Thread tracking type low-intrusion mimicry adaptation method, system, equipment and medium

Abstract

The invention discloses a thread tracking type low-intrusion mimicry adaptation method, system and device and a medium. The method comprises the steps of generating and embedding a mimicry label, extracting and transmitting the mimicry label, using the mimicry label when a new service is accessed, and injecting, judging and feeding back a low-intrusion mimicry label. By flexibly and accurately generating and extracting the mimicry labels containing rich information, introducing a thread tracking and label transmission mechanism, uniformly supporting heterogeneous redundant executors, injecting the labels in a low-intrusion mode and establishing an efficient judgment and feedback mechanism, the flexibility, expandability, safety and reliability of the system are remarkably improved. The system design not only can effectively generate and inject mimicry labels containing key information, but also reduces the change of the existing system architecture in a low-intrusion mode, and ensures the tracking and monitoring of database service access.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a thread-tracking low-intrusive mimicry adaptation method, system, device and medium. Background Art

[0002] Uncertain threats based on unknown vulnerabilities and backdoors are the most serious and difficult security issues in the current cyberspace. At present, such network security issues are usually solved through mimic defense (MD). Mimic defense can transform network security issues caused by unknown vulnerabilities and backdoors into differential mode disturbance problems that can be identified by the arbitrator, and then make a decision through the arbitrator, thereby obtaining a decision result that can maintain network stability and improve system security.

[0003] Among the existing mimicry defense technologies, a typical method is the mimicry arbitration method disclosed in the existing patent document CN118487817A. In this method, the mimicry tag is generated on the arbiter side, and is mainly combined and aggregated based on the information in the redundant executor's processing of business requests. However, this method relies on the arbiter's ability to obtain these process information comprehensively and accurately, which may be limited by various factors in practical applications, such as network communication delays, data loss, etc. In addition, the method does not clearly explain how to extract the mimicry tag directly from the request header, but focuses on subsequent processing on the arbiter side. This is inconsistent with the step of extracting the mimicry tag from the request header emphasized in the thread tracking low-intrusive mimicry adaptation method.

[0004] At the same time, although the existing mimetic adjudication method can adjudicate redundant executor output requests, it does not involve thread tracking mechanisms and cannot ensure the continuity and consistency of mimetic tags during processing. In a multi-threaded environment, the lack of a direct tag transfer mechanism may lead to tag loss or confusion, thus affecting the accuracy and efficiency of adjudication. Summary of the invention

[0005] The main purpose of this application is to provide an automated identification method and system for key defense locations in an e-government system, aiming to address the limitations of label generation and extraction in the prior art, and the lack of a direct thread tracking and label transfer mechanism.

[0006] To achieve the above objectives, this application provides the following solutions:

[0007] In a first aspect, the present application provides a thread tracking low-intrusive mimetic adaptation method, comprising the following steps:

[0008] S1. Generate and embed a mimetic tag, where the mimetic tag contains a timestamp, a device ID, a board ID, a request count, a random number, a user ID, and a session ID;

[0009] S2, extracting and transmitting the mimetic tag, wherein after receiving the request, the heterogeneous redundant executor extracts the mimetic tag from the request header and transmits it to the processing thread;

[0010] S3. Use the mimic tag when accessing a new service. When a thread needs to access a database service, extract the mimic tag of the current thread and store it in a newly generated request, which is sent to the database service.

[0011] S4, low-intrusive mimetic tag injection, where corresponding library functions are provided for different programming languages ​​to implement tag injection and extraction;

[0012] S5, arbitration and feedback mechanism, in which an arbitration mechanism is established between the user-side pseudo bracket and the business-side pseudo bracket, and the final vote is made by integrating the responses of multiple heterogeneous executors.

[0013] Optionally, in step S2, natural language processing is used to accurately extract the mimicry tag from the request header, and the specific operation steps are as follows:

[0014] Parse the request header using a pre-trained natural language processing model to identify and locate the structure of the mimicry tag;

[0015] Applying named entity recognition to keywords and entities in the request header, the keywords and entities corresponding to components of the mimic tag;

[0016] Determine the relationship between entities in the request header through dependency syntax analysis;

[0017] Use deep learning algorithms to extract features from text in request headers;

[0018] Match the extracted features with known mimic label patterns;

[0019] Once the mimic tag is identified, it is separated from the request header and passed to the processing thread for further processing.

[0020] Optionally, the library function in step S4 is:

[0021]

[0022] Among them, F(x) is the original function, which accepts the parameter x and performs its defined operation;

[0023] I(T,F) represents the function F injected with the mimic tag T;

[0024] print(T) is a hypothetical function used to output label information.

[0025] Optionally, the specific operation steps of step S5 are as follows:

[0026] The user-side pseudo bracket distributes the request to multiple heterogeneous executors R in the business-side pseudo brackets i ;

[0027] According to the historical performance security and heterogeneous confidence of each executor, its influence in the vote is weighted, and its weighted voting result R is expressed as:

[0028]

[0029] Among them, ω i is the weight of the ith executor, P(R i ) is the pre-processed form of the response of the i-th executive;

[0030] The response data are processed using a parallel clustering algorithm;

[0031] Use the three-dimensional DUCG theoretical model to handle the logical causal relationship of complex faults;

[0032] Diagnose abnormalities in voting results and handle abnormal situations robustly;

[0033] The voting results are fed back to the user-side mimetic brackets to complete the entire ruling and feedback mechanism.

[0034] In a second aspect, the present application provides a thread tracking low-intrusive mimicry adaptation system, including:

[0035] Mimic tag generator, used to generate mimic tags containing timestamp, device ID, board ID, request count, random number, user ID and session ID;

[0036] Mimic tag extractor, used to extract mimic tags from request headers and pass them to the processing thread;

[0037] The database service access module is used to extract the mimic tag and send it to the database service when the thread accesses the database service;

[0038] Low-intrusive tag injection module, which is used to provide library functions in different programming languages ​​to implement tag injection and extraction;

[0039] The arbitration and feedback module is used to integrate the responses of multiple heterogeneous executors for final voting.

[0040] In a third aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the steps of the thread-tracking low-intrusive mimetic adaptation method described in any one of the above items.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the thread-tracking low-intrusive mimetic adaptation method described in any one of the above items are implemented.

[0042] Through the above technical scheme, the beneficial effects of the present invention are as follows: the thread tracking low-intrusive mimetic adaptation method proposed in this application improves the flexibility and accuracy of label generation and extraction by embedding mimetic tags with rich information in the request generation stage, and reduces the arbitrator's dependence on process information. At the same time, the introduction of thread tracking and label transmission mechanism effectively avoids the loss or confusion of labels in a multi-threaded environment, and improves the accuracy and efficiency of the ruling. In addition, the method supports the unified processing of heterogeneous redundant executors, enhancing the flexibility and scalability of the system. The low-intrusive mimetic tag injection method reduces the complexity of system implementation, ensures stability and reliability, and provides developers with more debugging and monitoring methods. Finally, the efficient ruling and feedback mechanism votes by integrating the responses of multiple heterogeneous executors, and uses advanced technology to improve the voting speed and accuracy, ensuring the safe and reliable operation of the system and providing users with a more stable and reliable service experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and the embodiments in the drawings do not constitute any limitation to the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A flowchart of a thread tracking low-intrusive mimicry adaptation method provided in one embodiment of the present application;

[0045] Figure 2 A structural diagram of a thread tracking low-intrusive mimicry adaptation system provided in one embodiment of the present application;

[0046] Figure 3 A schematic diagram of the structure of a computer device provided in one embodiment of the present application.

[0047] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0049] The above and other technical contents, features and effects of the present invention are described in detail below with reference to the attached Figure 1-3 The detailed description of the embodiments will clearly show that the structural contents mentioned in the following embodiments are all based on the drawings in the specification.

[0050] Exemplary embodiments of the present invention will be described below with reference to the accompanying drawings.

[0051] The main solutions of the embodiments of this application are:

[0052] like Figure 1 As shown, an embodiment of the present application provides a thread-tracking low-intrusive mimicry adaptation method, which can be executed by a computing device with computing functions, and the computing device can be a desktop computer, a laptop computer, or a mobile phone.

[0053] Step S1, generate and embed a mimetic tag, wherein the mimetic tag includes a timestamp, a device ID, a board ID, a request count, a random number, a user ID, and a session ID.

[0054] In the example embodiment, for example, the user initiates a request at 10:00:00, the device ID is 12345, the board ID is 67890, the request count is 1, the random number is 123, the user ID is 4567, and the session ID is 890, then the generated mimic tag is: 10:00:00_12345_67890_1_123_4567_890. This tag is embedded in the HTTP request header with X-Mimic-Tag as the key: 10:00:00_12345_67890_1_123_4567_890.

[0055] Step S2, extracting and transmitting the mimetic tag, wherein after receiving the request, the heterogeneous redundant executor extracts the mimetic tag from the request header and transmits it to the processing thread.

[0056] In an example embodiment, after receiving the request, the heterogeneous redundant executor uses a pre-trained natural language processing (NLP) model to parse the request header:

[0057] O=NLP(R)

[0058] Among them, R is the request header, and O contains the feature representation of each part of the request header.

[0059] Natural language processing (NLP) is an artificial intelligence technology that enables computers to understand, interpret, and generate human language. NLP models are trained through deep learning algorithms and can recognize patterns, structures, and meanings in text. In the scenario of parsing request headers, NLP models can accurately extract key information in request headers, such as mimetic tags. Specifically, when the heterogeneous redundant executor receives a request, it inputs the request header into the pre-trained NLP model. The NLP model carefully analyzes and parses the request header and extracts the mimetic tags. This process not only ensures the accurate extraction of tags, but also improves the processing efficiency and accuracy of the system. The extracted mimetic tags are then passed to the processing thread, which decides how to process the request based on this information, ensuring that each request receives an appropriate response.

[0060] Through such a design, the system not only achieves the uniqueness and traceability of requests, but also improves processing efficiency and accuracy. At the same time, the application of NLP models also demonstrates the great potential of artificial intelligence technology in network request processing.

[0061] By applying named entity recognition (NER), the keywords and entities in the request header are identified. NER is an important task in the field of NLP, which aims to identify entities with specific meanings from text, such as names of people, places, institutions, time expressions, numerical expressions, etc. NER technology can help computers understand key information in text, thereby supporting various applications, such as information extraction, question-answering systems, machine translation, and text summarization. By applying NER, the system can automatically identify and classify entities in the text, providing a basis for subsequent processing and analysis. By applying NER technology, the NLP model can identify keywords and entities in the request header, such as the timestamp "10:00:00" and the device ID "12345". These keywords and entities are important components of mimetic tags, and each of them carries specific meanings and functions. For example, the timestamp can reflect the specific moment when the request was initiated, while the device ID identifies the device that issued the request.

[0062] Dependency parsing is used to determine the relationship between entities in the request header. Through this analysis, the NLP model can understand the logical connection between entities. For example, it can help the model understand that "12345" is a device ID, "67890" is a board ID, and these IDs are associated with specific users and sessions. This analysis ensures that each part of the tag can be correctly identified and understood.

[0063] The deep learning algorithm extracts features from the text in the request header to enhance the recognition of mimetic tags. These features include text patterns, structures, etc. The deep learning algorithm is trained to identify key information in the request header and can extract useful information from complex text. For example, the algorithm will identify key information such as timestamps and device IDs in the request header and match them with known mimetic tag patterns.

[0064] The extracted features are matched with known mimetic tag patterns to verify and confirm the validity of the mimetic tags. For example, the model checks whether the extracted tags conform to the format of "HH:MM:SS_ID_ID_Count_Random_ID_ID". Once the mimetic tag is confirmed, the NLP model separates it from the request header and passes it to the processing thread. After receiving the mimetic tag, the processing thread decides how to handle the request based on the information in the tag. For example, the processing thread can verify the user identity based on the user ID and session ID to ensure that the request is initiated by a legitimate user. In addition, the processing thread can also determine whether the request needs to be throttled based on the request count to prevent system overload. This processing method based on mimetic tags not only improves the processing efficiency and accuracy of the system, but also enhances the security and reliability of the system.

[0065] Through the above processing, the system not only achieves the uniqueness and traceability of the request, but also improves the processing efficiency and accuracy. At the same time, the application of the NLP model also demonstrates the great potential of artificial intelligence technology in network request processing. Through meticulous analysis and intelligent processing, the system can ensure that each request is properly responded to, thereby providing users with a more stable and reliable service experience.

[0066] Step S3, using the mimic tag when accessing the new service, wherein when the thread needs to access the database service, the mimic tag of the current thread is extracted, stored in the newly generated request, and sent to the database service. Specifically, before the thread is ready to access the database service, it first extracts the mimic tag from the context of the current thread. This step usually involves accessing the thread local storage or thread-specific data structure, in which the mimic tag information extracted in step S2 has been saved. After extracting the mimic tag, the thread needs to construct a new request and embed the mimic tag into the appropriate position of the request. In the HTTP request, the mimic tag is used as part of the request header. For example, if the HTTP protocol is used, the thread will create a request header and add the mimic tag as the value and "X-Mimic-Tag" as the key to the request header. After the construction is completed, the thread sends the new request containing the mimic tag to the database service. After receiving the request, the database service will process the request according to the established process, including extracting the mimic tag in the request header and performing corresponding processing according to the information in the tag. After the database service completes the processing, it returns the response to the thread that initiated the request. Through the above steps, the system ensures that each request can be uniquely identified and tracked when passing requests between multiple services, thereby improving the overall consistency and reliability of the system.

[0067] Step S4, low-intrusive mimetic tag injection, wherein for different programming languages, corresponding library functions are provided to implement tag injection and extraction, thereby achieving the lowest level of intrusion on the original code.

[0068] The library function in step S4 is:

[0069]

[0070] Among them, F(x) is the original function, which accepts the parameter x and performs its defined operation;

[0071] I(T,F) represents the function F injected with the mimic tag T;

[0072] print(T) is a hypothetical function used to output label information.

[0073] In the above, the mimic tag T is a key identifier that carries additional information about the request, such as timestamps, device IDs, etc., which are essential for tracking requests and ensuring the correctness of request processing. Whenever the system needs to process a request, the mimic tag is first injected into the relevant processing function through the above function library. print(T) is a hypothetical function responsible for outputting tag information, which helps debug and monitor the behavior of the system and ensure that the mimic tag is correctly injected and identified. After the tag is injected, the print(T) function will output the tag information at the appropriate time so that developers or system administrators can track and verify the use of the tag.

[0074] In the specific workflow, when the system needs to process a request, it first determines the original function F(x) that needs to be called based on the type and content of the request. Then, the system looks for the library function I(T,F) corresponding to the function and passes the mimic label T as a parameter to this function. After receiving the label and the original function, the library function I(T,F) executes the print(T) function to output the label information and injects the label into the original function F(x). In this way, when the original function F(x) is executed, it will carry the mimic label T, thereby realizing the identification and tracking of the request.

[0075] Through the above method, the system can ensure that each request can be uniquely identified and tracked when passing requests between multiple services. This not only improves the overall consistency and reliability of the system, but also provides developers with more debugging and monitoring methods. At the same time, since this injection method is the least intrusive to the original code, it also ensures the flexibility and scalability of the system.

[0076] Step S5, arbitration and feedback mechanism, wherein an arbitration mechanism is established between the user-side pseudo bracket and the business-side pseudo bracket, and the final vote is performed by integrating the responses of multiple heterogeneous executors.

[0077] Specifically, the user-side pseudo bracket distributes the request to the heterogeneous execution bodies R in multiple business-side pseudo brackets i ;

[0078] In order to ensure that the final decision result is both fair and efficient, the system will weight the influence of each executor in the vote based on its historical performance security and heterogeneous confidence. The consideration of historical performance security is to ensure that those executors with good performance and high reliability in the past can have a greater influence on the final decision result. Heterogeneous confidence takes into account the adaptability and accuracy of the executor when processing different types of requests. Through such a weighting mechanism, the system can comprehensively consider various factors to obtain a comprehensive and balanced voting result. The weighted voting result R is expressed as:

[0079]

[0080] Among them, ω i is the weight of the ith executor, P(R i ) is the pre-processed form of the response of the i-th executive;

[0081] In order to further improve the efficiency of the voting process, a parallel clustering algorithm is used to process the response data, reduce the problem of data idleness, and increase the voting speed. At the same time, the three-dimensional DUCG theoretical model is used to handle those complex fault logic and causal relationships to ensure that the system can accurately identify and handle various potential abnormal situations.

[0082] After obtaining the voting results, the system will perform anomaly diagnosis on the voting results. This process involves in-depth analysis of the voting results to identify any possible anomalies or inconsistencies. Once an abnormality is found, the system will activate the robustness processing mechanism and take a series of measures to ensure the stable operation of the system and prevent potential failures from affecting the user experience.

[0083] Finally, the results processed by the adjudication and feedback mechanism will be promptly fed back to the user-side mimic bracket. The feedback not only includes the final decision result, but also includes the evaluation and suggestions on the performance of the executor, providing valuable data support for the continuous optimization and learning of the system.

[0084] Through the above-mentioned arbitration and feedback mechanism, the system not only ensures the accuracy and efficiency of decision-making, but also enhances the stability and reliability of the entire system, providing users with a more stable and reliable service experience.

[0085] Based on the same inventive concept, the embodiment of the present application also provides a thread-tracking low-intrusive mimetic adaptation system for implementing the thread-tracking low-intrusive mimetic adaptation method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more thread-tracking low-intrusive mimetic adaptation system embodiments provided below can refer to the limitations of the thread-tracking low-intrusive mimetic adaptation method above, and will not be repeated here.

[0086] In an exemplary embodiment, Figure 2 A thread-tracking low-intrusive mimetic adaptation system is provided, and the thread-tracking low-intrusive mimetic adaptation system includes:

[0087] Mimic tag generator, used to generate mimic tags containing timestamp, device ID, board ID, request count, random number, user ID and session ID;

[0088] Mimic tag extractor, used to extract mimic tags from request headers and pass them to the processing thread;

[0089] The database service access module is used to extract the mimic tag and send it to the database service when the thread accesses the database service;

[0090] Low-intrusive tag injection module, which is used to provide library functions in different programming languages ​​to implement tag injection and extraction;

[0091] The arbitration and feedback module is used to integrate the responses of multiple heterogeneous executors for final voting.

[0092] This system realizes thread-tracking low-intrusive mimetic adaptation by integrating mimetic tag generator, mimetic tag extractor, database service access module, low-intrusive tag injection module and arbitration and feedback module. The system design can not only effectively generate and inject mimetic tags containing key information, but also reduce the changes to the existing system architecture in a low-intrusive way, while ensuring the tracking and monitoring of database service access. In addition, the system comprehensively processes the responses of heterogeneous executors through arbitration and feedback modules, which improves the security and reliability of the system, thereby enhancing the system's defense capabilities and response efficiency without sacrificing performance.

[0093] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store thread-tracking low-intrusive mimetic adaptation data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a thread-tracking low-intrusive mimetic adaptation method is implemented.

[0094] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0095] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0096] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0097] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0098] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0099] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0100] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0101] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A thread-tracking low-intrusive mimetic adaptation method, characterized in that: The steps include: S1. Generate and embed a mimetic tag, where the mimetic tag contains a timestamp, a device ID, a board ID, a request count, a random number, a user ID, and a session ID; S2, extracting and transmitting the mimetic tag, wherein after receiving the request, the heterogeneous redundant executor extracts the mimetic tag from the request header and transmits it to the processing thread; S3. Use the mimic tag when accessing a new service. When a thread needs to access a database service, extract the mimic tag of the current thread and store it in a newly generated request, which is sent to the database service. S4, low-intrusive mimetic tag injection, where corresponding library functions are provided for different programming languages ​​to implement tag injection and extraction; S5, arbitration and feedback mechanism, in which an arbitration mechanism is established between the user-side pseudo bracket and the business-side pseudo bracket, and the final vote is made by integrating the responses of multiple heterogeneous executors.

2. According to claim 1, the thread tracking low-intrusive mimicry adaptation method is characterized in that: In step S2, natural language processing is used to accurately extract the mimicry tag from the request header. The specific operation steps are as follows: Parse the request header using a pre-trained natural language processing model to identify and locate the structure of the mimicry tag; Applying named entity recognition to keywords and entities in the request header, the keywords and entities corresponding to components of the mimic tag; Determine the relationship between entities in the request header through dependency syntax analysis; Use deep learning algorithms to extract features from text in request headers; Match the extracted features with known mimic label patterns; Once the mimic tag is identified, it is separated from the request header and passed to the processing thread for further processing.

3. According to claim 2, the thread tracking low-intrusive mimicry adaptation method is characterized in that: The library function in step S4 is: Among them, F(x) is the original function, which accepts the parameter x and performs its defined operation; I(T,F) represents the function F injected with the mimic tag T; print(T) is a hypothetical function used to output label information.

4. According to claim 3, the thread tracking low-intrusive mimicry adaptation method is characterized in that: The specific operation steps of step S5 are as follows: The user-side pseudo bracket distributes the request to multiple heterogeneous executors R in the business-side pseudo brackets i ; According to the historical performance security and heterogeneous confidence of each executor, its influence in the vote is weighted, and its weighted voting result R is expressed as: Among them, ω i is the weight of the ith executor, P(R i ) is the preprocessed form of the response of the i-th executive; The response data are processed using a parallel clustering algorithm; Use the three-dimensional DUCG theoretical model to handle the logical causal relationship of complex faults; Diagnose abnormalities in voting results and handle abnormal situations robustly; The voting results are fed back to the user-side mimetic brackets to complete the entire ruling and feedback mechanism.

5. A thread-tracking low-intrusive mimicry adaptation system, characterized in that: The thread tracking low-intrusive mimicry adaptation system includes: Mimic tag generator, used to generate mimic tags containing timestamp, device ID, board ID, request count, random number, user ID and session ID; Mimic tag extractor, used to extract mimic tags from request headers and pass them to the processing thread; The database service access module is used to extract the mimic tag and send it to the database service when the thread accesses the database service; Low-intrusive tag injection module, which is used to provide library functions in different programming languages ​​to implement tag injection and extraction; The arbitration and feedback module is used to integrate the responses of multiple heterogeneous executors for final voting.

6. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the thread-tracking low-intrusive mimetic adaptation method described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the thread-tracing low-intrusive mimicry adaptation method described in any one of claims 1 to 4 are implemented.

Images