A method, system, device, medium and product for mimetic defense based on lightweight architecture

Abstract

The application relates to the technical field of cyberspace security, in particular to a quasi-state defense method, system, device, medium and product based on a lightweight architecture, which comprises the following steps: obtaining an input data packet; performing service processing on the data packet by a first execution body in an online state to obtain a first result, and transmitting the first result to a second execution body in a silent state, the second execution body being in an isolated state with the outside; calling the second execution body to perform service processing on the obtained data packet to obtain a second result; judging whether the first result and the second result are consistent through the second execution body, if not, determining that the second result is the final result; otherwise, determining that one of the first result and the second result is the final result; and outputting the final result through the second execution body. By deploying two execution body modules, the system processing flow is reduced, the occupation of system resources is reduced, the logic is simple, and the processing efficiency of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security technology, and in particular to a mimicry defense method, system, device, medium and product based on a lightweight architecture. Background Art

[0002] Mimic Defense (MD), an intrinsically secure mimic defense architecture, is a proactive defense behavior. Generally, the main components of a fully quantized MD architecture include an input agent, a redundant heterogeneous executor pool, an arbiter, and a scheduler. The redundant heterogeneous executor pool contains several redundant executors with equivalent functions but different structures, divided into online and offline categories. A fully quantized mimic defense system architecture has many modules, and the executor pool theoretically requires at least four or more executors. Furthermore, the processing logic of the arbiter's multi-mode decision calculation algorithm and the scheduler's multi-executor dynamic scheduling algorithm are highly complex. Consequently, the deployment of more modules increases the use of system resources such as computing and storage, and the complex algorithmic logic reduces system efficiency. Summary of the Invention

[0003] The purpose of this application is to provide a mimetic defense method, system, device, medium and product based on a lightweight architecture. By deploying two execution modules, the system processing flow is reduced, the occupation of system resources is reduced, and the logic is simple, which improves the processing efficiency of the system.

[0004] In a first aspect, a mimicry defense method based on a lightweight architecture is provided, wherein the lightweight architecture includes a first executor and a second executor connected in series.

[0005] The mimicry defense method based on lightweight architecture includes:

[0006] Get the input data message;

[0007] Performing service processing on the data message by the first execution body in the online state to obtain a first result, and transmitting the first result to the second execution body in the silent state, where the second execution body is isolated from the outside;

[0008] calling the second execution body to perform business processing on the obtained data message to obtain a second result;

[0009] determining, by the second execution body, whether the first result and the second result are consistent; if they are inconsistent, determining the arbitration result to be the second result; otherwise, determining the arbitration result to be either the first result or the second result;

[0010] The decision result is outputted by the second execution body.

[0011] In a preferred example, the present application may be further configured as follows: after calling the second execution body to perform service processing on the obtained data message to obtain the second result, the following steps are further included:

[0012] When the second execution body determines that the first result has not been received within a preset time period, outputting the second result;

[0013] When the second execution body receives the first result, the step of determining whether the first result and the second result are consistent is performed by the second execution body.

[0014] In a preferred example, the present application may be further configured as follows: the first execution body and the second execution body are heterogeneous execution bodies, and the method further includes:

[0015] Determining, by the second executive body, whether a preset condition is met;

[0016] If the preset condition is met, calling the second execution body to perform the scheduling operation;

[0017] The scheduling operation includes: after performing a cleaning operation on the first execution body, swapping the states of the first execution body and the second execution body so that the first execution body serves as the new second execution body and the second execution body serves as the new first execution body;

[0018] The preset conditions include any of the following:

[0019] When the second execution body determines that the first result and the second result are inconsistent;

[0020] When the second execution body determines that the first result has not been received within the preset time period;

[0021] When the current moment reaches the preset exchange cycle.

[0022] In a preferred example, the present application may be further configured as follows: after calling the second execution body to perform the scheduling operation, the following steps are further included:

[0023] Performing service processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state;

[0024] Invoking the new second execution body to perform business processing on the obtained data message to obtain a fourth result;

[0025] The second result is verified by a new second execution body based on the third result and the fourth result.

[0026] In a preferred example, the present application may be further configured as follows: before the second execution body determines whether the first result and the second result are consistent, the following steps are further included:

[0027] Get the output mode;

[0028] If the output mode is the priority output mode, outputting the second result through the second execution body;

[0029] If the output mode is the normal output mode, a step of determining, by the second execution body, whether the first result and the second result are consistent is performed.

[0030] In a preferred example, the present application may be further configured as follows: calling the second execution body to perform service processing on the obtained data message to obtain a second result, including:

[0031] calling the second executor to monitor the network interface of the first executor to obtain a data message by bypassing the replication mode, and performing service processing on the obtained data message to obtain the second result;

[0032] or,

[0033] Using the input agent to copy the data message to obtain a copied data message; calling the second execution body to perform business processing on the copied data message to obtain the second result;

[0034] or,

[0035] The second execution body is called to perform business processing on the data message sent by the first execution body to obtain the second result.

[0036] In a second aspect, a mimicry defense system based on a lightweight architecture is provided, wherein the lightweight architecture includes a first actuator and a second actuator connected in series.

[0037] The mimicry defense system based on a lightweight architecture includes:

[0038] A data message acquisition module, used to acquire input data messages;

[0039] a first execution module, configured to perform service processing on the data message through the first execution body in an online state, obtain a first result, and transmit the first result to the second execution body in a silent state, where the second execution body is isolated from the outside;

[0040] The second execution module is used to call the second execution body to perform business processing on the obtained data message to obtain a second result; determine whether the first result and the second result are consistent through the second execution body, and if they are inconsistent, determine the judgment result to be the second result; otherwise, determine the judgment result to be either the first result or the second result; and output the judgment result through the second execution body.

[0041] According to a third aspect, an electronic device is provided, including:

[0042] one or more processors;

[0043] Memory;

[0044] One or more applications, wherein the one or more applications are stored in a memory and configured to be executed by one or more processors, and the one or more programs are configured to: perform operations corresponding to the method shown in any possible implementation of the first aspect.

[0045] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded by a processor and executes the steps of the method shown in any possible implementation of the first aspect.

[0046] In a fifth aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements operations corresponding to the method shown in any possible implementation manner in the first aspect.

[0047] In summary, the mimetic defense method based on a lightweight architecture provided by the present application has the following beneficial technical effects: constructing a lightweight architecture, which includes a first executor in an online state and a second executor in an isolated state from the outside in series, wherein the first executor in the online state performs business processing on the data message, obtains a first result, and transmits the first result to the second executor in a silent state; the second executor performs business processing on the obtained data message to obtain a second result, and makes a decision based on the first result and the second result; the present application deploys two executor modules, which reduces the system processing flow, reduces the occupancy of system resources, and has simple logic, thereby improving the processing efficiency of the system.

[0048] In addition, the present application also provides a mimetic defense system, equipment, medium and product based on a lightweight architecture, which has the above-mentioned beneficial technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0050] Figure 1 A schematic diagram of the fully quantified endogenous security mimicry defense architecture for related technologies;

[0051] Figure 2 An overall schematic diagram of a lightweight mimicry defense deployment method provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of a flow chart of a mimicry defense method based on a lightweight architecture provided in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of a specific application scenario provided in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of the structure of a mimicry defense system based on a lightweight architecture provided in an embodiment of the present application;

[0055] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make non-creative modifications to the present embodiment as needed, but as long as they are within the scope of the present application, they are protected by patent law.

[0057] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained through the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information requires the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0058] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0059] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document, unless otherwise specified, generally indicates an "or" relationship between the related objects.

[0060] In cyberspace, the endogenous security mimicry defense architecture greatly improves the system's ability to cope with security risks brought by unknown vulnerabilities and unknown backdoors, effectively ensures the safe and stable operation of data communications and business processing, and provides universal theories and methods for dealing with unknown network threats.

[0061] See also Figure 1 , Figure 1 This is a schematic diagram of a fully quantized, endogenously secure mimetic defense architecture for related technologies. Its main components include an input agent, a pool of redundant heterogeneous executors, an arbiter, and a scheduler. The redundant heterogeneous executor pool contains several redundant executors with equivalent functionality but different structures, divided into online and offline categories. The architecture's operating mechanism is described as follows: When external input data enters the system, it first passes through the input agent module. The input agent replicates the input data in multiple copies, equal to the number of online executors. The input agent then distributes the replicated data to each online executor for specific business processing. After each executor completes its business processing, it sends the generated output to the arbiter. The arbiter performs a decision calculation on the received executor data based on a multi-mode decision algorithm. Typically, since the executors are functionally equivalent, the business processing results they send to the arbiter should be consistent. In this case, the decision calculation succeeds, and the arbiter selects an arbitrary business processing result as the final decision and outputs it to the backend process.

[0062] If executor N suffers an unknown attack, causing its business processing output results to be incorrect, then when the arbiter performs the arbitration calculation, it will find that only the output result of executor N is different from the data of other executors, and thus conclude that executor N has an abnormality. The arbiter will discard the data of executor N and select a business processing result from other normal executors as the arbitration result to output to the backend. At the same time, it will send a message to the scheduler to inform it of the abnormality of executor N. The scheduler will perform a cleaning operation to take executor N offline, and then randomly select a new executor from the offline executors to go online to ensure that the number of online executors remains unchanged.

[0063] The full-scale mimetic defense system architecture has many modules and requires input agents, arbitrators, schedulers, and redundant heterogeneous executor pools. Theoretically, at least four or more executors are required in the executor pool. In addition, the processing logic complexity of the arbitrator's multi-mode decision calculation algorithm and the scheduler's multi-executor dynamic scheduling algorithm is relatively high.

[0064] Given the above situation, first, the deployment of more modules leads to greater occupation of system resources such as computing and storage; second, complex algorithm logic increases the difficulty of software implementation and reduces system operation efficiency; third, more process processing will affect the real-time performance of the business; finally, the heavy system architecture brings certain difficulties to deployment in the actual environment.

[0065] Therefore, the full-scale endogenous security mimetic defense architecture has certain limitations in actual application deployment. For scenarios with limited hardware resources and lightweight equipment, such as intelligent connected vehicle onboard terminals and small drone onboard terminals, the applicability of this system architecture is significantly restricted.

[0066] In response to the above problems, this application proposes a lightweight system based on the idea of ​​endogenous security mimicry defense, which specifically solves problems that are difficult to solve under traditional architectures, broadens the practical application scenarios of the theory of endogenous security mimicry defense, and provides a new method for the practice of the theory of endogenous security mimicry defense. First, the independent input proxy module, arbitrator, and scheduler are eliminated, and a dual redundant heterogeneous executor pool is replaced by a dual redundant heterogeneous executor. After the modules are streamlined, the system processing flow is reduced and the occupation of system resources is reduced; secondly, since only two executors are deployed, the number of redundant heterogeneous executors is reduced, and the logical complexity of the arbitration algorithm and the dynamic scheduling algorithm is simplified, which greatly reduces the difficulty of software implementation and improves the system processing efficiency; finally, the lightweight deployment retains the core concepts of the endogenous security mimicry defense theory such as "redundant heterogeneous executors", "arbitration calculation", and "dynamic scheduling" to the greatest extent, ensuring its ability to deal with unknown threats.

[0067] Therefore, the lightweight mimetic defense deployment method proposed in this application reduces the consumption of system resources, reduces the difficulty of algorithm implementation, and improves processing efficiency while ensuring its ability to resist unknown network threats. It provides a solution for lightweight application scenarios and provides a new idea and new method for the theoretical practice of endogenous security mimetic defense.

[0068] In order to better understand and illustrate the solution of the embodiment of the present application, see Figure 2 , Figure 2 This is a schematic diagram of a lightweight mimicry defense deployment method provided by an embodiment of this application. Compared to the full mimicry defense architecture, this solution eliminates the independent input proxy module, arbitrator, and scheduler, replaces the multi-redundant heterogeneous executor pool with a dual executor mode, and switches the individual executors from a parallel structure to a series structure.

[0069] The first executor (executor 1) is in an online state, responsible for directly receiving external input data packets and carrying out actual business processing functions. That is, after receiving the external input data packets, it performs normal business processing procedures and generates the first processed result (business output result) and sends it to the second executor (executor 2).

[0070] Executor 2 is in a silent state. In this state, the executor is isolated from the outside of the entire system, that is, the outside cannot access, log in, or perform other communication and interaction operations on the executor. After executor 2 obtains the data message, it synchronously performs the internal business processing flow. The way for executor 2 to obtain the data message can be to actively monitor the network interface of executor 1 to receive the message, and obtain a copy of the external input business-related data message through bypass replication; or, use the input agent to replicate the data message to obtain the replicated data message; or, executor 1 forwards the data message after receiving it. This embodiment of the application is no longer limited to this.

[0071] Executor 2 performs arbitration calculation on the second result generated by the operation and the first result output by Executor 1, outputs the arbitration result and passes it to the subsequent process.

[0072] In one embodiment, the present application provides a mimicry defense method based on a lightweight architecture, such as Figure 3 As shown, the method provided in the embodiment of the present application can be executed by an electronic device, which can be a server or a terminal device. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent networked car terminal, a small drone terminal, etc., but is not limited to this. The embodiment of the present application is not limited here. The lightweight architecture includes a first actuator and a second actuator connected in series. The method includes:

[0073] S101, obtaining input data packets;

[0074] Wherein, the data message of external input is obtained, the data message includes data, and of course, if the electronic device is provided with multiple service processing types, the processing service type can also be included.

[0075] For example, the remote service cloud platform can issue a control instruction to the vehicle through the T-BOX, such as vehicle starting, vehicle door opening, vehicle window opening, etc. At this time, the electronic device is the T-BOX, and the data message includes the analysis service type and the control data, so that the T-BOX can perform data analysis and message format conversion after receiving the issued control message. It should be noted that different electronic devices can be provided with different service types, which can be adjusted according to actual conditions. The above is only an example, and the present embodiment is not limited herein.

[0076] S102, performing service processing on the data message by the first execution body in the online state to obtain a first result, and transmitting the first result to the second execution body in the silent state, the second execution body being in an isolated state with the outside;

[0077] S103, calling the second execution body to perform service processing on the obtained data message to obtain a second result;

[0078] The first execution body in the online state is an execution body exposed to the outside, and the first execution body is exposed to the outside. When the system is attacked from the outside, the attack object is generally the first execution body.

[0079] The second execution body in the silent state is in an isolated state with the outside, and the second execution body is shielded in the system, so it is generally not attacked or disturbed from the outside. At this time, the second result obtained by the second execution body has high reliability.

[0080] In some embodiments, the second result can be obtained in various ways:

[0081] Method one: calling the second execution body to listen to the network interface of the first execution body to obtain the data message by bypass copying, and performing service processing on the obtained data message to obtain the second result.

[0082] Wherein, the second execution body actively listens to the network interface of the first execution body to receive the message, and when the first execution body receives the message, a copy of the data message related to the service of the external input is obtained by bypass copying, and the internal service processing process is synchronized.

[0083] Method two: duplicating the data message by using an input agent to obtain the duplicated data message; calling the second execution body to perform service processing on the duplicated data message to obtain the second result.

[0084] Among them, an input agent is added. When the data message is transmitted to the input agent, the input agent will copy the data. Since it only includes the first execution body and the second execution body, only one copy is needed at this time.

[0085] Method three: calling the second execution body to perform business processing on the data message sent by the first execution body to obtain the second result.

[0086] In one case, the first execution body sends the data message to the second execution body immediately after receiving it; in another case, after obtaining the first result, the first execution body sends the first result and the data message to the second execution body at the same time; of course, there may be other times for sending message data, which are no longer limited in the embodiments of the present application, and users can set them according to actual needs.

[0087] It is understandable that, in addition to the above three implementation methods, other technologies may also be used for implementation, which is not limited here.

[0088] S104: Determine, by the second execution body, whether the first result and the second result are consistent. If they are inconsistent, determine the arbitration result to be the second result; otherwise, determine the arbitration result to be either the first result or the second result.

[0089] The decision result is outputted by the second execution body.

[0090] To external objects, only the online first executor directly interacts with it, appearing externally as a single business entity. The second executor is hidden in the system backend and is not visible to the outside world. Because the second executor is in a silent and isolated state, the business processing process is not interfered with by external abnormal factors, and its business processing results are reliable. Furthermore, if the second executor determines that the first and second results are inconsistent, the second result has a higher credibility, and therefore can be output as the decision result. If the second executor determines that the first and second results are consistent, the decision result is determined to be either the first or the second result.

[0091] It can be seen that the embodiment of the present application constructs a lightweight architecture, which includes a first executor in an online state and a second executor in an isolated state from the outside in series, wherein the first executor in the online state performs business processing on the data message, obtains a first result, and transmits the first result to the second executor in a silent state; the second executor performs business processing on the obtained data message to obtain a second result, and makes a decision based on the first result and the second result; the present application deploys two executor modules, which reduces the system processing flow, reduces the occupation of system resources, and has simple logic, thereby improving the processing efficiency of the system.

[0092] Furthermore, in a possible implementation of the embodiment of the present application, after S104 calls the second execution body to perform service processing on the obtained data message to obtain the second result, the following steps are further included:

[0093] When the second execution body determines that the first result has not been received within a preset time period, outputting a second result;

[0094] When the second execution body receives the first result, the step of determining whether the first result and the second result are consistent is performed by the second execution body.

[0095] Among them, the preset duration can be set by the user according to actual business needs.

[0096] In some cases, some data messages may have higher time sensitivity requirements. If they are judged first, the timeliness may be reduced. Therefore, since the second result is more reliable, when the second executor obtains the second result, it can output the second result. At the same time, when the second executor receives the first result, it can make a judgment. If the second executor determines that the first result and the second result are consistent, it means that the second result output first is correct; if the second executor determines that the first result and the second result are inconsistent, it means that the first executor may be subject to external interference or attack, and the system stability is insufficient. A prompt message can be generated so that the user can focus on it.

[0097] It can be seen that in the embodiment of the present application, when the first result is not received within the preset time period, it can be output first and then determined to improve the timeliness of business processing.

[0098] Furthermore, in a possible implementation of the embodiment of the present application, the mimicry defense method based on the lightweight architecture further includes:

[0099] Determining whether a preset condition is met through the second execution body;

[0100] If the preset conditions are met, the second execution body is called to perform the scheduling operation;

[0101] The scheduling operation includes: after performing a cleaning operation on the first execution body, swapping the states of the first execution body and the second execution body so that the first execution body serves as the new second execution body and the second execution body serves as the new first execution body;

[0102] The preset conditions include any of the following:

[0103] When the second execution body determines that the first result and the second result are inconsistent;

[0104] When the second execution body determines that the first result has not been received within a preset time period;

[0105] When the current moment reaches the preset exchange cycle.

[0106] By comparing the first and second results to determine if they are consistent, the second executor can detect whether the electronic device has been attacked or interfered with. Specifically, the second executor determines whether the first executor has experienced an anomaly based on its own business output. If so, it triggers a cleanup operation on the first executor and initiates a state change.

[0107] Furthermore, if the first executor does not output the business processing results to the second executor for some reason, the second executor will first send its own business processing results to the backend after its own arbitration timer expires, and at the same time trigger the cleaning of the first executor and take corresponding state switching processing.

[0108] It is understandable that the first executor is abnormal, and the first executor is cleaned and taken offline, becoming an isolated executor. The original isolated executor is put online, and the first executor is attacked by an unknown vulnerability or backdoor. Since the first executor and the second executor are heterogeneous executors, if the attacker still attacks the same vulnerability or backdoor, the newly-launched executor may not be affected, thereby blocking the attacker's continuous attack chain and ensuring the safe and stable operation of the entire system.

[0109] Furthermore, to further enhance security defenses, you can enable the scheduled state switching feature. This means that even when the online executor is operating normally, the two executors periodically switch states, making external attacks more difficult. This periodic state switching is triggered by the silent executor control. Enabling this feature may incur additional system resource overhead; users can configure it based on their needs.

[0110] It should be noted that when the state of the online executor and the silent executor switches, the internal communication path must also change accordingly. That is, the external input directly communicates with the newly online executor for business purposes. After the cleansing is completed, the executor enters the silent state. At the same time, bypass monitoring can be enabled and the business processing results sent by the online executor can be received at the same time.

[0111] It can be seen that in the embodiment of the present application, after the second execution body determines whether the preset conditions are met, it controls the first execution body to perform a cleaning operation, and then interchanges the states of the first execution body and the second execution body, so that the first execution body can be used as the new second execution body and the second execution body can be used as the new first execution body, thereby realizing the state switching of the execution body and ensuring the stability of the system.

[0112] A possible implementation of the embodiment of the present application further includes, after calling the second execution body to perform the scheduling operation:

[0113] Performing service processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state;

[0114] Invoking the new second execution body to perform business processing on the obtained data message to obtain a fourth result;

[0115] The second result is verified by the new second execution body based on the third result and the fourth result.

[0116] In the embodiment of the present application, after the execution state switch is completed, the last output result can be verified again. If the third and fourth results are consistent and consistent with the second result, it means that the judgment result is correct; otherwise, a prompt message is generated to facilitate the user's focus.

[0117] In a possible implementation of the embodiment of the present application, before the second executor adjudicates the first result and the second result to obtain the adjudication result, the method further includes:

[0118] Get the output mode;

[0119] If the output mode is the priority output mode, outputting the second result through the second execution body;

[0120] If the output mode is a normal output mode, the second execution body is executed to determine the first result and the second result to obtain a determination result.

[0121] In an embodiment of the present application, the credibility of the business processing results of the silent execution body is relatively high, and the "output first, then judgment" mode, that is, the priority output mode, can be enabled according to actual conditions. Once the silent execution body obtains its own business processing results, it can be directly output to the back end, and then perform a series of processing such as judgment calculation and dynamic scheduling, thereby further improving system efficiency and minimizing the impact on normal business delays.

[0122] In summary, the lightweight mimetic defense method proposed in the embodiment of the present application, under the premise of effectively ensuring the security of the business system, has a simpler system module, a shorter processing flow, and a simpler algorithm logic. It effectively reduces the additional system resource occupation, effectively reduces the difficulty of software implementation, and effectively improves business processing efficiency. It provides new technical ideas and solutions for the theory of intrinsic security mimetic defense in application scenarios with limited device resources.

[0123] Based on any of the above embodiments, in order to better understand the solution provided by the embodiments of this application, the solution is described below in conjunction with a specific application scenario. Among them, the specific operation process of the lightweight system is further elaborated in detail by combining the example of an intelligent connected vehicle onboard terminal device:

[0124] The T-BOX for intelligent connected vehicles is deployed in the vehicle and communicates with the automaker's remote service cloud platform. The remote service cloud platform can use the T-BOX to send control commands to the vehicle, such as starting the vehicle, opening and closing doors, and opening and closing windows. After receiving the control messages, the T-BOX parses the data and converts the message format before sending them to the vehicle to execute the specific action.

[0125] The lightweight mimicry defense method and system are deployed on the T-BOX device, where the executor assumes the main business function, that is, to perform data parsing and format conversion on the control message sent by the remote service cloud platform. Figure 4 .

[0126] Initially, Executor 1 is online, while Executor 2 is silent. The remote service platform sends a light-off control message to the T-BOX device. Upon receiving the light-off control message, Executor 1 processes the message, parses it, converts its format, and then sends the processed result to Executor 2.

[0127] Executor 2 obtains the service control message through bypass monitoring, performs corresponding service processing, parses the control message and performs format conversion to obtain the corresponding service result.

[0128] Under normal circumstances, Executor 2 receives the business output data containing the light-off instruction from Executor 1, and simultaneously processes the business output data containing the light-off instruction itself. Executor 2 compares the results and determines that the two data are consistent. It then outputs the business data to the backend process normally, and the vehicle executes the light-off action.

[0129] If Executor 1 is attacked by an unknown network, resulting in a processing error and outputting data containing a door-opening command, Executor 2 will similarly compare the results and, upon finding a discrepancy, conclude that Executor 1 has failed. It will first select its own result as the adjudication result and output the light-off command data, ensuring that the vehicle correctly executes the light-off action. Next, Executor 2 initiates a dispatch operation to remove Executor 1 from the online state. Finally, Executor 2 switches from a silent state to an online state, and Executor 1 completes the cleaning process and enters a silent state.

[0130] In another case, if executor 1 is attacked by an unknown network, resulting in no output of business processing results to executor 2; executor 2 will start the arbitration timer after completing its own business processing. If the arbitration timer times out and still has not received the business processing results sent by the online executor 1, it is considered that executor 1 has an abnormality. First, it selects its own result as the arbitration result for output, that is, outputs the light-off instruction data, and the vehicle correctly executes the light-off action; secondly, executor 2 starts the scheduling operation to clean up the online executor 1 offline; finally, executor 2 switches from the silent state to the online state, and executor 1 enters the silent state after completing the cleaning.

[0131] It should be noted that after the dual executors complete the state switching, the internal communication path changes dynamically, the external control message input interacts directly with the online executor 2, the silent executor 1 enters the isolation environment, and the executor 1 starts the bypass monitoring to obtain the business message received by the executor 2. The executor 2 outputs the business processing results to the executor 1. The executor 1 is responsible for comparison, judgment and dynamic scheduling.

[0132] It is understandable that the above is only an example, and the solution provided in this application can also be applied to other devices, which is not limited in this embodiment.

[0133] The following is an introduction to a mimic defense system based on a lightweight architecture provided by an embodiment of the present application. The system described below and the method described above can be referenced to each other. The system of this embodiment is set in an electronic device, and the lightweight architecture includes a first actuator and a second actuator connected in series. Figure 5 , Figure 5 This is a structural block diagram of a system according to one embodiment of the present application, including:

[0134] The lightweight architecture-based mimicry defense system 500 includes:

[0135] The data packet acquisition module 510 is used to acquire input data packets;

[0136] A first execution module 520 is configured to perform service processing on the data message through a first execution body in an online state, obtain a first result, and transmit the first result to a second execution body in a silent state, where the second execution body is isolated from the outside;

[0137] The second execution module 530 is used to call the second execution body to perform business processing on the obtained data message to obtain a second result; determine whether the first result and the second result are consistent through the second execution body, and if they are inconsistent, determine the judgment result to be the second result; otherwise, determine the judgment result to be either the first result or the second result; and output the judgment result through the second execution body.

[0138] In one achievable manner, the second execution module 530 is further configured to:

[0139] When the second execution body determines that the first result has not been received within a preset time period, outputting a second result;

[0140] When the second execution body receives the first result, the step of determining whether the first result and the second result are consistent is performed by the second execution body.

[0141] In one achievable manner, the second execution module 530 is further configured to:

[0142] Determining whether a preset condition is met through the second execution body;

[0143] If the preset conditions are met, the second execution body is called to perform the scheduling operation;

[0144] The scheduling operation includes: after performing a cleaning operation on the first execution body, swapping the states of the first execution body and the second execution body so that the first execution body serves as the new second execution body and the second execution body serves as the new first execution body;

[0145] The preset conditions include any of the following:

[0146] When the second execution body determines that the first result and the second result are inconsistent;

[0147] When the second execution body determines that the first result has not been received within a preset time period;

[0148] When the current moment reaches the preset exchange cycle.

[0149] In one implementable manner, the first execution module 520 is further configured to:

[0150] Performing service processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state;

[0151] In one achievable manner, the second execution module 530 is further configured to:

[0152] Invoking the new second execution body to perform business processing on the obtained data message to obtain a fourth result;

[0153] The second result is verified by the new second execution body based on the third result and the fourth result.

[0154] In one practicable manner, the mimicry defense system 500 based on the lightweight architecture further includes:

[0155] Mode acquisition module, used to obtain output mode;

[0156] Accordingly, the second execution module 530 is further configured to:

[0157] If the output mode is the priority output mode, outputting the second result through the second execution body;

[0158] If the output mode is the normal output mode, a step of determining whether the first result and the second result are consistent with each other by the second execution body is performed.

[0159] In one achievable manner, the second execution module 530 is further configured to:

[0160] The second execution body is called to monitor the interface of the first execution body to obtain a data message through bypass replication, and business processing is performed on the obtained data message to obtain a second result.

[0161] In one practicable manner, the mimicry defense system 500 based on the lightweight architecture further includes:

[0162] A replication module, configured to: utilize an input agent to replicate a data message to obtain a replicated data message;

[0163] The second execution module 530 is further configured to:

[0164] The second execution body is called to perform business processing on the copied data message to obtain a second result.

[0165] In one achievable manner, the second execution module 530 is further configured to:

[0166] The second execution module 530 is further configured to:

[0167] The second execution body is called to perform business processing on the data message sent by the first execution body to obtain a second result.

[0168] An electronic device is provided in an embodiment of the present application, such as Figure 6 As shown, Figure 6 The electronic device 600 shown includes a processor 601 and a memory 603. The processor 601 and the memory 603 are connected, for example, via a bus 602. Optionally, the electronic device 600 may further include a transceiver 604. It should be noted that in actual applications, the number of transceivers 604 is not limited to one, and the structure of the electronic device 600 does not constitute a limitation on the embodiments of the present application.

[0169] Processor 601 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 601 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0170] Bus 602 may include a path for transmitting information between the above components. Bus 602 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. Bus 602 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0171] The memory 603 may be a ROM (Read Only Memory) or other type of static storage device that can store static information and instructions, a RAM (Random Access Memory) or other type of dynamic storage device that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0172] The memory 603 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 601. The processor 601 is used to execute the application code stored in the memory 603 to implement the content shown in the above method embodiment.

[0173] Figure 6 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0174] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding contents of the aforementioned method embodiment.

[0175] An embodiment of the present application provides a computer program product, including a computer program, which implements the corresponding contents of the aforementioned method embodiment when the computer program is executed by a processor.

[0176] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0177] The above are only some of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A mimicry defense method based on lightweight architecture, characterized in that: The lightweight architecture includes a first executor and a second executor connected in series. The mimicry defense method based on the lightweight architecture includes: Get the input data message; Performing service processing on the data message by the first execution body in the online state to obtain a first result, and transmitting the first result to the second execution body in the silent state, where the second execution body is isolated from the outside; calling the second execution body to perform business processing on the obtained data message to obtain a second result; determining, by the second execution body, whether the first result and the second result are consistent; if they are inconsistent, determining the arbitration result to be the second result; otherwise, determining the arbitration result to be either the first result or the second result; The decision result is outputted by the second execution body.

2. The mimicry defense method based on lightweight architecture according to claim 1 is characterized in that: After calling the second execution body to perform service processing on the obtained data message to obtain the second result, the method further includes: When the second execution body determines that the first result has not been received within a preset time period, outputting the second result; When the second execution body receives the first result, the step of determining whether the first result and the second result are consistent is performed by the second execution body.

3. The mimicry defense method based on lightweight architecture according to claim 2 is characterized in that: The first executable and the second executable are heterogeneous executables, and the method further includes: Determining, by the second executive body, whether a preset condition is met; If the preset condition is met, calling the second execution body to perform the scheduling operation; The scheduling operation includes: after performing a cleaning operation on the first execution body, swapping the states of the first execution body and the second execution body so that the first execution body serves as the new second execution body and the second execution body serves as the new first execution body; The preset conditions include any of the following: When the second execution body determines that the first result and the second result are inconsistent; When the second execution body determines that the first result has not been received within the preset time period; When the current moment reaches the preset exchange cycle.

4. The mimicry defense method based on lightweight architecture according to claim 3 is characterized in that: After calling the second execution body to perform the scheduling operation, the method further includes: Performing service processing on the data message through the new first execution body to obtain a third result, and transmitting the new first result to the new second execution body in a silent state; Invoking the new second execution body to perform business processing on the obtained data message to obtain a fourth result; The second result is verified by a new second execution body based on the third result and the fourth result.

5. The mimicry defense method based on lightweight architecture according to claim 1 is characterized in that: Before determining, by the second execution body, whether the first result and the second result are consistent, the method further includes: Get the output mode; If the output mode is the priority output mode, outputting the second result through the second execution body; If the output mode is the normal output mode, a step of determining, by the second execution body, whether the first result and the second result are consistent is performed.

6. The mimicry defense method based on lightweight architecture according to any one of claims 1 to 5, characterized in that: Calling the second execution body to perform business processing on the obtained data message to obtain a second result includes: calling the second executor to monitor the network interface of the first executor to obtain a data message by bypassing the replication mode, and performing service processing on the obtained data message to obtain the second result; or, Using the input agent to copy the data message to obtain a copied data message; calling the second execution body to perform business processing on the copied data message to obtain the second result; or, The second execution body is called to perform business processing on the data message sent by the first execution body to obtain the second result.

7. A mimicry defense system based on a lightweight architecture, characterized in that: The lightweight architecture includes a first actuator and a second actuator connected in series. The mimicry defense system based on the lightweight architecture includes: A data message acquisition module, used to acquire input data messages; a first execution module, configured to perform service processing on the data message through the first execution body in an online state, obtain a first result, and transmit the first result to the second execution body in a silent state, where the second execution body is isolated from the outside; The second execution module is used to call the second execution body to perform business processing on the obtained data message to obtain a second result; determine whether the first result and the second result are consistent through the second execution body, and if they are inconsistent, determine the judgment result to be the second result; otherwise, determine the judgment result to be either the first result or the second result; and output the judgment result through the second execution body.

8. An electronic device, characterized in that: include: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: execute the steps of the mimicry defense method based on a lightweight architecture according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded by the processor and executes the steps of the mimicry defense method based on a lightweight architecture according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the steps of the mimicry defense method based on lightweight architecture as described in any one of claims 1 to 6.

Images