Safe operation method of operating system

Abstract

The invention discloses a safe operation method of an operating system, which comprises the following steps: acquiring access flow data of a Hfish honeypot in a subdomain operating system, and sending the access flow data to a network attack detection module; wherein the operating system comprises a plurality of sub-domain operating systems which are isolated from one another, and each sub-domain operating system comprises the Hfish honeypot; the network attack detection module is used for carrying out network attack detection on the access traffic data; determining the sub-domain operating system as a high-risk sub-domain operating system under the condition of determining that attack data exists in the access traffic data based on the network attack detection module; and executing a defense action based on a defense strategy in an attack defense module in the high-risk sub-domain operating system.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for securely running an operating system. Background Art

[0002] With the rapid development of computer technology, the security of operating systems, as the core of computer systems, has received increasing attention. Servers that deploy operating systems are often faced with malicious attacks from the network, and the trend is increasing year by year. After the evolution of network attack and defense, more and more malicious attacks can disguise themselves as normal communications, access data or instructions, bypass the firewall set by the operating system itself, invade servers, destroy the communication and functions of servers, leak important data and privacy data of users and enterprises, etc., and cause irreparable losses to users and enterprises. Therefore, how to achieve the safe operation of the operating system is a technical problem that needs to be solved urgently in related technologies. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method for secure operation of an operating system, so as to solve the technical problem that the secure operation of the operating system cannot be achieved.

[0004] In a first aspect, a method for secure operation of an operating system is provided, comprising: collecting access traffic data of an Hfish honeypot in a subdomain operating system, and sending the access traffic data to a network attack detection module; wherein the operating system comprises a plurality of mutually isolated subdomain operating systems, each of which comprises the Hfish honeypot; the network attack detection module is used to perform network attack detection on the access traffic data; in a case where it is determined by the network attack detection module that attack data exists in the access traffic data, the subdomain operating system is determined to be a high-risk subdomain operating system; and defense actions are performed based on the defense strategy in the attack defense module in the high-risk subdomain operating system.

[0005] In a second aspect, an electronic device is provided, comprising: a data processing module, used to collect access traffic data of an Hfish honeypot in a sub-domain operating system, and send the access traffic data to a network attack detection module; wherein the operating system comprises a plurality of mutually isolated sub-domain operating systems, each of which comprises the Hfish honeypot; the network attack detection module is used to perform network attack detection on the access traffic data; a processing module, used to determine the sub-domain operating system as a high-risk sub-domain operating system when the network attack detection module determines that attack data exists in the access traffic data; and a defense module, used to execute defense actions based on the defense strategy in the attack defense module in the high-risk sub-domain operating system.

[0006] According to a third aspect, an electronic device is provided. The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method according to the first aspect are implemented.

[0007] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method according to the first aspect are implemented.

[0008] In a fifth aspect, a computer program product is provided, the computer program product comprising a non-transitory computer-readable storage medium storing a computer program, the computer program being operable to cause a computer to execute part or all of the steps of the method of the first aspect.

[0009] In the embodiment of the present application, by dividing the operating system into multiple mutually isolated sub-domain operating systems, a high degree of isolation of the file system is achieved, which is beneficial to improving the security performance of the operating system; at the same time, by deploying an Hfish honeypot and an attack defense module in each sub-domain operating system, a defense strategy is deployed in the attack defense module, and the attack behavior can be captured and analyzed through the Hfish honeypot, which is beneficial to the attack defense module to perform effective defense actions based on the defense strategy, thereby improving the security performance of the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram showing a flow chart of a method for securely operating an operating system provided by an embodiment of the present application; Figure 2 A schematic diagram showing a flow chart of a method for securely operating an operating system provided by an embodiment of the present application; Figure 3 A schematic diagram showing a flow chart of a method for securely operating an operating system provided by an embodiment of the present application; Figure 4 A schematic diagram showing a flow chart of a method for securely operating an operating system provided by an embodiment of the present application; Figure 5 A schematic diagram showing a flow chart of a method for securely operating an operating system provided by an embodiment of the present application; Figure 6 A schematic diagram showing a flow chart of a method for securely operating an operating system provided by an embodiment of the present application; Figure 7 A schematic diagram showing the structure of an electronic device provided in an embodiment of the present application is shown; Figure 8 A schematic diagram of the hardware structure of an electronic device for executing the method for securely running an operating system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0012] Figure 1 A flowchart of a method for securely operating an operating system provided by an embodiment of the present application is shown, and the method can be executed by an electronic device, such as a terminal device or a server device. In other words, the method can be executed by software or hardware installed in a terminal device or a server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. Figure 1 As shown, the method may include the following steps.

[0013] S102: Collect access traffic data of the Hfish honeypot in the subdomain operating system, and send the access traffic data to the network attack detection module.

[0014] The operating system includes a plurality of mutually isolated subdomain operating systems, each of which includes the Hfish honeypot; the network attack detection module is used to perform network attack detection on the access traffic data. This embodiment can perform steps S102 to S106 for each subdomain operating system.

[0015] The multiple sub-domain operating systems mentioned above may be obtained by dividing the (original) operating system of the server. The multiple sub-domain operating systems are isolated from each other, which is beneficial to improving the security of the operating system.

[0016] This embodiment can deploy Hfish honeypot in each subdomain operating system. Hfish honeypot is an active defense technology that can actively expose some vulnerabilities and set some baits to lure attackers to attack, so as to capture and analyze attack behaviors, which is beneficial to improving the security of the operating system.

[0017] In one embodiment, before collecting the access traffic data of the Hfish honeypot in the sub-domain operating system, the method also includes: setting the single-level file structure of the server to a multi-level file structure; wherein the multi-level file structure includes a main domain file system and multiple sub-domain file systems; based on the main domain file system and the multiple sub-domain file systems, dividing the operating system into a main domain operating system and multiple sub-domain operating systems.

[0018] This embodiment can divide the operating system into a main domain operating system and multiple sub-domain operating systems. The multiple sub-domain operating systems are isolated from each other and can share memory space. By controlling the sub-domain operating systems to access the shared memory space, a high degree of isolation of the file system can be achieved, thereby improving the security of the operating system.

[0019] The network attack detection module may be located in the primary domain operating system, and may be used to detect whether there is an attack behavior, that is, to detect whether there is attack data in the access traffic data. The network attack detection module includes a network attack detection model, which may be pre-trained.

[0020] S104: When it is determined based on the network attack detection module that the access traffic data contains attack data, the sub-domain operating system is determined as a high-risk sub-domain operating system.

[0021] As mentioned above, the server operating system may include multiple subdomain operating systems, and S102 may collect access traffic data of the Hfish honeypot in each subdomain operating system. This step may determine the subdomain operating system with attack data as a high-risk subdomain operating system.

[0022] S106: Execute a defense action based on the defense strategy in the attack defense module in the high-risk sub-domain operating system.

[0023] The defense strategy may be obtained based on a HGSBAB (Honeypot Game Strategy Based on Attack Beliefs) model, and the HGSBAB model is generated by performing an attack and defense game on the Hfish honeypot.

[0024] Before executing this embodiment, the HGSBAB algorithm can be used in advance to conduct an attack and defense game on the Hfish honeypot to generate an HGSBAB model. The HGSBAB model is used to generate a defense strategy for the Hfish honeypot. The core of the defense strategy is to use game theory to optimize the operation of the Hfish honeypot, for example, to achieve an advantage in network confrontation by confusing and deceiving attackers.

[0025] Before executing this embodiment, the optimal defense strategy of the Hfish honeypot can be obtained based on the HGSBAB model.

[0026] This embodiment can also close the virtual security access rights of the high-risk sub-domain operating system to isolate the high-risk sub-domain operating system from the shared memory space, which is beneficial to improving the security of the operating system.

[0027] The secure operation method of the operating system provided in the embodiment of the present application achieves a high degree of isolation of the file system by dividing the operating system into multiple mutually isolated sub-domain operating systems, which is beneficial to improving the security performance of the operating system; at the same time, by deploying an Hfish honeypot and an attack defense module in each sub-domain operating system, a defense strategy is deployed in the attack defense module, and the attack behavior can be captured and analyzed through the Hfish honeypot, which is beneficial for the attack defense module to execute effective defense actions based on the defense strategy, thereby improving the security performance of the operating system.

[0028] Meanwhile, the defense strategy in the attack defense module can be obtained based on the HGSBAB model, which is generated by the attack and defense game of the Hfish honeypot, which is conducive to obtaining the optimal defense strategy and further improving the security performance of the operating system.

[0029] In one embodiment, sending the access traffic data to the network attack detection module includes: sending the access traffic data to the network attack detection module through an attack-trapping Hfish honeypot chain network; wherein the attack-trapping Hfish honeypot chain network includes: an Hfish management module set in the main domain operating system and the Hfish honeypot set in each of the sub-domain operating systems, the Hfish management module is connected to each of the Hfish honeypots, and the Hfish management module can be used to manage each of the Hfish honeypots.

[0030] This embodiment sets up an attack trapping Hfish honeypot chain network, and can utilize the active defense technology of the Hfish honeypot to actively expose some vulnerabilities and set some baits to lure attackers to attack, so that the attack behavior can be captured and analyzed, which is conducive to the attack defense module to perform effective defense actions based on the defense strategy and improve the security performance of the operating system.

[0031] In one embodiment, after executing the defense action, the method further includes: returning defense action execution information to the Hfish management module; wherein each of the sub-domain operating systems includes the attack defense module, each of the attack defense modules is connected to the Hfish management module to form a network attack defense chain network, and each of the attack defense modules in the sub-domain operating system is connected to the Hfish honeypot.

[0032] This embodiment is beneficial to improving the security performance of the operating system by setting up a network attack defense chain network and an attack trapping Hfish honeypot chain network.

[0033] In one embodiment, the method further includes: repeatedly executing the following steps to generate the HGSBAB model by performing an attack and defense game on the Hfish honeypot: 1) setting an initial attack belief value for the attacker participating in the attack and defense game; 2) based on the initial attack belief value, obtaining the expected benefits of each attack action performed by the attacker; 3) based on the expected benefits of each attack action, generating attack action execution information; 4) based on the attack action execution information, obtaining the expected benefits of the defender's defense action, and generating corresponding defense action execution information; 5) if the defense action execution information includes a blocking action, then according to the Bayesian rule, updating the attack belief value of the attacker.

[0034] This embodiment may pre-set a preset number threshold. When the number of iterations of the above five steps is greater than or equal to the preset number threshold, the attack and defense game of the Hfish honeypot may be stopped to obtain the HGSBAB model.

[0035] In one embodiment, the method further includes: based on the HGSBAB model and at least one of the following information, using the IUCT (Imporved Upper Confidence Bound Apply to Tce) algorithm to solve the pure strategy equilibrium of the NSE (N Successes are Enough) honeypot game to obtain the defense strategy corresponding to the Hfish honeypot: the loss caused by the attacker being captured by the Hfish honeypot when executing each attack action; the benefit of the attacker successfully executing each attack action; the cost of the attacker re-executing the attack; and the maintenance cost of the defender.

[0036] Among them, IUCT can be used in the selection stage of pure strategy equilibrium solution of NSE honeypot game, wherein the pure strategy equilibrium solution of NSE honeypot game can include multiple stages, such as selection stage, expansion stage, simulation stage and backtracking update stage.

[0037] This embodiment is conducive to obtaining the optimal defense strategy and improving the security performance of the operating system.

[0038] In one embodiment, after obtaining the defense strategy corresponding to the Hfish honeypot, the method further includes: using the virtual security access verification module in the main domain operating system to verify the virtual security access request sent by each sub-domain operating system; and sharing the defense strategy to the sub-domain operating system that has successfully been verified.

[0039] This embodiment can share the generated defense strategy with the successfully verified sub-domain operating system, and through the security verification operation on the sub-domain operating system, it is beneficial to improve the security performance of the operating system.

[0040] In one embodiment, sharing the defense strategy to the successfully verified sub-domain operating system includes: sharing the defense strategy to the successfully verified sub-domain operating system through a shared memory space; wherein a plurality of the sub-domain operating systems share the memory space.

[0041] In one embodiment, before collecting the access traffic data of the Hfish honeypot in the sub-domain operating system, the method further includes: performing model training to obtain the network attack detection module.

[0042] In one embodiment, the execution model training to obtain the network attack detection module includes: 1) collecting historical access traffic data, wherein the historical access traffic data includes attack data carrying attack tags; 2) dividing the historical access traffic data into a model training sample set and a model test sample set; 3) based on the model training sample set, using the DBN-IFWA (Deep Belief Network, Iterative Forward Weighted Averaging) algorithm to perform optimization training to construct an initial network attack detection model; 4) based on the model test sample set, determining the accuracy of the initial network attack detection model; 5) if the accuracy is greater than a preset accuracy threshold, deploying the initial network attack detection model in the network attack detection module.

[0043] This embodiment uses the DBN-IFWA algorithm to build an initial network attack detection model. By mining the deep data features of traffic data, it can automatically and accurately identify and detect traffic data of malicious network attacks. DBN-IFWA is an iterative weighted average algorithm that can be used to perform operations such as screening, filtering, and sorting of data.

[0044] To illustrate in detail the method for secure operation of an operating system provided in the embodiments of the present application, several specific embodiments will be described below.

[0045] This embodiment provides a method for secure operation of an operating system based on honeypot technology. Figure 2 As shown, the following steps are included: S1: Initialize the multi-domain isolation operating system of the current server based on the main domain file system and several sub-domain file systems of the joint multi-level file structure.

[0046] like Figure 3 As shown, S1 may include the following steps: S1-1: Set the single-level file structure of the current server to a joint multi-level file structure.

[0047] The combined multi-level file structure includes a bottom-level main domain file system and a plurality of combined multi-level sub-domain file systems, and the main domain file system and the plurality of sub-domain file systems are independent of each other.

[0048] S1-2: Based on the main domain file system and several sub-domain file systems of the combined multi-level file structure, a corresponding main domain operating system partition and several sub-domain operating system partitions are set.

[0049] A domain operating system refers to setting up multiple independent operating systems on the same server according to their functions. Each domain operating system can operate facing users, and the operations of different domain operating systems are isolated from each other.

[0050] S1-3: Set up a shared memory space, which is connected to the main domain-level file system and several subdomain-level file systems respectively.

[0051] S1-4: According to the system property information of the main domain operating system and several sub-domain operating systems that need to be set, configure the corresponding main domain operating system image file and sub-domain operating system image files.

[0052] S1-5: storing the main domain operating system image file and the sub-domain operating system image file in the corresponding main domain hierarchical file system and several sub-domain hierarchical file systems.

[0053] S1-6: Load and boot the kernel, pull the main domain operating system image file and the sub-domain operating system image file at one time in the kernel state, and start the corresponding main domain operating system and several sub-domain operating systems in the main domain operating system partition and several sub-domain operating system partitions.

[0054] S1-7: Integrate the main domain operating system and several sub-domain operating systems to obtain a multi-domain isolation operating system of the current server.

[0055] S2: In the multi-domain isolation operating system of the current server, the main domain operating system deploys the Hfish management module and the network attack detection module, and each sub-domain operating system deploys the Hfish honeypot and connects to the main domain Hfish management module to form an Hfish honeypot chain network.

[0056] Among them, the network attack detection module can be obtained based on the following process: the initial network parameters of the DBN (Deep Belief Network) network are used as the optimization target of the IFWA (Improved Fireworks Algorithm) optimization algorithm, and according to the optimization target, the IFWA optimization algorithm is used to optimize to obtain the optimal initial network parameters of the DBN network, and the model training sample set is input into the DBN network for optimization training to obtain the optimized network attack detection model.

[0057] like Figure 4 As shown, S2 may include the following steps: S2-1: Based on the multi-domain isolation operating system, deploy the Hfish management module, virtual security access verification module and network attack detection module in the main domain operating system.

[0058] The virtual security access verification module is connected to all sub-domain operating systems respectively, and is used to receive virtual security access requests sent by the sub-domain operating systems.

[0059] The training method of the network attack detection model is: (1) Collecting historical access traffic data containing a number of network attacks, and preprocessing and labeling the historical access traffic data to obtain a number of preprocessed historical access traffic data with preset network attack labels.

[0060] Among them, preprocessing includes data format unification, duplicate data cleaning, erroneous data deletion and sensitive data desensitization.

[0061] (2) Divide the preprocessed historical access traffic data into a model training sample set and a model testing sample set in a ratio of 7:3.

[0062] (3) Based on the model training sample set, the DBN-IFWA algorithm is used to perform optimization training and build the initial network attack detection model, including the following steps: ① The initial network parameters of the DBN network are used as the optimization target of the IFWA optimization algorithm, and the IFWA optimization algorithm is used to optimize according to the optimization target to obtain the optimal initial network parameters of the DBN network, including the following steps: a: The initial network parameters of the DBN network are used as the optimization target of the IFWA optimization algorithm.

[0063] b: Set the IFWA population parameters, maximum number of iterations and fitness function of the IFWA optimization algorithm, and take the optimization target as the position of the IFWA individual in the IFWA population.

[0064] c: According to the IFWA population parameters, the Circle chaotic mapping sequence is used to initialize the IFWA population to obtain the initialized IFWA population. The formula is:

[0065] In the formula, is the initial IFWA individual of Circle chaos mapping; is the randomly generated initial IFWA individual; It is the IFWA individual indicator.

[0066] d: According to the fitness function, calculate the fitness value of the IFWA individual in the initialized IFWA population. The formula is:

[0067] In the formula, For the initial IFWA individuals Fitness value; MSE is the prediction mean square error function; are the predicted value and the true value; L is the total number of IFWA individuals.

[0068] e: Get the explosion radius and number of sparks of IFWA individuals in the IFWA population. The formula is:

[0069] In the formula, For the initial IFWA individuals The number of sparks; is a constant; is the maximum fitness value in the initialized IFWA population; For the initial IFWA individuals The fitness value of is an infinitely small constant.

[0070]

[0071] In the formula, For the initial IFWA individuals Explosion radius; Adjusted constant for explosion radius; is the minimum fitness value in the initialized IFWA population.

[0072] f: According to the explosion radius and number of sparks of each initial IFWA individual in the initial IFWA population, fireworks are exploded to obtain an updated IFWA population. The formula is:

[0073] In the formula, For updated IFWA individuals; A random number between -1 and 1; For the initial IFWA individuals.

[0074] g: Use the Gaussian mutation algorithm to perform Gaussian mutation on the initialized IFWA population to generate a Gaussian mutated IFWA population. The formula is:

[0075] In the formula, is the IFWA individual of Gaussian variation; is a Gaussian distributed random number with mean and variance both 1; For the initial IFWA individuals.

[0076] h: Use the dynamic reverse learning algorithm to perform dynamic reverse learning on the initialized IFWA population to generate a dynamic reverse IFWA population. The formula is:

[0077] In the formula, For dynamic reverse IFWA individuals; is the initial IFWA individual; γ is the decreasing inertia coefficient, γ=0.9-0.5t / T; are the maximum and minimum values ​​of the vector space respectively; t is the iteration indicator; T is the iteration number threshold.

[0078] i: Calculate the fitness values ​​of all IFWA individuals in the updated IFWA population, the Gaussian mutated IFWA population, and the dynamically reversed IFWA population, and take the IFWA individual with the minimum fitness value as the optimal individual.

[0079] j: If the number of iterations reaches the iteration threshold or the fitness value of the optimal individual meets the requirements, the optimal solution corresponding to the current optimal individual is output to obtain the optimal initial network parameters of the DBN network.

[0080] ② Construct the network structure of the DBN network based on the optimal initial network parameters of the DBN network.

[0081] ③ Input the model training sample set into the DBN network for optimization training to build the initial network attack detection model.

[0082] (4) Input the model test sample set into the initial network attack detection model, perform model testing, and obtain several corresponding network attack prediction labels.

[0083] (5) Based on several network attack prediction labels and several corresponding network attack preset labels, the model test accuracy is obtained.

[0084] (6) If the model test accuracy is greater than the preset accuracy threshold, the optimal network attack detection model is output; otherwise, the optimization training continues.

[0085] S2-2: Generate corresponding Hfish honeypot elements according to the system attribute information of each sub-domain operating system and the application attribute information of the application provided by the sub-domain operating system.

[0086] S2-3: According to the Hfish honeypot elements, set up Hfish honeypots at all applications of the subdomain operating system, and set up network traffic probes on the Hfish honeypots.

[0087] The Hfish honeypot elements include the service framework agreement for building the virtual server corresponding to the Hfish honeypot, virtual server attribute information, applicable application attribute information, and applicable system attribute information.

[0088] S2-4: Connect the Hfish honeypots deployed in all sub-domain operating systems to the Hfish management module of the main domain operating system, and connect all network traffic probes to the network attack detection model of the main domain operating system to form an attack trapping Hfish honeypot chain network.

[0089] S3: In the main domain operating system of the multi-domain isolation operating system, the attack and defense game is performed on the Hfish honeypot to generate the HGSBAB model, and the optimal defense strategy is obtained and shared to each sub-domain file system to form a network attack defense chain network.

[0090] like Figure 5 As shown, S3 may include the following steps: S3-1: Based on the main domain operating system of the multi-domain isolation operating system, the HGSBAB algorithm is used to conduct an attack and defense game on the Hfish honeypot to generate the HGSBAB model.

[0091] The attack and defense game of Hfish honeypot includes the following steps: (1) Set the initial attack belief value for the attacker participating in the attack and defense game, and preset three types of attack actions for the attacker: low-frequency attack actions, high-frequency attack actions, and attack exit actions, and two types of defense actions for the defender: blocking actions and releasing actions.

[0092] (2) Based on the initial attack belief value, the expected benefits of the attacker performing three types of attack actions are obtained, including: the expected benefits of low-frequency attack actions, the expected benefits of high-frequency attack actions, and the expected benefits of attack exit actions.

[0093] (3) Based on the expected return of the attacker, execute the attack action with the highest expected return and send the corresponding attack action execution information to the defender.

[0094] (4) Based on the defense side, according to the attack action execution information, the expected benefits of executing three types of attack actions are obtained, including: the expected benefits of blocking actions and the expected benefits of releasing actions.

[0095] (5) Based on the expected benefit of the defender, execute the defense action with the highest expected benefit and generate the corresponding defense action execution information.

[0096] (6) If the defense action of the defender included in the defense action execution information is a blocking action, according to the Bayesian rule, the attack belief value of the attacker is updated to obtain an updated attack belief value, and the above steps are repeated according to the updated attack belief value to proceed to the next step of the Hfish honeypot attack and defense game.

[0097] (7) If the number of iterations of the Hfish honeypot attack and defense game is greater than the preset threshold, the Hfish honeypot attack and defense game is stopped.

[0098] The relevant formula of the HGSBAB model is as follows: The formula for the threshold attack belief value is:

[0099] In the formula, The threshold attack belief value for the attacker to perform an attack action; The attack belief value for the attacker to perform the attack exit action; The probability of executing a release action for the defender; The profit of the attacker for successfully executing low-frequency attack actions; The profit of the attacker for successfully executing high-frequency attack actions; The loss caused by the attacker's information being leaked when the attacker is caught by the Hfish honeypot while performing low-frequency attack actions; The loss caused by the attacker's high-frequency attack being captured by the Hfish honeypot and leaking the attacker's information; is the number of iterations of the attack and defense game of Hfish honeypot.

[0100] The update formula of attack belief value is:

[0101] In the formula, The attack belief value updated by the attacker when the defender's defensive action is a blocking action; The probability of the defender performing a blocking action, Much smaller than ; It is the initial attack belief value of the attacker.

[0102] The formula for equilibrium payoff is:

[0103] In the formula, For the The equilibrium payoff of the attacker in the next iteration; The attack belief value is updated after The equilibrium payoff of the attacker in the next iteration; The cost of re-performing the attack for the attacker; Cost of maintenance for the defender; The profit for the attacker to re-execute the attack.

[0104] like , the defender executes the release action; The formula for expected return is:

[0105] In the formula, For the The expected return of the attacker when the defender's defense action is a release action and the attacker's attack action is a low-frequency attack action; For the The expected return of the attacker when the defender's defense action is a release action and the attacker's attack action is a high-frequency attack action; The loss caused by the attacker's information being leaked when the attacker is caught by the Hfish honeypot while performing low-frequency attack actions; The loss caused by the attacker's high-frequency attack being captured by the Hfish honeypot and leaking the attacker's information; is the number of iterations of the attack and defense game of Hfish honeypot; For the The attack belief value updated by the attacker in this iteration; The profit of the attacker for successfully executing low-frequency attack actions; The profit of the attacker for successfully executing high-frequency attack actions; For the The equilibrium payoff of the attacker in the next iteration; The probability of executing a release action for the defender; The probability of executing a blocking action for the defender.

[0106] like , the attacker performs low-frequency attack actions.

[0107]

[0108] In the formula, For the The expected benefit of the attacker when the defender's defensive action is a blocking action and the attacker's attack action is a low-frequency attack action; For the The expected return of the attacker when the defender's defensive action is a blocking action and the attacker's attack action is a high-frequency attack action.

[0109] like , the attacker performs low-frequency attack actions.

[0110] S3-2: Based on the HGSBAB model, the IUCT algorithm is used to solve the pure strategy equilibrium of the NSE honeypot game, where N is the preset number threshold, and the optimal defense strategy of the Hfish honeypot is obtained and stored in the primary domain file system, including the following steps: (1) The preset number threshold N in the HGSBAB model, the initial states of the attacker and the defender , when the attacker performs low-frequency attack actions, he is captured by the Hfish honeypot and the attacker's information is leaked, causing losses , when the attacker performs high-frequency attack actions, the attacker is captured by the Hfish honeypot and the attacker's information is leaked, causing losses , the attacker's profit from successfully executing low-frequency attack actions , the attacker's profit from successfully executing high-frequency attack actions , the cost for the attacker to re-execute the attack , the cost of maintenance by the defender , enter the IUCT algorithm.

[0111] (2) Initial states of the attacker and defender , construct the root node of the search tree .

[0112] (3) According to the root node , search and obtain several child nodes, and the current search depth is less than the preset search depth threshold .

[0113] (4) Obtain the node evaluation values ​​of several child nodes. The formula is:

[0114] In the formula, For the The node evaluation value of the node; For the The average revenue value of the node; is the total number of explorations; For the The number of explorations of the node; is the balance coefficient; is the greedy coefficient; the average benefit value is based on the node Corresponding , , , , as well as Get.

[0115] (5) Add the node with the largest evaluation value to the search tree.

[0116] (6) If the current number of explorations is greater than or equal to the preset number threshold N, all corresponding root nodes in the search tree will be searched. The defense action strategy of the child node is output to obtain the optimal defense strategy of the Hfish honeypot.

[0117] S3-3: Use the virtual security access verification module to verify the virtual security access requests sent by all subdomain operating systems. If the verification is successful, the optimal defense strategy of the Hfish honeypot is shared to several subdomain file systems through the shared memory space.

[0118] S3-4: Set up attack defense modules at the Hfish honeypots of all sub-domain operating systems, and connect all attack defense modules to the Hfish management module deployed in the main domain operating system.

[0119] S3-5: Use the Hfish management module to write the optimal defense strategy into the attack defense module to form a network attack defense chain network.

[0120] The attack defense module is connected to the Hfish honeypot and the Hfish management module respectively, and is used to control the Hfish honeypot, perform defense actions on the attacker's network attack according to the optimal defense strategy, and return corresponding defense action execution information to the Hfish management module.

[0121] S4: Based on the attack trapping Hfish honeypot chain network and network attack defense chain network of multi-domain isolation operating system, malicious network attacks on the current server are trapped and defended.

[0122] like Figure 6 As shown, S4 may include the following steps: S4-1: Based on any subdomain operating system, use the network traffic probe to collect the access traffic data of the Hfish honeypot, and trap the Hfish honeypot chain network by attacking, and send the access traffic data to the network attack detection module.

[0123] S4-2: Use the network attack detection model deployed by the network attack detection module to perform network attack detection on the access traffic data. If the network attack detection result is that there is a malicious network attack, the access traffic data is used as attack traffic data to implement the malicious network attack trapping function.

[0124] S4-3: According to the transmission path and network traffic probe information of the attack traffic data in the attack trap Hfish honeypot chain network, the attack traffic data is traced to the source and the corresponding high-risk subdomain operating system is obtained.

[0125] S4-4: Based on the virtual security access verification module, the virtual security access rights of the high-risk subdomain operating system are closed to isolate the high-risk subdomain operating system from the shared memory space.

[0126] S4-5: Use the attack defense module corresponding to the high-risk subdomain operating system in the network attack defense chain network to execute defense actions according to the optimal defense strategy, and return the corresponding defense action execution information to the Hfish management module to realize the malicious network attack defense function.

[0127] The embodiment of the present application is based on the attack trapping Hfish honeypot chain network and network attack defense chain network of the multi-domain isolated operating system, which traps and defends against malicious network attacks on the current server, realizes 24-hour uninterrupted monitoring of the operation of the operating system, and can accurately and efficiently identify and promptly intercept malicious network attacks, thereby improving the security of operating system files and data.

[0128] In the embodiment of the present application, a multi-domain isolated operating system is deployed on a server, and a high degree of isolation of the file system is achieved by controlling the sub-domain operating system to access the shared memory space, thereby improving the data security and reliability of the file system of the main domain operating system, avoiding malicious network attacks from invading the file system of the main domain operating system and causing losses, and limiting the impact of malicious network attacks to the sub-domain operating system, thereby reducing the degree of damage caused by malicious network attacks.

[0129] The embodiment of the present application constructs an attack trapping Hfish honeypot chain network, which can trap malicious network attacks while ensuring the security of the operating system, facilitate subsequent analysis of the attack behavior, improve the functionality of operating system operation security monitoring, and can be applied to continuously updated malicious network attack technologies.

[0130] In the embodiment of the present application, the HGSBAB algorithm is used to conduct an attack and defense game on the Hfish honeypot, and the Hfish honeypot is trained to be able to execute the optimal defense strategy to the maximum extent. It can fully weigh the risk of bearing the attack and reducing the suspicion of the attacker according to the attacker's strategy to obtain more information benefits from the attacker, and select the best response, thereby improving the response speed of the Hfish honeypot to malicious network attacks and the effectiveness of the defense strategy, and accelerating the efficiency and speed of the execution of defense actions.

[0131] In the embodiment of the present application, the DBN-IFWA algorithm is used to construct an initial network attack detection model, and the traffic data of malicious network attacks is automatically and accurately identified and detected by mining the deep data features of the traffic data. The network traffic data collected by the Hfish honeypot is used to perform real-time and dynamic malicious network attack detection, thereby improving the intelligence and accuracy of the operating system operation security monitoring and ensuring the stability and security of the operating system operation.

[0132] Figure 7 A schematic structural diagram of an electronic device 700 provided in an embodiment of the present application is shown, and the electronic device 700 includes the following modules.

[0133] The data processing module 702 is used to collect the access traffic data of the Hfish honeypot in the sub-domain operating system and send the access traffic data to the network attack detection module; wherein the operating system includes a plurality of mutually isolated sub-domain operating systems, each of which includes the Hfish honeypot; the network attack detection module is used to perform network attack detection on the access traffic data.

[0134] The processing module 704 is used to determine the sub-domain operating system as a high-risk sub-domain operating system when the network attack detection module determines that the access traffic data contains attack data.

[0135] The defense module 706 is used to execute defense actions based on the defense strategy in the attack defense module in the high-risk sub-domain operating system.

[0136] The defense strategy may be obtained based on a HGSBAB model, and the HGSBAB model is generated by performing an attack and defense game on the Hfish honeypot.

[0137] In the embodiment of the present application, by dividing the operating system into multiple mutually isolated sub-domain operating systems, a high degree of isolation of the file system is achieved, which is beneficial to improving the security performance of the operating system; at the same time, by deploying an Hfish honeypot and an attack defense module in each sub-domain operating system, a defense strategy is deployed in the attack defense module, and the attack behavior can be captured and analyzed through the Hfish honeypot, which is beneficial to the attack defense module to perform effective defense actions based on the defense strategy, thereby improving the security performance of the operating system.

[0138] The electronic device 700 provided in the embodiment of the present application can execute any embodiment described in the aforementioned method embodiment and realize the functions and beneficial effects of any embodiment described in the aforementioned method embodiment, which will not be repeated here.

[0139] Among them, the above modules in the electronic device provided by the embodiment of the present application can also implement the method steps provided by the above method embodiment. Alternatively, the electronic device provided by the embodiment of the present application can also include other modules in addition to the above modules to implement the method steps provided by the above method embodiment. And the electronic device provided by the embodiment of the present application can achieve the technical effects that can be achieved by the above method embodiment.

[0140] An embodiment of the present application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the embodiment of the method for secure operation of the above-mentioned operating system are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0141] Figure 8 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device includes a processor, and may also include an internal bus, a network interface, and a memory. Among them, the memory may include a memory, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

[0142] The processor, network interface and memory can be interconnected through an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0143] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0144] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it. The processor executes the program stored in the memory and is specifically used to perform: Figure 1-6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0145] The above application Figure 1-6The method disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0146] The electronic device can also execute any embodiment described in the aforementioned method embodiment, and realize the functions and beneficial effects of any embodiment described in the aforementioned method embodiment, which will not be repeated here.

[0147] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0148] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the embodiment of the safe operation method of the above-mentioned operating system is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the computer-readable storage medium, such as read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk, etc.

[0149] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to execute part or all of the steps of the above-mentioned operating system security operation method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0150] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0151] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0154] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0155] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0156] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0157] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0158] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0159] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for secure operation of an operating system, characterized in that: include: Collecting access traffic data of the Hfish honeypot in the subdomain operating system, and sending the access traffic data to the network attack detection module; wherein the operating system includes a plurality of mutually isolated subdomain operating systems, each of which includes the Hfish honeypot; the network attack detection module is used to perform network attack detection on the access traffic data; In a case where it is determined based on the network attack detection module that the access traffic data contains attack data, determining the subdomain operating system as a high-risk subdomain operating system; Based on the defense strategy in the attack defense module in the high-risk sub-domain operating system, a defense action is executed.

2. The method according to claim 1, characterized in that The sending of the access traffic data to the network attack detection module comprises: By attacking and trapping the Hfish honeypot chain network, the access traffic data is sent to the network attack detection module; The attack trapping Hfish honeypot chain network includes: an Hfish management module arranged in the main domain operating system and the Hfish honeypot arranged in each of the subdomain operating systems, and the Hfish management module is connected to each of the Hfish honeypots.

3. The method according to claim 2, characterized in that After executing the defense action, the method further includes: Returning defense action execution information to the Hfish management module; Each of the subdomain operating systems includes the attack defense module, each of the attack defense modules is connected with the Hfish management module to form a network attack defense chain network, and each of the attack defense modules in the subdomain operating system is connected with the Hfish honeypot.

4. The method according to any one of claims 1 to 3, characterized in that: The method further includes: repeatedly executing the following steps to generate the HGSBAB model by performing an attack and defense game on the Hfish honeypot: Set the initial attack belief value for the attacker participating in the attack and defense game; Based on the initial attack belief value, obtaining the expected benefits of each attack action performed by the attacker; Generate attack action execution information based on the expected benefits of each attack action; Based on the attack action execution information, the expected benefit of the defense action of the defender is obtained, and corresponding defense action execution information is generated; If the defense action execution information includes a blocking action, the attack belief value of the attacker is updated according to the Bayesian rule.

5. The method according to claim 4, characterized in that The method further comprises: Based on the HGSBAB model and at least one of the following information, the IUCT algorithm is used to solve the pure strategy equilibrium of the NSE honeypot game to obtain the defense strategy corresponding to the Hfish honeypot: The losses caused by the attacker being captured by the Hfish honeypot when executing each attack action; the benefits of the attacker successfully executing each attack action; the cost of the attacker re-executing the attack; and the maintenance cost of the defender.

6. The method according to claim 5, characterized in that After obtaining the defense strategy corresponding to the Hfish honeypot, the method further includes: Using a virtual security access verification module in the main domain operating system, verifying the virtual security access request sent by each of the sub-domain operating systems; The defense strategy is shared with the successfully verified sub-domain operating system.

7. The method according to claim 6, characterized in that The step of sharing the defense strategy to the successfully verified subdomain operating system includes: The defense strategy is shared to the successfully verified sub-domain operating system through a shared memory space; wherein a plurality of the sub-domain operating systems share the memory space.

8. The method according to claim 1, characterized in that Before collecting the access traffic data of the Hfish honeypot in the subdomain operating system, the method further includes: Setting the single-level file structure of the server to a multi-level file structure; wherein the multi-level file structure includes a main domain file system and multiple sub-domain file systems; Based on the main domain file system and the multiple sub-domain file systems, the operating system is divided into a main domain operating system and the multiple sub-domain operating systems.

9. The method according to claim 1, characterized in that: Before collecting the access traffic data of the Hfish honeypot in the subdomain operating system, the method further includes: Execute model training to obtain the network attack detection module.

10. The method according to claim 9, characterized in that The execution model training to obtain the network attack detection module includes: Collecting historical access traffic data, wherein the historical access traffic data includes attack data carrying attack tags; Dividing the historical access traffic data into a model training sample set and a model testing sample set; Based on the model training sample set, the DBN-IFWA algorithm is used for optimization training to build an initial network attack detection model; Determining the accuracy of the initial network attack detection model based on the model test sample set; If the accuracy is greater than a preset accuracy threshold, the initial network attack detection model is deployed in the network attack detection module.

Images