operation includes: after performing a cleaning operation on the first execution body, exchanging the states of the first execution body and the second execution body, so as to use the first execution body as a new second execution body and the second execution body as a new first execution body;

[0102] The preset condition includes any of the following:

[0103] When the second execution body determines that the first result and the second result are inconsistent;

[0104] When the second executor determines that the first result has not been received within a preset time period;

[0105] When the current moment reaches the preset exchange cycle.

[0106] Among them, by comparing the first result and the second result to see if they are consistent, the second execution body can sense whether the electronic device has encountered an attack or interference. Specifically, the second execution body determines whether the first execution body is abnormal based on its own business output results. If the first execution body is abnormal, a cleaning operation on the first execution body is triggered, and a state switching process is taken.

[0107] Furthermore, if the first executor does not output the business processing results to the second executor for some reason, the second executor will first send its own business processing results to the backend after its own arbitration timer expires, and at the same time trigger the cleaning of the first executor and take corresponding state switching processing.

[0108] It is understandable that the first executor is abnormal, so it is cleaned and taken offline to become an isolated executor. The original isolated executor is put online, and the first executor is attacked by an unknown vulnerability or backdoor. Since the first executor and the second executor are heterogeneous executors, if the attacker still attacks the same vulnerability or backdoor, the newly-launched executor may not be affected, thereby blocking the attacker's continuous attack chain and ensuring the safe and stable operation of the entire system.

[0109] Furthermore, to further enhance security defense capabilities, the function of periodic state switching of the execution body can be enabled, that is, even if the online execution body is running normally, the two execution bodies will periodically switch states, thereby increasing the difficulty of external attacks. The periodic state switching of the execution body is triggered by the silent execution body control. Enabling this function may bring additional system resource overhead, and users can set it according to actual needs.

[0110] It should be noted that when the state of the online executor and the silent executor is switched, the internal communication path must also be changed accordingly, that is, the external input directly communicates with the newly online executor for business. After the executor is cleaned, it enters the silent state. At the same time, bypass monitoring can be enabled, and the business processing results sent by the online executor can be received at the same time.

[0111] It can be seen that in the embodiment of the present application, after the second execution body determines whether the preset conditions are met, it controls the first execution body to perform a cleaning operation, and then interchanges the states of the first execution body and the second execution body, so that the first execution body can be used as the new second execution body, and the second execution body can be used as the new first execution body, thereby realizing the state switching of the execution body and ensuring the stability of the system.

[0112] A possible implementation of the embodiment of the present application, after calling the second execution body to perform the scheduling operation, further includes:

[0113] Performing business processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state;

[0114] Calling the new second execution body to perform business processing on the obtained data message to obtain a fourth result;

[0115] The second result is verified by the new second execution body based on the third result and the fourth result.

[0116] In the embodiment of the present application, after the execution state is switched, the result of the last output can be verified again. If the third and fourth results are consistent and consistent with the second result, it means that the decision result is correct; otherwise, a prompt message is generated so that the user can focus on it.

[0117] In a possible implementation of the embodiment of the present application, before the second execution body adjudicates the first result and the second result to obtain the adjudication result, the method further includes:

[0118] Get the output mode;

[0119] If the output mode is the priority output mode, outputting the second result through the second execution body;

[0120] If the output mode is a normal output mode, the second execution body performs a decision on the first result and the second result to obtain a decision result.

[0121] In the embodiment of the present application, the credibility of the business processing results of the silent executor is relatively high, and the "output first, then decision" mode, that is, the priority output mode, can be enabled according to actual conditions. Once the silent executor obtains its own business processing results, it can be directly output to the back end, and then perform a series of processing such as decision calculation and dynamic scheduling, thereby further improving system efficiency and minimizing the impact on normal business delays.

[0122] In summary, the lightweight mimicry defense method proposed in the embodiment of the present application, under the premise of effectively ensuring the security of the business system, has a simpler system module, a shorter processing flow, and a simpler algorithm logic. It effectively reduces the additional system resource occupation, effectively reduces the difficulty of software implementation, and effectively improves business processing efficiency. It provides new technical ideas and solutions for the theory of intrinsic security mimicry defense in application scenarios with limited device resources.

[0123] Based on any of the above embodiments, in order to better understand the solution provided by the embodiments of the present application, the solution is described below in conjunction with a specific application scenario. Among them, the specific operation process of the lightweight system is further elaborated in detail in conjunction with the example of the vehicle-mounted terminal device of an intelligent networked vehicle:

[0124] The intelligent connected car T-BOX is deployed on the car side for data communication with the car company's remote service cloud platform. The remote service cloud platform can send control instructions to the vehicle through the T-BOX, such as vehicle start, vehicle door opening and closing, vehicle window opening and closing, etc. After receiving the control message sent, the T-BOX will perform data analysis and message format conversion, and then send it to the vehicle to perform specific actions.

[0125] The lightweight mimicry defense method and system are deployed on the T-BOX device, where the execution body undertakes the main business function, that is, to perform data parsing and format conversion on the control message sent by the remote service cloud platform, see Figure 4 .

[0126] Initially, Executor 1 is online and Executor 2 is silent. The remote service platform sends a light-off control message to the T-BOX device. After receiving the light-off control message, Executor 1 performs business processing, parses the control message, converts the format, and then sends the processing result to Executor 2.

[0127] Executor 2 obtains the service control message through bypass monitoring, performs corresponding service processing, parses the control message and performs format conversion to obtain corresponding service results.

[0128] Under normal circumstances, Executor 2 receives the business output data containing the light-off instruction sent by Executor 1, and at the same time, it also processes the business output data containing the light-off instruction; Executor 2 compares the results and determines that the two data are consistent, and then performs the business output to the back-end process normally, and the vehicle executes the light-off action;

[0129] If Executor 1 is attacked by an unknown network, resulting in business processing errors and outputting data containing door opening instructions, Executor 2 will also compare the results and find that the results of both parties are inconsistent. It will consider that Executor 1 is abnormal and first select its own result as the result of the judgment to output, that is, output the light-off instruction data, and the vehicle will correctly execute the light-off action; secondly, Executor 2 will start the scheduling operation to clean the online Executor 1 offline; finally, Executor 2 will switch from the silent state to the online state, and Executor 1 will enter the silent state after completing the cleaning process.

[0130] In another case, if executor 1 is attacked by an unknown network, resulting in no output of business processing results to executor 2; executor 2 will start the arbitration timer after completing its own business processing. If the arbitration timer times out and still has not received the business processing results sent by the online executor 1, it is considered that executor 1 has an abnormality. First, its own result is selected as the arbitration result for output, that is, the light-off instruction data is output, and the vehicle correctly executes the light-off action; secondly, executor 2 starts the scheduling operation to clean up the online executor 1 offline; finally, executor 2 switches from the silent state to the online state, and executor 1 enters the silent state after completing the cleaning.

[0131] It should be noted that after the dual executors complete the state switching, the internal communication path changes dynamically, the external control message input interacts directly with the online executor 2, the silent executor 1 enters the isolation environment, and the executor 1 starts bypass monitoring to obtain the business message received by the executor 2. The executor 2 outputs the business processing results to the executor 1, and the executor 1 is responsible for comparison, judgment and dynamic scheduling.

[0132] It can be understood that the above is only an example, and the solution provided in this application can also be applied to other devices, and this embodiment is not limited here.

[0133] The following is an introduction to a mimic defense system based on a lightweight architecture provided in an embodiment of the present application. The system described below and the method described above can be referred to each other. The system of this embodiment is set in an electronic device, and the lightweight architecture includes a first actuator and a second actuator connected in series. Figure 5 , Figure 5 It is a structural block diagram of a system of one embodiment of the present application, including:

[0134] The mimicry defense system 500 based on lightweight architecture includes:

[0135] The data packet acquisition module 510 is used to acquire input data packets;

[0136] A first execution module 520 is used to perform business processing on the data message through a first execution body in an online state, obtain a first result, and transmit the first result to a second execution body in a silent state, where the second execution body is isolated from the outside;

[0137] The second execution module 530 is used to call the second execution body to perform business processing on the obtained data message to obtain a second result; determine whether the first result and the second result are consistent through the second execution body, if not, determine the judgment result to be the second result; otherwise, determine the judgment result to be any one of the first result and the second result; output the judgment result through the second execution body.

[0138] In an implementable manner, the second execution module 530 is further configured to:

[0139] When the second execution body determines that the first result has not been received within a preset time period, outputting a second result;

[0140] When the second execution body receives the first result, a step of determining whether the first result and the second result are consistent is performed by the second execution body.

[0141] In an implementable manner, the second execution module 530 is further configured to:

[0142] Determining whether a preset condition is met through the second execution body;

[0143] If the preset conditions are met, the second execution body is called to perform the scheduling operation;

[0144] The scheduling operation includes: after performing a cleaning operation on the first execution body, exchanging the states of the first execution body and the second execution body, so as to use the first execution body as a new second execution body and the second execution body as a new first execution body;

[0145] The preset condition includes any of the following:

[0146] When the second execution body determines that the first result and the second result are inconsistent;

[0147] When the second executor determines that the first result has not been received within a preset time period;

[0148] When the current moment reaches the preset exchange cycle.

[0149] In an implementable manner, the first execution module 520 is further configured to:

[0150] Performing business processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state;

[0151] In an implementable manner, the second execution module 530 is further configured to:

[0152] Calling the new second execution body to perform business processing on the obtained data message to obtain a fourth result;

[0153] The second result is verified by the new second execution body based on the third result and the fourth result.

[0154] In one achievable manner, the mimicry defense system 500 based on the lightweight architecture further includes:

[0155] A mode acquisition module, used to acquire the output mode;

[0156] Accordingly, the second execution module 530 is further configured to:

[0157] If the output mode is the priority output mode, outputting the second result through the second execution body;

[0158] If the output mode is a normal output mode, a step of determining whether the first result and the second result are consistent with each other through the second execution body is performed.

[0159] In an implementable manner, the second execution module 530 is further configured to:

[0160] The second execution body is called to monitor the interface of the first execution body to obtain the data message by bypassing the replication mode, and the service processing is performed on the obtained data message to obtain the second result.

[0161] In one achievable manner, the mimicry defense system 500 based on the lightweight architecture further includes:

[0162] A replication module, used to: utilize an input agent to replicate a data message, and obtain a replicated data message;

[0163] The second execution module 530 is further configured to:

[0164] The second execution body is called to perform business processing on the copied data message to obtain a second result.

[0165] In an implementable manner, the second execution module 530 is further configured to:

[0166] The second execution module 530 is further configured to:

[0167] The second execution body is called to perform business processing on the data message sent by the first execution body to obtain a second result.

[0168] An electronic device is provided in an embodiment of the present application, such as Figure 6 As shown, Figure 6 The electronic device 600 shown includes: a processor 601 and a memory 603. The processor 601 and the memory 603 are connected, such as through a bus 602. Optionally, the electronic device 600 may also include a transceiver 604. It should be noted that in actual applications, the transceiver 604 is not limited to one, and the structure of the electronic device 600 does not constitute a limitation on the embodiments of the present application.

[0169] Processor 601 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 601 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0170] The bus 602 may include a path to transmit information between the above components. The bus 602 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 602 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0171] The memory 603 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0172] The memory 603 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 601. The processor 601 is used to execute the application code stored in the memory 603 to implement the contents shown in the above method embodiment.

[0173] Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0174] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0175] An embodiment of the present application provides a computer program product, including a computer program, which implements the corresponding contents of the aforementioned method embodiment when the computer program is executed by a processor.

[0176] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0177] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A mimicry defense method based on lightweight architecture, characterized in that: The lightweight architecture includes a first actuator and a second actuator connected in series. The mimicry defense method based on the lightweight architecture includes: Get the input data message; Performing business processing on the data message through the first execution body in the online state to obtain a first result, and transmitting the first result to the second execution body in the silent state, where the second execution body is isolated from the outside; Calling the second execution body to perform business processing on the obtained data message to obtain a second result; determining, by the second execution body, whether the first result and the second result are consistent; if they are inconsistent, determining the decision result to be the second result; otherwise, determining the decision result to be any one of the first result and the second result; The decision result is outputted by the second execution body.

2. The mimicry defense method based on lightweight architecture according to claim 1 is characterized in that: After calling the second execution body to perform service processing on the obtained data message to obtain the second result, the method further includes: When the second executor determines that the first result has not been received within a preset time period, outputting the second result; When the second execution body receives the first result, a step of determining whether the first result and the second result are consistent is performed by the second execution body.

3. The mimicry defense method based on lightweight architecture according to claim 2 is characterized in that: The first executable body and the second executable body are heterogeneous executable bodies, and the method further includes: Determining, by the second executor, whether a preset condition is met; If the preset condition is met, calling the second execution body to perform the scheduling operation; The scheduling operation includes: after performing a cleaning operation on the first execution body, exchanging the states of the first execution body and the second execution body, so as to use the first execution body as a new second execution body and the second execution body as a new first execution body; The preset condition includes any of the following: When the second executor determines that the first result and the second result are inconsistent; When it is determined by the second executor that the first result has not been received within the preset time period; When the current moment reaches the preset exchange cycle.

4. The mimicry defense method based on lightweight architecture according to claim 3 is characterized in that: After calling the second execution body to perform the scheduling operation, the method further includes: Performing business processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state; Calling the new second execution body to perform business processing on the obtained data message to obtain a fourth result; The second result is verified by a new second execution body based on the third result and the fourth result.

5. The mimicry defense method based on lightweight architecture according to claim 1 is characterized in that: Before determining, by the second execution body, whether the first result and the second result are consistent, the method further includes: Get the output mode; If the output mode is the priority output mode, outputting the second result through the second execution body; If the output mode is a normal output mode, a step of determining, by the second execution body, whether the first result and the second result are consistent is performed.

6. The mimicry defense method based on lightweight architecture according to any one of claims 1 to 5, characterized in that: Calling the second execution body to perform business processing on the obtained data message to obtain a second result includes: Calling the second execution body to monitor the network interface of the first execution body to obtain a data message by bypassing the replication mode, and performing business processing on the obtained data message to obtain the second result; or, Using the input agent to copy the data message to obtain a copied data message; calling the second execution body to perform business processing on the copied data message to obtain the second result; or, The second execution body is called to perform business processing on the data message sent by the first execution body to obtain the second result.

7. A mimicry defense system based on a lightweight architecture, characterized in that: The lightweight architecture includes a first actuator and a second actuator connected in series. The mimicry defense system based on the lightweight architecture includes: A data message acquisition module, used to acquire input data messages; A first execution module, configured to perform business processing on a data message through the first execution body in an online state, obtain a first result, and transmit the first result to the second execution body in a silent state, wherein the second execution body is isolated from the outside; The second execution module is used to call the second execution body to perform business processing on the obtained data message to obtain a second result; determine whether the first result and the second result are consistent through the second execution body, if not, determine the decision result to be the second result; otherwise, determine the decision result to be any one of the first result and the second result; output the decision result through the second execution body.

8. An electronic device, characterized in that: include: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: execute the steps of the mimicry defense method based on a lightweight architecture according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded by a processor and executes the steps of the mimicry defense method based on a lightweight architecture according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the steps of the mimicry defense method based on lightweight architecture as described in any one of claims 1 to 6.

Images