Heterogeneous executor scheduling method and system oriented to unknown attack endogenous perception
By constructing heterogeneous executors and calculating their similarity and threat, and scheduling with time slice strategies, the problem of failure to effectively deal with unknown vulnerabilities in the existing technology is solved, and an efficient and reliable internal security defense mechanism is achieved.
Patent Information
- Application Number
- CN202410523079.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-28
- Publication Date
- 2025-02-18
AI Technical Summary
The existing technology is difficult to effectively detect and deal with unknown vulnerability threats based on software and hardware, and the existing mimicry scheduling algorithms do not fully consider the threat level of the heterogeneous executor itself, and it is difficult to meet the needs of dynamics and heterogeneity at the same time, resulting in algorithm complexity. High and redundant waste.
By building isomeric executors with the same functions but different components, obtain the similarity and threat degree between the isomeric executors, build a similarity matrix and threat degree matrix, calculate the comprehensive scheduling indicators, and combine the time slice strategy for scheduling, so as to Achieve perception and resistance to unknown attacks.
Improves the perceived speed and accuracy of unknown attacks, enhances the security of the system and the ability to resist unknown threats, achieves a balance between dynamics, reliability and stability, and reduces time complexity.
Smart Images
Figure CN119483992A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security, and relates to a heterogeneous execution body scheduling method and system for endogenous perception of unknown attacks. Background Art
[0002] As cloud service technology develops rapidly, security issues are also gradually becoming prominent. Among them, unknown vulnerabilities have become one of the main threats to cloud security. Due to the complexity and scale of cloud services, traditional security measures often find it difficult to effectively detect and respond to unknown vulnerability threats based on software and hardware. However, traditional means may not be able to provide sufficient protection against attacks on unknown vulnerabilities. At the same time, the characteristics and architecture of cloud services give it a wide attack surface, and attackers may use various means to find and exploit security vulnerabilities. This makes it more difficult to protect the security of cloud services and easily leads to a "easy to attack and difficult to defend" situation in cyberspace. Applying the endogenous perception technology of unknown attacks to the cloud environment to build a mimic cloud service will greatly enhance the security defense effectiveness of the system, greatly increase the difficulty of attackers, and enhance the security of the cloud service system.
[0003] Endogenous perception of unknown attacks can be used in conjunction with the dynamic heterogeneous redundancy (DHR) architecture to achieve the ability to perceive and resist unknown attacks. The DHR architecture forms a heterogeneous redundant service environment by building multiple heterogeneous executors that have different software and hardware components and dynamically schedule and select them when processing requests. The design of this architecture enables the system to proactively defend against attacks because each request is processed by multiple heterogeneous executors, thereby avoiding attacks targeting specific vulnerabilities. By introducing dynamicity and generalized uncertainty, the DHR architecture provides higher security, reliability, and performance.
[0004] The heterogeneous executor scheduling algorithm for endogenous perception of unknown attacks rationally allocates and manages system resources through steps such as heterogeneous executor allocation, task scheduling and priority division, dynamic resource allocation, task coordination and communication, and real-time scheduling and optimization, improves the speed and accuracy of perception of unknown attacks, and realizes coordination and optimization between tasks, thereby improving the security of the system and its ability to resist unknown threats. The algorithm can adapt to different system architectures and task requirements, make full use of heterogeneous resources, and realize intelligent task scheduling and optimization. It is an efficient and reliable internal security defense mechanism.
[0005] In the scheduling algorithm, the scheduling strategy is a very important link. It needs to select appropriate heterogeneous executors based on multiple factors such as the system's available resources, requirements, and the status of heterogeneous executors to build a service environment with dynamic redundancy characteristics. When scheduling, the scheduling strategy needs to take into account the dynamic changes of the system, such as the status of heterogeneous executors, load conditions, and changes in heterogeneous executor components. In order to maintain the uncertainty and flexibility of the system, the scheduling strategy will dynamically select heterogeneous executors and allocate requests according to certain rules. In addition, the scheduling strategy also needs to collaborate with other key technologies and modules such as arbitration strategy, negative feedback strategy, and cleaning offline strategy to ensure the efficient operation and optimization of the entire architecture.
[0006] There are some limitations in the current research on scheduling execution sets. Existing mimic scheduling algorithms have not fully considered the threat level of heterogeneous execution bodies themselves, and it is difficult to meet the requirements of dynamics and heterogeneity at the same time. In addition, some algorithms are highly complex, face difficulties in practical applications, and may lead to redundancy and waste. Summary of the invention
[0007] The purpose of the present invention is to solve the problem that the threat level of heterogeneous executors themselves has not been fully considered in the prior art, and it is difficult to simultaneously meet the requirements of dynamics and heterogeneity. At the same time, some algorithms are highly complex and may cause redundant waste. A heterogeneous executor scheduling method and system with endogenous perception of unknown attacks is provided.
[0008] In order to achieve the above object, the present invention adopts the following technical solutions:
[0009] A heterogeneous executor scheduling method for endogenous perception of unknown attacks, comprising:
[0010] Construct heterogeneous executable bodies with the same functions but different components, and divide the constructed heterogeneous executable bodies into several scheduling sets, wherein the number of heterogeneous executable bodies in each scheduling set is different; and construct an execution pool list according to the redundancy r of the heterogeneous executable bodies and the number n of heterogeneous executable bodies in the scheduling set, wherein the execution pool list includes Execution pools;
[0011] Based on the constructed heterogeneous executors, obtain the similarity and threat degree between the heterogeneous executors in the scheduling set;
[0012] Based on the similarity and threat degree between each heterogeneous executor in the scheduling set, a similarity matrix and a threat degree matrix of the scheduling set are obtained respectively;
[0013] Based on the similarity matrix and threat matrix of the scheduling set, the execution pool similarity index and threat index are obtained respectively, and finally the comprehensive scheduling index is obtained;
[0014] Based on the comprehensive scheduling indicators, the execution pool list The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy.
[0015] A further improvement of the present invention is:
[0016] Furthermore, based on the constructed heterogeneous executables, the similarity between the heterogeneous executables in the scheduling set is obtained, specifically:
[0017] Obtain the similarity of common vulnerabilities between heterogeneous executables, specifically:
[0018]
[0019] Where i∈{y-years+1,...,y-2,y-1,y}; α represents the time weight factor; y represents the year; years represents the year of the vulnerability, which is at least 1 year; α i Factor represents the time weight factor for the i-th year;
[0020] The similarity between heterogeneous executors in the scheduling set is obtained through the similarity of the common vulnerabilities between heterogeneous executors, which is specifically:
[0021]
[0022] Among them, β represents the spatial weight factor, tiers represents the number of component layers; E j and E k Indicates different heterogeneous executors; heterogeneous executors are represented by E i ={C lp |l,p=1,2,3,…,n}, where C lp represents the pth component of the lth class, v i (C lp ,C lq ) indicates the same type of components C lp and C lq The total number of vulnerabilities, β l Represents the spatial weight factor of the l-th layer component.
[0023] Furthermore, based on the similarity between each heterogeneous executor in the scheduling set, the similarity matrix of the scheduling set is obtained respectively, specifically: the similarity matrix composed of the similarities between the heterogeneous executors:
[0024]
[0025] Among them, C jk CVI y (E J,E k ), indicating the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix;
[0026] Based on the similarity matrix C of the scheduling set in formula (3) l The element C in jk , and obtain the similarity index of the execution pool, specifically:
[0027]
[0028] Among them, C p is the similarity index of the execution pool, P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
[0029] Furthermore, the threat level between the heterogeneous execution bodies in the scheduling set is obtained, specifically:
[0030] Get the vulnerability threat level of the heterogeneous executable, specifically:
[0031]
[0032] Among them, B i = {B ij |B ij is the vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m};
[0033] Heterogeneous Executor E i With heterogeneous executive E j The common vulnerability threat levels are as follows:
[0034] t ij =∑CVSS(B i ∩B j ) (6)
[0035] Heterogeneous Executor E i With heterogeneous executive E j The overall threat level is:
[0036] m ij =t ij +t i +t j (7).
[0037] Further, the threat degree matrix of the scheduling set is obtained, specifically: the threat degree matrix M composed of the threat degrees between all heterogeneous executors in the executor set l , specifically:
[0038]
[0039] Among them, M l The elements in represent the comprehensive threat level between each two heterogeneous executives;
[0040] Based on the threat degree matrix of the scheduling set, the threat degree index of the execution pool is obtained, specifically: the threat degree index M of the execution pool p According to the threat degree matrix M in formula (8): l The element m in jk Through formula (9), we get:
[0041]
[0042] Among them, M P An indicator representing the threat level of the execution pool;
[0043] The comprehensive scheduling index is:
[0044] CM p =C p ×M p (10).
[0045] Furthermore, based on the comprehensive scheduling indicators, The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy. Specifically, the execution pool list is arranged in ascending order according to the comprehensive scheduling index to obtain a sorted execution pool list and use it as the scheduling plan; based on the time slice strategy, the time slice is adjusted according to the priority. The higher the priority of the execution pool, the longer the time slice, otherwise the shorter the time slice; if the time slice of the previous execution pool reaches the preset time, the next execution pool is selected.
[0046] A heterogeneous executor scheduling system for endogenous perception of unknown attacks, comprising:
[0047] A construction module, wherein the construction module constructs heterogeneous executable bodies with the same functions but different components, and divides the constructed heterogeneous executable bodies into a plurality of scheduling sets, wherein the number of heterogeneous executable bodies in each scheduling set is different; and an execution pool list is constructed according to the redundancy r of the heterogeneous executable bodies and the number n of heterogeneous executable bodies in the scheduling set, wherein the execution pool list includes Execution pools;
[0048] A first acquisition module, which acquires the similarity and threat degree between the heterogeneous execution bodies in the scheduling set based on the constructed heterogeneous execution bodies;
[0049] A second acquisition module, which acquires a similarity matrix and a threat matrix of the scheduling set based on the similarities and threat levels between the heterogeneous execution bodies in the scheduling set;
[0050] A third acquisition module, which obtains the execution pool similarity index and the threat index based on the similarity matrix and the threat matrix of the scheduling set, and finally obtains the comprehensive scheduling index;
[0051] A sorting module is used to sort the execution pool list based on the comprehensive scheduling index. The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy.
[0052] Furthermore, based on the constructed heterogeneous executables, the similarity between the heterogeneous executables in the scheduling set is obtained, specifically:
[0053] Obtain the similarity of common vulnerabilities between heterogeneous executables, specifically:
[0054]
[0055] Where i∈{y-years+1,...,y-2,y-1,y}; α represents the time weight factor; y represents the year; years represents the year of the vulnerability, which is at least 1 year; α i Factor represents the time weight factor for the i-th year;
[0056] The similarity between heterogeneous executors in the scheduling set is obtained through the similarity of the common vulnerabilities between heterogeneous executors, which is specifically:
[0057]
[0058] Among them, β represents the spatial weight factor, tiers represents the number of component layers; E j and E k Indicates different heterogeneous executors; heterogeneous executors are represented by E i ={C lp |l,p=1,2,3,…,n}, where C lp represents the pth component of the lth class, v i (C lp ,C lq ) indicates the same type of components C lp and C lq The total number of vulnerabilities, β l Represents the spatial weight factor of the l-th layer component.
[0059] Furthermore, based on the similarity between each heterogeneous executor in the scheduling set, the similarity matrix of the scheduling set is obtained respectively, specifically: the similarity matrix composed of the similarities between the heterogeneous executors:
[0060]
[0061] Among them, C jk CVI y (E J ,E k ), indicating the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix;
[0062] Based on the similarity matrix C of the scheduling set in formula (13) l The element C in jk , and obtain the similarity index of the execution pool, specifically:
[0063]
[0064] Among them, C p is the similarity index of the execution pool, P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
[0065] Furthermore, the threat level between the heterogeneous execution bodies in the scheduling set is obtained, specifically:
[0066] Get the vulnerability threat level of the heterogeneous executable, specifically:
[0067]
[0068] Among them, B i = {B ij |B ij is the vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m};
[0069] Heterogeneous Executor E i With heterogeneous executive E j The common vulnerability threat levels are as follows:
[0070] t ij =∑CVSS(B i ∩B j ) (16)
[0071] Heterogeneous Executor E i With heterogeneous executive E j The overall threat level is:
[0072] m ij =t ij +t i +t j (17).
[0073] Further, the threat degree matrix of the scheduling set is obtained, specifically: the threat degree matrix M composed of the threat degrees between all heterogeneous executors in the executor set l , specifically:
[0074]
[0075] Among them, M l The elements in represent the comprehensive threat level between each two heterogeneous executives;
[0076] Based on the threat degree matrix of the scheduling set, the threat degree index of the execution pool is obtained, specifically: the threat degree index M of the execution pool p According to the threat degree matrix M in formula (18): l The element m in jk Through formula (19), we get:
[0077]
[0078] Among them, M P An indicator representing the threat level of the execution pool;
[0079] The comprehensive scheduling index is:
[0080] CM p =C p ×M p (20).
[0081] Furthermore, based on the comprehensive scheduling indicators, The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy. Specifically, the execution pool list is arranged in ascending order according to the comprehensive scheduling index to obtain a sorted execution pool list and use it as the scheduling plan; based on the time slice strategy, the time slice is adjusted according to the priority. The higher the priority of the execution pool, the longer the time slice, otherwise the shorter the time slice; if the time slice of the previous execution pool reaches the preset time, the next execution pool is selected.
[0082] A terminal device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.
[0083] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.
[0084] Compared with the prior art, the present invention has the following beneficial effects:
[0085] The present invention comprehensively considers the similarity and threat level of heterogeneous executors, and uses two quantitative indicators, similarity and threat level, to calculate the comprehensive indicator, ensuring a balance between reliability and stability; making scheduling decisions more intelligent, while incorporating time slice strategies, to a certain extent solving the problem of insufficient algorithm dynamics. The present invention has good dynamics, can obtain better scheduling effects, achieves a balance between dynamics, reliability and stability, and has low time complexity. BRIEF DESCRIPTION OF THE DRAWINGS
[0086] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.
[0087] Figure 1 A schematic diagram of a flow chart of a heterogeneous execution body scheduling method for endogenous perception of unknown attacks of the present invention;
[0088] Figure 2 It is a schematic diagram of the structure of the heterogeneous executor scheduling system for endogenous perception of unknown attacks of the present invention;
[0089] Figure 3 The figure is another flowchart of a heterogeneous executor scheduling method based on endogenous perception of unknown attacks. DETAILED DESCRIPTION
[0090] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.
[0091] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0092] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.
[0093] In the description of the embodiments of the present invention, it should be noted that if the terms "upper", "lower", "horizontal", "inner", etc. indicate an orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the product of the invention is usually placed when in use, it is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.
[0094] In addition, if the term "horizontal" appears, it does not mean that the component must be absolutely horizontal, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", which does not mean that the structure must be completely horizontal, but can be slightly tilted.
[0095] In the description of the embodiments of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0096] The present invention is further described in detail below in conjunction with the accompanying drawings:
[0097] See also Figure 1 The present invention discloses a heterogeneous execution body scheduling method for endogenous perception of unknown attacks, including:
[0098] S101, constructing heterogeneous executable bodies with the same functions but different components, and dividing the constructed heterogeneous executable bodies into a plurality of scheduling sets, wherein the number of heterogeneous executable bodies in each scheduling set is different; and constructing an execution pool list according to the redundancy r of the heterogeneous executable bodies and the number n of heterogeneous executable bodies in the scheduling set, wherein the execution pool list includes Execution pools;
[0099] S102, based on the constructed heterogeneous executable bodies, obtaining similarities and threat levels between the heterogeneous executable bodies in the scheduling set;
[0100] Obtain the similarity of common vulnerabilities between heterogeneous executables, specifically:
[0101]
[0102] Where i∈{y-years+1,...,y-2,y-1,y}; α represents the time weight factor; y represents the year; and years represents the year of the vulnerability, which is at least 1 year. i The factor represents the time weight factor of the i-th year, which considers the importance of constructing historical vulnerabilities from the time dimension, and can also be understood as the possibility of attackers exploiting vulnerabilities.
[0103] The similarity between heterogeneous executors in the scheduling set is obtained through the similarity of the common vulnerabilities between heterogeneous executors, which is specifically:
[0104]
[0105] Among them, β represents the spatial weight factor, tiers represents the number of component layers; E j and E k Indicates different heterogeneous executors; heterogeneous executors are represented by E i ={C lp |l,p=1,2,3,…,n}, where C lp represents the pth component of the lth class, v i (C lp ,C lq ) indicates the same type of components C lp and C lq The total number of vulnerabilities; β l Represents the spatial weight factor of the l-th layer component. It considers the importance of each layer of components from the spatial dimension, and can also be defined as the possibility of an attacker using this component to attack.
[0106] Get the threat level between the heterogeneous executors in the scheduling set, specifically: Get the threat level of the vulnerability of the heterogeneous executor itself, specifically:
[0107]
[0108] Among them, B i = {B ij |B ij is the vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m};
[0109] Furthermore, the heterogeneous executive E i With heterogeneous executive E j The common vulnerability threat levels are as follows:
[0110] tij =∑CVSS(B i ∩B j ) (4)
[0111] Furthermore, the heterogeneous executive E i With heterogeneous executive E j The overall threat level is:
[0112] m ij =t ij +t i +t j (5)
[0113] S103, based on the similarities and threat levels between the heterogeneous executors in the scheduling set, respectively obtain a similarity matrix and a threat level matrix of the scheduling set;
[0114] Based on the similarity between each heterogeneous executor in the scheduling set, the similarity matrix of the scheduling set is obtained, specifically: the similarity matrix composed of the similarities between heterogeneous executors:
[0115]
[0116] Among them, C jk CVI y (E J ,E k ), indicating the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix;
[0117] Get the threat degree matrix of the scheduling set, specifically: the threat degree matrix M composed of the threat degrees between all heterogeneous executors in the executor set l , specifically:
[0118]
[0119] Among them, M l The elements in represent the comprehensive threat level between each two heterogeneous executives;
[0120] S104, based on the similarity matrix and threat matrix of the scheduling set, respectively obtain the execution pool similarity index and threat index, and finally obtain the comprehensive scheduling index.
[0121] Based on the similarity matrix C of the scheduling set in formula (6) l The element C in jk , and obtain the similarity index of the execution pool, specifically:
[0122]
[0123] Among them, C p is the similarity index of the execution pool, P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
[0124] Based on the threat degree matrix of the scheduling set, the threat degree index of the execution pool is obtained, specifically: the threat degree index M of the execution pool p The threat level matrix M in the corresponding formula (7) is l The element m in jk Through formula (9), we get:
[0125]
[0126] Among them, M P Represents the threat level indicator of the execution pool.
[0127] The comprehensive scheduling indicators are:
[0128] CM p =C p ×M p (10)
[0129] S105, based on the comprehensive scheduling index, the execution pool list The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy.
[0130] Arrange the execution pool list in ascending order according to the comprehensive scheduling indicators to obtain a sorted execution pool list and use it as the scheduling plan; based on the time slice strategy, the time slice is adjusted according to the priority. The higher the priority of the execution pool, the longer the time slice, otherwise the shorter the time slice; if the time slice of the previous execution pool reaches a certain time, the next execution pool is selected.
[0131] See also Figure 2 The present invention discloses a heterogeneous execution body scheduling system for endogenous perception of unknown attacks, including:
[0132] A construction module, wherein the construction module constructs heterogeneous executable bodies with the same functions but different components, and divides the constructed heterogeneous executable bodies into a plurality of scheduling sets, wherein the number of heterogeneous executable bodies in each scheduling set is different; and an execution pool list is constructed according to the redundancy r of the heterogeneous executable bodies and the number n of heterogeneous executable bodies in the scheduling set, wherein the execution pool list includes Execution pools;
[0133] A first acquisition module, which acquires the similarity and threat degree between the heterogeneous execution bodies in the scheduling set based on the constructed heterogeneous execution bodies;
[0134] A second acquisition module, which acquires a similarity matrix and a threat matrix of the scheduling set based on the similarities and threat levels between the heterogeneous execution bodies in the scheduling set;
[0135] A third acquisition module, which obtains the execution pool similarity index and the threat index based on the similarity matrix and the threat matrix of the scheduling set, and finally obtains the comprehensive scheduling index;
[0136] A sorting module is used to sort the execution pool list based on the comprehensive scheduling index. The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy.
[0137] Based on the constructed heterogeneous executors, the similarity between the heterogeneous executors in the scheduling set is obtained, specifically:
[0138] Obtain the similarity of common vulnerabilities between heterogeneous executables, specifically:
[0139]
[0140] Where i∈{y-years+1,...,y-2,y-1,y}; α represents the time weight factor; y represents the year; and years represents the year of the vulnerability, which is at least 1 year. i The factor represents the time weight factor of the i-th year, which considers the importance of constructing historical vulnerabilities from the time dimension, and can also be understood as the possibility of attackers exploiting vulnerabilities.
[0141] The similarity between heterogeneous executors in the scheduling set is obtained through the similarity of the common vulnerabilities between heterogeneous executors, which is specifically:
[0142]
[0143] Among them, β represents the spatial weight factor, tiers represents the number of component layers; E j and E k Indicates different heterogeneous executors; heterogeneous executors are represented by E i ={C lp |l,p=1,2,3,…,n}, where C lp represents the pth component of the lth class, v i (C lp ,C lq ) indicates the same type of components C lp and C lq The total number of vulnerabilities; β lRepresents the spatial weight factor of the l-th layer component. It considers the importance of each layer of components from the spatial dimension, and can also be defined as the possibility of an attacker using this component to attack.
[0144] Based on the similarity between each heterogeneous executor in the scheduling set, the similarity matrix of the scheduling set is obtained respectively, specifically: the similarity matrix composed of the similarities between heterogeneous executors:
[0145]
[0146] Among them, C jk CVI y (E J ,E k ), indicating the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix;
[0147] Based on the similarity matrix C of the scheduling set in formula (13) l The element C in jk , and obtain the similarity index of the execution pool, specifically:
[0148]
[0149] Among them, C p is the similarity index of the execution pool, P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
[0150] Get the threat level between the heterogeneous executors in the scheduling set, specifically:
[0151] Get the vulnerability threat level of the heterogeneous executable, specifically:
[0152]
[0153] Among them, B i = {B ij |B ij is the vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m};
[0154] Heterogeneous Executor E i With heterogeneous executive E j The common vulnerability threat levels are as follows:
[0155] t ij =∑CVSS(B i ∩B j ) (16)
[0156] Heterogeneous Executor E i With heterogeneous executive E j The overall threat level is:
[0157] m ij =t ij +t i +t j (17)
[0158] Get the threat degree matrix of the scheduling set, specifically: the threat degree matrix M composed of the threat degrees between all heterogeneous executors in the executor set l , specifically:
[0159]
[0160] Among them, M l The elements in represent the comprehensive threat level between each two heterogeneous executives;
[0161] Based on the threat degree matrix of the scheduling set, the threat degree index of the execution pool is obtained, specifically: the threat degree index M of the execution pool p According to the threat degree matrix M in formula (18): l The element m in jk Through formula (19), we get:
[0162]
[0163] Among them, M P An indicator representing the threat level of the execution pool;
[0164] The comprehensive scheduling index is:
[0165] CM p =C p ×M p (20)
[0166] Based on the comprehensive scheduling indicators, the execution pool list The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy. Specifically, the execution pool list is arranged in ascending order according to the comprehensive scheduling index to obtain a sorted execution pool list and use it as the scheduling plan; based on the time slice strategy, the time slice is adjusted according to the priority. The higher the priority of the execution pool, the longer the time slice, otherwise the shorter the time slice; if the time slice of the previous execution pool reaches the preset time, the next execution pool is selected.
[0167] Example: See Figure 3The present invention proposes a heterogeneous executor scheduling method for endogenous perception of unknown attacks. First, the heterogeneity and threat level of the execution pool are obtained through a quantitative evaluation method of the heterogeneity and threat level between heterogeneous executors in the mimic cloud. Then the two calculate the comprehensive index of the execution pool to obtain a scheduling scheme, and finally use the time slice strategy for scheduling.
[0168] The specific steps are: quantify the similarity of functionally equivalent heterogeneous executables in the entire set. The higher the value, the more similar this heterogeneous executable is to other heterogeneous executables, and the more similar vulnerabilities there are;
[0169] Quantify the threat level of heterogeneous executors. The higher this value is, the lower the security of the heterogeneous executors is, and the higher the probability of being attacked by common mode.
[0170] The final scheduling plan is determined by comprehensively calculating the similarity degree of quantified heterogeneous executors and the threat degree of quantified heterogeneous executors.
[0171] Quantifying the similarity of functionally equivalent heterogeneous executables in the entire set includes: measuring the similarity of the same type of components of heterogeneous executables based on common vulnerabilities, measuring the similarity between heterogeneous executables, constructing a heterogeneous executable similarity matrix, and calculating the execution pool similarity index;
[0172] Furthermore, the mimetic cloud service structure constructed based on the mimetic defense theory consists of heterogeneous executors, scheduling sets and execution pools. Therefore, to measure the similarity of heterogeneous executors, it is necessary to first define heterogeneous executors, scheduling sets and execution pools.
[0173] Heterogeneous Executor: E i ={C lp |l,p=1,2,3,…,n}, where C lp Represents the pth component of the lth category.
[0174] Scheduling set: The scheduling set is the set of all functionally equivalent executables in the system, denoted by E = {E i |i=1,2,3,…,n}, where n is the number of heterogeneous executors in the scheduling set.
[0175] Execution pool: The set of functionally equivalent executables working online at the same time in the system is denoted as P = {E i |i=1,2,3,…,r}, where r represents the redundancy of heterogeneous executors. Since multi-mode decision is required during output, the redundancy of the execution pool must have at least 3 executors, that is, 3≤r≤n. At the same time, the executors in the execution pool must be obtained from the scheduling set mapping.
[0176] The same class of heterogeneous executables is defined based on the similarity of common vulnerabilities, specifically:
[0177]
[0178] By constructing the similarity based on the common vulnerabilities in the same category, the similarity between heterogeneous executables is obtained, which is:
[0179]
[0180] Among them, α represents the time weight factor, which considers the importance of the vulnerability from a time perspective, and years represents the year of the vulnerability. β represents the space weight factor, which considers the importance of the vulnerability of each layer of components from a spatial dimension, and tiers represents the number of component layers.
[0181] Furthermore, the similarity matrix composed of the similarities between all heterogeneous executors is obtained:
[0182]
[0183] Among them, C jk CVI y (E J ,E k ) represents the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix.
[0184] Furthermore, the similarity index C of the execution pool is p The corresponding similarity matrix C l The element C in jk Calculated using the following formula.
[0185]
[0186] Where P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
[0187] Similarity index C p The larger the value, the more similar the pairs of heterogeneous execution bodies in this execution pool are, and the more similar vulnerabilities they have.
[0188] Quantifying the threat level of heterogeneous executors includes measuring the threat level of the vulnerabilities of the heterogeneous executors themselves, measuring the threat level of the common vulnerabilities of two heterogeneous executors and the comprehensive threat level of the two heterogeneous executors, building a threat level matrix and a threat level indicator of the execution pool.
[0189] The quantified threat level of heterogeneous executables is obtained by querying the Common Vulnerability Scoring System (CVSS), and the vulnerability set of the heterogeneous executables needs to be defined.
[0190] Define the vulnerability set of heterogeneous executables, denoted as B i = {B ij |B ij is a vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m}. Define the heterogeneous executable E i The threat level of its own vulnerabilities is as follows:
[0191]
[0192] Heterogeneous Executor E i With heterogeneous executive E j The common vulnerability threat levels are as follows:
[0193] t ik =∑CVSS(B i ∩B j )
[0194] Heterogeneous Executor E i With heterogeneous executive E j The comprehensive threat level can be obtained using the following formula:
[0195] m ij =t ij +t i +t j
[0196] Based on the above method, we get the threat degree matrix M composed of the threat degrees among all heterogeneous executives in the executive set: l . M l The elements in represent the comprehensive threat level between each two heterogeneous executables:
[0197]
[0198] Furthermore, the threat level index M of the execution pool p The corresponding threat degree matrix M l The element m in jk Calculated using the following formula.
[0199]
[0200] Where P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
[0201] Mp The larger the value, the higher the threat level between the heterogeneous executors in this execution pool, and the greater the probability of being attacked by common mode.
[0202] Incorporating the threat level of heterogeneous executors into the heterogeneous executor scheduling strategy can improve the security, resource utilization efficiency and flexibility of the system, prevent potential threats, and improve system credibility. This helps build a more intelligent, efficient and secure system environment.
[0203] It is obtained by comprehensively calculating the similarity degree of quantified heterogeneous executors and the threat degree of quantified heterogeneous executors. The comprehensive scheduling index is positively correlated with the similarity threat degree of the execution pool, specifically:
[0204] CM p =C p ×M p
[0205] The higher the comprehensive scheduling index, the higher the similarity between the heterogeneous executor and other heterogeneous executors, the higher the threat level, and the greater the probability of being attacked by common mode. The execution pools are sorted in ascending order according to the comprehensive scheduling index, and adjusted according to the priority in combination with the time slice strategy to determine the final scheduling plan.
[0206] The present invention comprehensively considers the similarity and threat level of heterogeneous executors, making scheduling decisions more intelligent. By considering the similarity of heterogeneous executors, heterogeneous executors with similar functions or performance can be better utilized to improve the overall system performance and resource utilization efficiency. At the same time, by considering the threat level, the scheduling and permissions of heterogeneous executors with malicious behaviors or higher security threats can be limited to improve system security. In the intelligent power monitoring system, a heterogeneous executor scheduling algorithm is used to manage multiple sensors and executors to achieve real-time monitoring and response to the security environment. The system can dynamically allocate executor resources according to the data characteristics of different sensors and the current environmental conditions to improve the overall performance of the system and respond to unknown threats.
[0207] A terminal device is provided in one embodiment of the present invention. The terminal device of this embodiment includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps in the above-mentioned method embodiments are implemented. Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned device embodiments are implemented.
[0208] The computer program may be divided into one or more modules / units, and the one or more modules / units are stored in the memory and executed by the processor to accomplish the present invention.
[0209] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.
[0210] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
[0211] The memory may be used to store the computer program and / or module, and the processor implements various functions of the terminal device by running or executing the computer program and / or module stored in the memory and calling the data stored in the memory.
[0212] If the module / unit integrated in the terminal device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.
[0213] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A heterogeneous execution body scheduling method for endogenous perception of unknown attacks, characterized in that: include: Construct heterogeneous executable bodies with the same functions but different components, and divide the constructed heterogeneous executable bodies into several scheduling sets, wherein the number of heterogeneous executable bodies in each scheduling set is different; and construct an execution pool list according to the redundancy r of the heterogeneous executable bodies and the number n of heterogeneous executable bodies in the scheduling set, wherein the execution pool list includes Execution pools; Based on the constructed heterogeneous executors, obtain the similarity and threat degree between the heterogeneous executors in the scheduling set; Based on the similarity and threat degree between each heterogeneous executor in the scheduling set, a similarity matrix and a threat degree matrix of the scheduling set are obtained respectively; Based on the similarity matrix and threat matrix of the scheduling set, the execution pool similarity index and threat index are obtained respectively, and finally the comprehensive scheduling index is obtained; Based on the comprehensive scheduling indicators, the execution pool list The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy.
2. The heterogeneous execution body scheduling method for endogenous perception of unknown attacks according to claim 1 is characterized in that: Based on the constructed heterogeneous executors, the similarity between the heterogeneous executors in the scheduling set is obtained, specifically: Obtain the similarity of common vulnerabilities between heterogeneous executables, specifically: Where i∈{y-years+1,...,y-2,y-1,y}; α represents the time weight factor; y represents the year; years represents the year of the vulnerability, which is at least 1 year; α i Factor represents the time weight factor for the i-th year; The similarity between heterogeneous executors in the scheduling set is obtained through the similarity of the common vulnerabilities between heterogeneous executors, which is specifically: Among them, β represents the spatial weight factor, tiers represents the number of component layers; E j and E k Indicates different heterogeneous executors; heterogeneous executors are represented by E i ={C lp |l,p=1,2,3,…,n}, where C lp represents the pth component of the lth class, v i (C lp ,C lq ) indicates the same type of components C lp and C lq The total number of vulnerabilities, β l Represents the spatial weight factor of the l-th layer component.
3. The heterogeneous execution body scheduling method for endogenous perception of unknown attacks according to claim 2 is characterized in that: Based on the similarity between each heterogeneous executor in the scheduling set, the similarity matrix of the scheduling set is obtained respectively, specifically: the similarity matrix composed of the similarities between heterogeneous executors: Among them, C jk CVI y (E J ,E k ), indicating the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix; Based on the similarity matrix C of the scheduling set in formula (3) l The element C in jk , and obtain the similarity index of the execution pool, specifically: Among them, C p is the similarity index of the execution pool, P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
4. The heterogeneous execution body scheduling method for endogenous perception of unknown attacks according to claim 1 is characterized in that: Get the threat level between the heterogeneous executors in the scheduling set, specifically: Get the vulnerability threat level of the heterogeneous executable, specifically: Among them, B i = {B ij |B ij is the vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m}; Heterogeneous Executor E i With heterogeneous executive E j The common vulnerability threat levels are as follows: t ij =∑CVSS(B i ∩B j ) (6) Heterogeneous Executor E i With heterogeneous executive E j The overall threat level is: m ij =t ij +t i +t j (7)。 5. The heterogeneous execution body scheduling method for endogenous perception of unknown attacks according to claim 4 is characterized in that: Get the threat degree matrix of the scheduling set, specifically: the threat degree matrix M composed of the threat degrees between all heterogeneous executors in the executor set l , specifically: Among them, M l The elements in represent the comprehensive threat level between each two heterogeneous executives; Based on the threat degree matrix of the scheduling set, the threat degree index of the execution pool is obtained, specifically: the threat degree index M of the execution pool p According to the threat degree matrix M in formula (8): l The element m in jk Through formula (9), we get: Among them, M P An indicator representing the threat level of the execution pool; The comprehensive scheduling index is: CM p =C p ×M p (10)。 6. The heterogeneous execution body scheduling method for endogenous perception of unknown attacks according to claim 1 is characterized in that: The execution pool list is executed based on the comprehensive scheduling index The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy. Specifically, the execution pool list is arranged in ascending order according to the comprehensive scheduling index to obtain a sorted execution pool list and use it as the scheduling plan; based on the time slice strategy, the time slice is adjusted according to the priority. The higher the priority of the execution pool, the longer the time slice, otherwise the shorter the time slice; if the time slice of the previous execution pool reaches the preset time, the next execution pool is selected.
7. A heterogeneous execution body scheduling system for endogenous perception of unknown attacks, characterized in that: include: A construction module, wherein the construction module constructs heterogeneous executable bodies with the same functions but different components, and divides the constructed heterogeneous executable bodies into a plurality of scheduling sets, wherein the number of heterogeneous executable bodies in each scheduling set is different; and an execution pool list is constructed according to the redundancy r of the heterogeneous executable bodies and the number n of heterogeneous executable bodies in the scheduling set, wherein the execution pool list includes Execution pools; A first acquisition module, which acquires the similarity and threat degree between the heterogeneous execution bodies in the scheduling set based on the constructed heterogeneous execution bodies; A second acquisition module, which acquires a similarity matrix and a threat matrix of the scheduling set based on the similarities and threat levels between the heterogeneous execution bodies in the scheduling set; A third acquisition module, which obtains the execution pool similarity index and the threat index based on the similarity matrix and the threat matrix of the scheduling set, and finally obtains the comprehensive scheduling index; A sorting module is used to sort the execution pool list based on the comprehensive scheduling index. The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy.
8. The heterogeneous execution body scheduling system for endogenous perception of unknown attacks according to claim 7 is characterized in that: Based on the constructed heterogeneous executors, the similarity between the heterogeneous executors in the scheduling set is obtained, specifically: Obtain the similarity of common vulnerabilities between heterogeneous executables, specifically: Where i∈{y-years+1,...,y-2,y-1,y}; α represents the time weight factor; y represents the year; years represents the year of the vulnerability, which is at least 1 year; α i Factor represents the time weight factor for the i-th year; The similarity between heterogeneous executors in the scheduling set is obtained through the similarity of the common vulnerabilities between heterogeneous executors, which is specifically: Among them, β represents the spatial weight factor, tiers represents the number of component layers; E j and E k Indicates different heterogeneous executors; heterogeneous executors are represented by E i ={C lp |l,p=1,2,3,…,n}, where C lp represents the pth component of the lth class, v i (C lp ,C lq ) indicates the same type of components C lp and C lq The total number of vulnerabilities, β l Represents the spatial weight factor of the l-th layer component.
9. The heterogeneous execution body scheduling system for endogenous perception of unknown attacks according to claim 8 is characterized in that: Based on the similarity between each heterogeneous executor in the scheduling set, the similarity matrix of the scheduling set is obtained respectively, specifically: the similarity matrix composed of the similarities between heterogeneous executors: Among them, C jk CVI y (E J ,E k ), indicating the heterogeneous execution body E j and heterogeneous executive E k The similarity between l is a symmetric matrix; Based on the similarity matrix C of the scheduling set in formula (13) l The element C in jk , and obtain the similarity index of the execution pool, specifically: Among them, C p is the similarity index of the execution pool, P represents the execution pool, j and k represent the numbers of the heterogeneous execution bodies in the execution pool, Indicates the number of heterogeneous executor pairs in the execution pool.
10. The heterogeneous execution body scheduling system for endogenous perception of unknown attacks according to claim 7 is characterized in that: Get the threat level between the heterogeneous executors in the scheduling set, specifically: Get the vulnerability threat level of the heterogeneous executable, specifically: Among them, B i = {B ij |B ij is the vulnerability of the heterogeneous executable Ei, and j = 1, 2, ..., m}; Heterogeneous Executor E i With heterogeneous executive E j The common vulnerability threat levels are as follows: t ij =∑CVSS(B i ∩B j ) (16) Heterogeneous Executor E i With heterogeneous executive E j The overall threat level is: m ij =t ij +t i +t j (17)。 11. The heterogeneous execution body scheduling system for endogenous perception of unknown attacks according to claim 10 is characterized in that: Get the threat degree matrix of the scheduling set, specifically: the threat degree matrix M composed of the threat degrees between all heterogeneous executors in the executor set l , specifically: Among them, M l The elements in represent the comprehensive threat level between each two heterogeneous executives; Based on the threat degree matrix of the scheduling set, the threat degree index of the execution pool is obtained, specifically: the threat degree index M of the execution pool p According to the threat degree matrix M in formula (18): l The element m in jk Through formula (19), we get: Among them, M P An indicator representing the threat level of the execution pool; The comprehensive scheduling index is: CM p =C p ×M p (20)。 12. The heterogeneous execution body scheduling system for endogenous perception of unknown attacks according to claim 7 is characterized in that: The execution pool list is executed based on the comprehensive scheduling index The execution pools are arranged in ascending order, and the final scheduling plan is obtained according to the priority of the execution pool in the execution pool list in combination with the time slice strategy. Specifically, the execution pool list is arranged in ascending order according to the comprehensive scheduling index to obtain a sorted execution pool list and use it as the scheduling plan; based on the time slice strategy, the time slice is adjusted according to the priority. The higher the priority of the execution pool, the longer the time slice, otherwise the shorter the time slice; if the time slice of the previous execution pool reaches the preset time, the next execution pool is selected.
13. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
14. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.