Method and device for arbitrating mimic system hypertext transfer protocol response message

Abstract

The application provides a method and device for deciding a mimic system hypertext transfer protocol response message, and relates to the technical field of mimic defense, which comprises the following steps: receiving multiple non-empty packet response messages returned by an odd number of executors in a mimic system within a preset timeout period; constructing empty packet response messages for part of the executors corresponding to the non-empty packet response messages that are not returned; selectively obtaining a decision result or resolving a response status code, a response header and a response body based on the relationship between the number of the empty packet response messages and the number of the executors; and sequentially performing response status code decision, response header decision and response body decision. The application can effectively decide the hypertext transfer protocol response message based on the characteristics of the hypertext transfer protocol response message, and improve the accuracy and efficiency of the decision of the hypertext transfer protocol response message.

Description

Technical Field

[0001] This invention relates to the field of mimicry defense technology, and in particular to a method and apparatus for adjudicating Hypertext Transfer Protocol response messages of mimicry systems. Background Technology

[0002] Mimicry defense has become a research hotspot in the field of cyberspace security in recent years. Addressing the inherent "genetic defects" of information systems, such as static, deterministic, similar, and singular characteristics, mimicry defense utilizes dynamic, random, and diverse mechanisms to change the passive nature of traditional defense methods and build a trustworthy cyberspace. Applying mimicry defense technology to transform information systems into mimicry-based systems, constructing a Dynamic Heterogeneous Redundancy (DHR) architecture, can effectively enhance the system's security defense capabilities, increase the difficulty of attacks, and improve system security. In the DHR architecture, the distributor (also known as the input agent) replicates and distributes external requests, while the adjudicator (also known as the output agent) compares and verifies multiple results before returning a response, together forming the mimicry defense boundary. Mimicry adjudication is the process of comparing and judging the output results of multiple executors in the mimicry system to determine whether the output results of each executor are correct. This allows for the detection and shielding of abnormal outputs from executors caused by attack behavior. Mimicry adjudication is a crucial step in achieving mimicry security, and its accuracy directly affects the security of the DHR architecture.

[0003] Most related technologies are designed to adjudicate HTTP request messages in scenarios where clients using Hypertext Transfer Protocol (HTTP) as the external communication protocol act as the executor. However, they lack effective adjudication schemes for HTTP response messages in scenarios where services using HTTP as the external communication protocol act as the executor, making it difficult to guarantee the accuracy and efficiency of HTTP response message adjudication. Summary of the Invention

[0004] This invention provides a method and apparatus for adjudicating Hypertext Transfer Protocol (HTTP) response messages in a mimicry system, which aims to effectively adjudicate the characteristics of HTTP response messages and improve the accuracy and efficiency of HTTP response message adjudication.

[0005] This invention provides a method for adjudicating Hypertext Transfer Protocol (HTTP) response messages in a mimicry system, comprising:

[0006] Within a preset timeout period, receive multiple non-empty packet response messages returned by an odd number of executors in the mimicry system; for the executors that do not return the non-empty packet response messages, construct empty packet response messages; based on the relationship between the number of empty packet response messages and the number of each executor, selectively obtain the adjudication result or parse to obtain response information including the response status code, response header, and response body;

[0007] Based on the consistency of the response status code, the received non-empty packet response messages are divided into one or more first groups. Based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages, the decision result or the first non-empty packet response message set is selectively obtained.

[0008] Based on the consistency of the response header, the first set of non-empty packet response messages is divided into one or more second groups. Based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages, the decision result or the second set of non-empty packet response messages is selectively obtained.

[0009] The second non-empty packet response message set is divided into one or more third groups based on the data type of the response body, and the adjudication result is obtained based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages.

[0010] The present invention also provides an adjudication device for Hypertext Transfer Protocol response messages of a mimicry system, comprising:

[0011] The first adjudication module is used to receive multiple non-empty packet response messages returned by an odd number of executors in the mimicry system within a preset timeout period; construct empty packet response messages for the executors that do not return the non-empty packet response messages; and selectively obtain adjudication results or parse and obtain response information including response status codes, response headers, and response bodies based on the relationship between the number of empty packet response messages and the number of each executor.

[0012] The second adjudication module is used to divide the received non-empty packet response messages into one or more first groups based on the consistency of the response status codes, and selectively obtain an adjudication result or obtain a set of first non-empty packet response messages based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages.

[0013] The third adjudication module is used to divide the first non-empty packet response message set into one or more second groups based on the consistency of the response header, and selectively obtain an adjudication result or obtain a second non-empty packet response message set based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages.

[0014] The fourth adjudication module is used to divide the second non-empty packet response message set into one or more third groups based on the data type of the response body, and to obtain an adjudication result based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the adjudication method for the hypertext transfer protocol response message of the mimicry system as described above.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for adjudicating hypertext transfer protocol response messages of a mimicry system as described above.

[0017] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method for adjudicating Hypertext Transfer Protocol response messages of a mimicry system as described above.

[0018] The present invention provides a method and apparatus for adjudicating Hypertext Transfer Protocol (HTTP) response messages in a mimicry system. First, within a preset timeout period, multiple non-empty packet response messages are received from an odd number of executors in the mimicry system. For the executors that do not return non-empty packet response messages, empty packet response messages are constructed. That is, the present invention supports a timeout mechanism; for the executors that do not return non-empty packet response messages within the preset timeout period, empty packet response messages are constructed for subsequent adjudication, eliminating the need to wait for the executor's response and reducing time consumption, thus improving adjudication efficiency. Based on the relationship between the number of empty packet response messages and the number of executors, adjudication results are selectively obtained or response information including response status codes, response headers, and response bodies is parsed. Then, based on the consistency of response status codes, the received non-empty packet response messages are divided into one or more first groups. Based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages, adjudication results are selectively obtained or a set of first non-empty packet response messages is obtained. Next, based on the response... The header consistency method divides the first set of non-empty packet response messages into one or more second groups. Based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages, a decision result is selectively obtained, or a second set of non-empty packet response messages is obtained. Finally, based on the data type of the response body, the second set of non-empty packet response messages is divided into one or more third groups. A decision result is obtained based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages. In other words, this invention provides a "three-stage" decision-making scheme for response status codes, response headers, and response bodies. During decision-making, the response status code summarizes the response status, and the response header and response body represent the response result as the main data. The three stages are progressively advanced. When the response status code and response header decision is abnormal, the scope of the decision message can be narrowed down in a timely manner, or a decision result can be obtained directly, thereby improving decision-making efficiency. Using different decision-making methods for response bodies of structured and unstructured data types can improve decision-making accuracy and efficiency. Therefore, this invention can effectively decide the characteristics of Hypertext Transfer Protocol (HTTP) response messages, improving the accuracy and efficiency of HTTP response message decision-making. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the workflow of the mimicry system provided by related technologies.

[0021] Figure 2This is a flowchart illustrating the adjudication method for Hypertext Transfer Protocol response messages in a mimicry system provided in an embodiment of the present invention.

[0022] Figure 3 This is a flowchart illustrating the adjudication method prior to the adjudication of the response status code, as provided in an embodiment of the present invention.

[0023] Figure 4 This is a flowchart illustrating the response status code adjudication method provided in an embodiment of the present invention.

[0024] Figure 5 This is a flowchart illustrating the response header adjudication method provided in an embodiment of the present invention.

[0025] Figure 6 This is a flowchart illustrating the response body adjudication method provided in an embodiment of the present invention.

[0026] Figure 7 This is a schematic diagram of the process for extracting the mapping relationship of response header fields and constructing the reverse mapping relationship provided in the embodiments of the present invention.

[0027] Figure 8 This is a flowchart illustrating the storage method for the response header field mapping relationship and reverse mapping relationship provided in an embodiment of the present invention.

[0028] Figure 9 This is a schematic diagram of the process for extracting the mapping relationship of response body fields and constructing the reverse mapping relationship provided in the embodiments of the present invention.

[0029] Figure 10 This is a flowchart illustrating the storage method for the response body field mapping relationship and reverse mapping relationship provided in an embodiment of the present invention.

[0030] Figure 11 This is a schematic diagram of the business operation process of a mimicry system without a random number type field processing mechanism, provided by related technologies.

[0031] Figure 12 This is a schematic diagram of the business operation process of a mimicry system with an added random number type field processing mechanism provided in an embodiment of the present invention.

[0032] Figure 13 This is a schematic diagram of the structure of the adjudication device for the Hypertext Transfer Protocol response message of the mimicry system provided in the embodiment of the present invention.

[0033] Figure 14 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0035] First, to facilitate understanding of the adjudication methods in the mimicry system, the workflow of the mimicry system will be explained in detail.

[0036] Please refer to Figure 1 , Figure 1 This is a schematic diagram of the workflow of a mimicry system provided by related technologies. For example... Figure 1 As shown, the workflow of the mimicry system includes:

[0037] (1) The client sends a request to the dispatcher;

[0038] (2) After receiving the client's request, the distributor distributes the request message to multiple executors on the line (e.g., executor 1, executor 2, ..., executor N) based on the previously established network connection;

[0039] (3) After receiving the request message, the executor service processes the request message and gives a response; the response message does not reach the client directly, but is intercepted by the arbitrator;

[0040] (4) After the arbiter intercepts the response messages of multiple executors on the line, it makes a decision to achieve normalized output and returns the decision result message of the arbiter to the client. In addition to returning the normalized decision result message to the client, the arbiter also reports the decision result (mainly the decision of abnormal executors) to the negative feedback controller as the basis for the negative feedback controller to implement the executor scheduling.

[0041] (5) The negative feedback controller schedules the online execution body with abnormal decision to offline based on the decision result reported by the arbitrator, or schedules the execution body to offline based on some scheduling strategies (e.g., randomly select an online execution body to implement timed scheduling); and schedules the offline pre-execution body to online after processing such as synchronization (synchronizing the status and business data of the online execution body to achieve consistency between the status and business data of the execution body to be launched and the online execution body).

[0042] Next, let's combine... Figures 2-12 The present invention describes a method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system.

[0043] Please refer to Figure 2 , Figure 2This is a flowchart illustrating the adjudication method for Hypertext Transfer Protocol response messages in a mimicry system provided in an embodiment of the present invention. Figure 2 As shown, the method may include steps 201-204.

[0044] Step 201: Receive multiple non-empty packet response messages returned by an odd number of executors in the mimicry system within a preset timeout period; construct empty packet response messages for the executors that do not return non-empty packet response messages; selectively obtain the adjudication result or parse the response information including the response status code, response header, and response body based on the relationship between the number of empty packet response messages and the number of each executor.

[0045] Specifically, the preset timeout refers to the pre-configured timeout for the execution body's response. A non-empty response message refers to a received HTTP response message. An empty response message refers to a message with empty content constructed when the execution body does not return an HTTP response message.

[0046] Within a preset timeout period, non-empty packet response messages are continuously received from N (N≥3, N is an odd number) executors in the mimicry system. For executors that do not return a non-empty packet response message within the preset timeout period, an empty packet response message is constructed for that executor for subsequent adjudication, and the system no longer waits for the executor's response to reduce time consumption. If a non-empty packet response message is received from that executor after the preset timeout period, it is discarded, which can improve adjudication efficiency.

[0047] The system counts the number of empty packet response messages. Based on the relationship between the number of empty packet response messages and the number of each execution entity, it selectively obtains the adjudication result or parses the response information, including the response status code, response header, and response body. For example, if the ratio between the number of empty packet response messages and the number of each execution entity is greater than one-half, the adjudication result is: the empty packet response message is the adjudication result message, the execution entity corresponding to any empty packet response message is the adjudication result execution entity, and the execution entities corresponding to each non-empty packet response message are abnormal execution entities, and the adjudication ends. If the ratio between the number of empty packet response messages and the number of each execution entity is less than one-half, the received non-empty packet response messages are parsed to obtain the response information, including the response status code, response header, and response body. Then, the adjudication is performed sequentially: response status code adjudication, response header adjudication, and response body adjudication.

[0048] For message parsing, non-empty response messages are parsed according to the HTTP protocol. The byte stream in the non-empty response message is parsed into a memory object. The parsing result includes response status code, response header, and response body information, used for response message adjudication. The response status code indicates the result of an HTTP request to access a resource; for example, 200 indicates successful access, 404 indicates resource not found, and 500 indicates an internal server error. The response header has a fixed structure, being a collection of key-value pairs, with values ​​generally of basic data types and no nesting. When parsing the response body, it is categorized and parsed according to its data type. The data type of the response body can be determined by the Content-Type field in the response header. For structured data types such as JSON, XML, and HTML, the non-empty response message is parsed into a corresponding structured data type response body memory object. For example, when the data type of the response body in a non-empty response message is JSON, the response body is parsed into a JSON memory object. For unstructured data types such as plain text, audio, video, and byte streams, no further parsing is performed.

[0049] Step 202: Based on the consistency of the response status code, divide the received non-empty packet response messages into one or more first groups, and selectively obtain the adjudication result or obtain the first non-empty packet response message set based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages.

[0050] Specifically, since response status codes can indicate the result of an HTTP request to access a resource, such as successful access, resource not found, or internal server error, they can reflect attacks on the execution entity and thus can be used as a basis for adjudication.

[0051] Response status code consistency includes: if two response status codes are the same, they are considered consistent; otherwise, they are considered inconsistent. Based on response status code consistency, received non-empty packet response messages are divided into one or more first groups. By selectively obtaining a decision result or a set of first non-empty packet response messages based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages, the decision range can be narrowed down in a timely manner or a decision result can be obtained directly, thereby improving decision efficiency.

[0052] It should be noted that, due to the different structures of the response header and response body, the response header and response body are adjudicated separately to ensure the accuracy and efficiency of the adjudication. The adjudication of the response header and response body is described below through steps 203 and 204 respectively.

[0053] Step 203: Based on the consistency of the response header, divide the first non-empty packet response message set into one or more second groups, and selectively obtain the adjudication result or obtain the second non-empty packet response message set based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages.

[0054] Specifically, the response header, as one of the main data components of a non-empty packet response message, directly reflects whether the execution body has been effectively attacked, and therefore should also be included in the scope of adjudication. Response header consistency includes: if all fields of two response headers are identical, then the two response headers are considered consistent; otherwise, they are considered inconsistent. Based on response header consistency, the first set of non-empty packet response messages is divided into one or more second groups. The adjudication result or the second set of non-empty packet response messages is selectively obtained based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages. This allows for timely narrowing of the adjudication message range or direct acquisition of the adjudication result, thereby improving adjudication efficiency.

[0055] Step 204: Divide the second non-empty packet response message set into one or more third groups based on the data type of the response body, and obtain the decision result based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages.

[0056] As one of the main data components of a non-empty packet response message, the differences in the content of the response body directly reflect whether the execution body has been effectively attacked, and therefore should also be included in the scope of adjudication. Based on the data type of the response body (structured and unstructured data types), the second set of non-empty packet response messages is divided into one or more third groups. The adjudication result is obtained based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages. In other words, using different adjudication methods for response bodies of structured and unstructured data types can improve the accuracy and efficiency of adjudication.

[0057] The method for adjudicating Hypertext Transfer Protocol (HTTP) response messages in a mimicry system provided in this embodiment of the invention firstly receives multiple non-empty packet response messages returned by an odd number of executors in the mimicry system within a preset timeout period; for the executors that do not return non-empty packet response messages, empty packet response messages are constructed; that is, this embodiment of the invention supports a timeout mechanism, and for executors that do not return non-empty packet response messages within the preset timeout period, empty packet response messages are constructed for subsequent adjudication, and the system no longer waits for the executor's response to reduce time consumption and improve adjudication efficiency; based on the relationship between the number of empty packet response messages and the number of each executor, the adjudication result is selectively obtained or the response information including the response status code, response header, and response body is parsed; then, based on the consistency of the response status code, the received non-empty packet response messages are... The system divides the response body into one or more first groups. Based on the relationship between the maximum number of messages in each first group and the number of empty response messages, it selectively obtains a decision result or a first set of non-empty response messages. Next, based on the consistency of the response header, the first set of non-empty response messages is divided into one or more second groups. Based on the relationship between the maximum number of messages in each second group and the number of empty response messages, it selectively obtains a decision result or a second set of non-empty response messages. Finally, based on the data type of the response body, the second set of non-empty response messages is divided into one or more third groups. Based on the relationship between the maximum number of messages in each third group and the number of empty response messages, it obtains a decision result. In other words, this embodiment of the invention provides a "three-stage" decision-making scheme using response status codes, response headers, and response bodies. During decision-making, the response status code fully utilizes its summarizing role in the response status, and the response header and response body represent the response result as the main data of the response, with the three stages progressing step by step. When the response status code and response header decision-making is abnormal, the scope of the decision message can be narrowed down in a timely manner or a decision result can be obtained directly, thereby improving decision-making efficiency. Using different decision-making methods for response bodies of structured and unstructured data types can improve decision-making accuracy and efficiency. Therefore, the embodiments of the present invention can effectively adjudicate based on the characteristics of Hypertext Transfer Protocol (HTTP) response messages, thereby improving the accuracy and efficiency of HTTP response message adjudication.

[0058] In one embodiment, such as Figure 3 As shown, in step 201, the decision result is selectively obtained or the response information, including the response status code, response header, and response body, is parsed based on the relationship between the number of empty packet response messages and the number of each execution entity.

[0059] Step 301: Determine whether the ratio between the number of empty packet response messages and the number of each execution entity is greater than a preset ratio; if yes, proceed to step 302; if no, proceed to step 303; the preset ratio is less than 1.

[0060] Step 302: Determine that the empty packet response message is the adjudication result message, the execution body corresponding to any empty packet response message is the adjudication result execution body, and the execution body corresponding to each non-empty packet response message is the abnormal execution body, thereby obtaining the adjudication result and ending the adjudication;

[0061] Step 303: Based on the Hypertext Transfer Protocol, parse each received non-empty packet response message to obtain response information including the response status code, response header, and response body.

[0062] For example, with a preset ratio of 1 / 2, the number of empty packet response messages is counted. If the ratio between the number of empty packet response messages and the number of each execution body is greater than 1 / 2, it means that there are a large number of empty packet response messages. The decision is as follows: the empty packet response message is the decision result message, the execution body corresponding to any empty packet response message is the decision result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies. The decision ends. If the ratio between the number of empty packet response messages and the number of each execution body is less than or equal to 1 / 2, it means that there are a small number of empty packet response messages. The received non-empty packet response messages are parsed based on the Hypertext Transfer Protocol to obtain response information including the response status code, response header, and response body. Then, the response status code decision, response header decision, and response body decision are performed sequentially.

[0063] In this embodiment, when the ratio between the number of empty packet response messages and the number of each execution entity is greater than a preset ratio, the empty packet response message is directly determined as the decision result message, the execution entity corresponding to any empty packet response message is the decision result execution entity, and the execution entities corresponding to each non-empty packet response message are abnormal execution entities. The decision process ends, which can improve decision efficiency. When the ratio between the number of empty packet response messages and the number of each execution entity is less than or equal to the preset ratio, the received non-empty packet response messages are parsed based on the Hypertext Transfer Protocol to obtain response information including the response status code, response header, and response body. Then, the response status code decision, response header decision, and response body decision are performed sequentially.

[0064] In one embodiment, such as Figure 4 As shown, in step 202, the decision result or the first set of non-empty packet response messages is selectively obtained based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages, including steps 401-408.

[0065] Optionally, determining the first target packet based on the first packet corresponding to the maximum number of packets includes steps 401-403.

[0066] Step 401: Determine whether the first packet corresponding to the maximum number of packets is unique; if not, proceed to step 402; if yes, proceed to step 403.

[0067] Step 402: Sum the historical confidence or heterogeneous environment confidence of each execution entity in the first group corresponding to each maximum number of messages, select the first group corresponding to the maximum summation result as the first target group, and proceed to step 404.

[0068] Step 403: Determine the first packet corresponding to the maximum number of packets as the first target packet, and proceed to step 404;

[0069] Step 404: Determine whether the number of packets in the first target group is less than the number of empty packet response packets; if yes, proceed to step 405; if no, proceed to step 406.

[0070] Step 405: Determine that the empty packet response message is the adjudication result message, the execution body corresponding to any empty packet response message is the adjudication result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0071] Step 406: Determine if the number of packets in the first target packet is greater than 1; if not, proceed to step 407; if yes, proceed to step 408.

[0072] Step 407: Determine the unique non-empty packet response message in the first target group as the adjudication result message, the execution body corresponding to the unique non-empty packet response message in the first target group as the adjudication result execution body, and the execution bodies corresponding to all other response messages except the first target group as abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0073] Step 408: Determine each non-empty packet response message in the first target group as the first non-empty packet response message set.

[0074] In step 402, the confidence level is evaluated based on the historical performance of the executor's decisions, thus obtaining the historical confidence level of the executor. The number of decision inconsistency anomalies is negatively correlated with the historical confidence level; the fewer the number of decision inconsistency anomalies during the historical operation of the mimicry system, the higher the historical confidence level.

[0075] The credibility of the executor is scored using expert experience to obtain the credibility of the executor in heterogeneous environments. The scoring is based on the statistical and normalized number of vulnerabilities and backdoors discovered in components such as hardware platforms, operating environments, and software vendors.

[0076] Non-empty packet response messages are grouped based on the consistency of the response status code. If the first group corresponding to the maximum number of messages is not unique, the historical confidence or heterogeneous environment confidence of each executor in the first group corresponding to the maximum number of messages is summed. The first group corresponding to the maximum summation result is selected as the first target group. This can improve the accuracy of the adjudication by fully considering the historical confidence or heterogeneous environment confidence of the executor while ensuring the continuity of the adjudication service.

[0077] In step 403, if the first packet corresponding to the maximum number of packets is unique, the first packet corresponding to the maximum number of packets is taken as the first target packet.

[0078] In step 405, if the number of messages in the first target group is less than the number of empty packet response messages, that is, if the number of empty packet response messages is greater, the decision result is: the empty packet response message is the decision result message, the execution body corresponding to any empty packet response message is the decision result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies, and the decision ends.

[0079] In step 407, if the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is 1, the decision result is: the only non-empty packet response message in the first target group is the decision result message, the execution body corresponding to the only non-empty packet response message in the first target group is the decision result execution body, and the execution bodies corresponding to all other response messages except the first target group are abnormal execution bodies, and the decision ends.

[0080] In step 408, if the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is greater than 1, then each non-empty packet response message in the first target group is determined as the first non-empty packet response message set, which can narrow down the range of response messages for adjudication. Then, the response header adjudication is performed on the first non-empty packet response message set.

[0081] This embodiment provides a method for adjudicating response status codes. First, a first target group is determined based on the first group corresponding to the maximum number of messages. Then, if the number of messages in the first target group is less than the number of empty packet response messages (i.e., the number of empty packet response messages is relatively large), the adjudication result is obtained directly, and the adjudication ends, which can improve adjudication efficiency. If the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is 1, the adjudication result is obtained directly, and the adjudication ends, which can improve adjudication efficiency. If the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is greater than 1, the range of response messages for adjudication is directly narrowed, and then the response header is adjudicated, which can improve adjudication efficiency and accuracy.

[0082] In one embodiment, such as Figure 5 As shown, step 203, based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages, selectively obtains the decision result or obtains the second set of non-empty packet response messages, including:

[0083] Step 501: Determine whether the second group corresponding to the maximum number of packets is unique; if not, proceed to step 502; if yes, proceed to step 503.

[0084] Step 502: Sum the historical confidence or heterogeneous environment confidence of each execution entity in the second group corresponding to each maximum number of messages, and select the second group corresponding to the maximum summation result as the second target group, and proceed to step 504.

[0085] Step 503: Determine the second group corresponding to the maximum number of messages as the second target group, and proceed to step 504;

[0086] Step 504: Determine whether the number of packets in the second target group is less than the number of empty packet response packets; if yes, proceed to step 505; if no, proceed to step 506.

[0087] Step 505: Determine that the empty packet response message is the adjudication result message, the execution body corresponding to any empty packet response message is the adjudication result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0088] Step 506: Determine whether the number of packets in the second target group is greater than 1; if not, proceed to step 507; if yes, proceed to step 508.

[0089] Step 507: Determine the unique non-empty packet response message in the second target group as the adjudication result message, the execution body corresponding to the unique non-empty packet response message in the second target group as the adjudication result execution body, and the execution bodies corresponding to all other response messages except the second target group as abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0090] Step 508: Determine each non-empty packet response message in the second target group as the second non-empty packet response message set.

[0091] In step 502, the non-empty packet response messages in the filtered first non-empty packet response message set are grouped according to the consistency of the response header. If the second group corresponding to the maximum number of messages is not unique, the historical confidence or heterogeneous environment confidence of each executor in the second group corresponding to the maximum number of messages is summed, and the second group corresponding to the maximum summation result is selected as the second target group. This can fully consider the historical confidence or heterogeneous environment confidence of the executor while ensuring the continuity of the adjudication service, thereby improving the accuracy of the adjudication.

[0092] In step 503, if the second packet corresponding to the maximum number of packets is unique, the second packet corresponding to the maximum number of packets is taken as the second target packet.

[0093] In step 505, if the number of messages in the second target group is less than the number of empty packet response messages, that is, if the number of empty packet response messages is greater, the decision result is: the empty packet response message is the decision result message, the execution body corresponding to any empty packet response message is the decision result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies, and the decision ends.

[0094] In step 507, if the number of messages in the second target group is greater than or equal to the number of empty packet response messages, and the number of messages in the second target group is 1, the decision result is: the only non-empty packet response message in the second target group is the decision result message, the execution body corresponding to the only non-empty packet response message in the second target group is the decision result execution body, and the execution bodies corresponding to all other response messages except the second target group are abnormal execution bodies, and the decision ends.

[0095] In step 508, if the number of messages in the second target group is greater than or equal to the number of empty packet response messages, and the number of messages in the second target group is greater than 1, then each non-empty packet response message in the second target group is determined as the second non-empty packet response message set, which can narrow down the range of response messages for adjudication. Then, the response body adjudication is performed on the second non-empty packet response message set.

[0096] This embodiment provides a method for adjudicating response headers. It selects the second target group from multiple second groups corresponding to the maximum number of messages, based on the sum of historical confidence or heterogeneous environment confidence. This method improves adjudication accuracy by fully considering the historical confidence or heterogeneous environment confidence of the execution body while ensuring the continuity of adjudication services. Furthermore, if the number of messages in the second target group is less than the number of empty packet response messages (i.e., the number of empty packet response messages is greater), the adjudication result is obtained directly, and the adjudication ends, improving adjudication efficiency. If the number of messages in the second target group is greater than or equal to the number of empty packet response messages, and the number of messages in the second target group is 1, the adjudication result is obtained directly, and the adjudication ends, improving adjudication efficiency. If the number of messages in the second target group is greater than or equal to the number of empty packet response messages, and the number of messages in the second target group is greater than 1, the range of response messages for adjudication is narrowed before adjudicating the response body, improving both adjudication efficiency and accuracy.

[0097] In one embodiment, such as Figure 6 As shown, in step 204, the data type based on the response body divides the second non-empty packet response message set into one or more third groups, including:

[0098] Step 601: For the response body of the structured data type, divide the second non-empty packet response message set into one or more third groups based on the consistency of the response body;

[0099] Step 602: For response bodies of unstructured data types, calculate the hash value of the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set based on a preset hash algorithm, and divide the second non-empty packet response message set into one or more third groups based on the consistency of the response body hash values.

[0100] In step 601, response body consistency includes: if all fields of two response bodies are the same, then the two response bodies are determined to be consistent; otherwise, the two response bodies are determined to be inconsistent.

[0101] In step 602, the preset hash algorithm can be SHA256 (Secure Hash Algorithm 256-bit). The SHA256 algorithm has high security, reduces the possibility of hash collisions, and can improve the accuracy of the decision.

[0102] Response body hash value consistency includes: if the hash values ​​of two response bodies are the same, then the two response bodies are considered consistent; otherwise, the two response bodies are considered inconsistent.

[0103] For example, for response bodies of unstructured data types, the SHA256 algorithm is used to calculate the hash value of the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set, transforming the byte-by-byte comparison of the multi-byte response body into a hash value comparison of finite length, and dividing the second non-empty packet response message set into one or more third groups based on the consistency of the response body hash values.

[0104] In this embodiment, for response bodies of structured data types, the second set of non-empty packet response messages can be grouped based on response body consistency. For response bodies of unstructured data types, the hash values ​​of the response bodies of multiple non-empty packet response messages in the second set of non-empty packet response messages are calculated based on a preset hash algorithm, and the second set of non-empty packet response messages is grouped based on the consistency of the response body hash values. This allows for different grouping methods to be used for response bodies of different data types, improving both the accuracy and efficiency of the adjudication process.

[0105] In one embodiment, such as Figure 6 As shown, the decision result is obtained in step 204 based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages, including steps 603-610.

[0106] Optionally, determining the third target packet based on the third packet corresponding to the maximum number of packets includes steps 603-605.

[0107] Step 603: Determine whether the third packet corresponding to the maximum number of packets is unique; if not, proceed to step 604; if yes, proceed to step 605.

[0108] Step 604: Sum the historical confidence or heterogeneous environment confidence of each execution entity in the third group corresponding to each maximum number of messages, and select the third group corresponding to the maximum summation result as the third target group, and proceed to step 606.

[0109] Step 605: Determine the third packet corresponding to the maximum number of packets as the third target packet, and proceed to step 606;

[0110] Step 606: Determine whether the number of messages in the third target group is less than the number of empty packet response messages; if yes, proceed to step 607; if no, proceed to step 608.

[0111] Step 607: Determine that the empty packet response message is the adjudication result message, the execution body corresponding to any empty packet response message is the adjudication result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0112] Step 608: Determine if the number of packets in the third target group is greater than 1; if not, proceed to step 609; if yes, proceed to step 610.

[0113] Step 609: Determine the unique non-empty packet response message in the third target group as the adjudication result message, the execution body corresponding to the unique non-empty packet response message in the third target group as the adjudication result execution body, and the execution bodies corresponding to all other response messages except the third target group as abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0114] Step 610: Determine any non-empty packet response message in the third target group as the adjudication result message, the execution body corresponding to the adjudication result message as the adjudication result execution body, and the execution bodies corresponding to all other response messages except the third target group as abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication.

[0115] In step 604, if the third group corresponding to the maximum number of messages is not unique, the historical confidence or heterogeneous environment confidence of each executor in the third group corresponding to the maximum number of messages is summed, and the third group corresponding to the maximum summation result is selected as the third target group. This can fully consider the historical confidence or heterogeneous environment confidence of the executor while ensuring the continuity of the adjudication service, thereby improving the accuracy of the adjudication.

[0116] In step 605, if the third packet corresponding to the maximum number of packets is unique, the third packet corresponding to the maximum number of packets is taken as the third target packet.

[0117] In step 607, if the number of messages in the third target group is less than the number of empty packet response messages, that is, if the number of empty packet response messages is greater, the decision result is: the empty packet response message is the decision result message, the execution body corresponding to any empty packet response message is the decision result execution body, and the execution bodies corresponding to each non-empty packet response message are abnormal execution bodies, and the decision ends.

[0118] In step 609, if the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is 1, the decision result is: the only non-empty packet response message in the third target group is the decision result message, the execution body corresponding to the only non-empty packet response message in the third target group is the decision result execution body, and the execution bodies corresponding to all other response messages except the third target group are abnormal execution bodies, and the decision ends.

[0119] In step 610, if the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is greater than 1, the decision result is: any non-empty packet response message in the third target group is the decision result message, the execution body corresponding to the decision result message is the decision result execution body, and the execution bodies corresponding to all other response messages except the third target group are abnormal execution bodies, and the decision ends.

[0120] In this embodiment, firstly, a third target group is determined based on the third group corresponding to the maximum number of messages; then, the decision result is directly obtained based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages, which can improve decision efficiency.

[0121] Because information systems typically use random numbers generated by random number algorithms to identify objects managed by the system when providing services, this results in a large number of random numbers in the interaction messages between the client and the system service. Related technologies only filter the random number type field to eliminate its impact on consistency decisions, but this solution has the following problems: 1) After the dispatcher distributes the request, the execution body service in the mimicry system cannot recognize the random number type field.

[0122] 2) Conflicts arise when the client encounters inconsistent values ​​in the random number type field during changes to the execution body of the adjudication result across multiple adjudications. Both of these issues hinder the normal operation of the mimicry system.

[0123] To address this technical problem, specific embodiments are described below.

[0124] In one embodiment, the method further includes:

[0125] Step 205: Extract the mapping relationship of the response header fields from the first set of non-empty packet response messages, and construct the reverse mapping relationship of the response header fields based on the mapping relationship of the response header fields;

[0126] Step 206: For response bodies of structured data types, extract the mapping relationship of response body fields from the second non-empty packet response message set, and construct the reverse mapping relationship of response body fields based on the mapping relationship of response body fields.

[0127] Step 207: If the decision result message in the decision result is a non-empty packet response message, then the response header field values ​​and response body field values ​​of the decision result message are rewritten based on the reverse mapping relationship of the response header field and the reverse mapping relationship of the response body field in the cache server to form a new decision result message.

[0128] It should be noted that step 205 is executed before step 203, step 206 is executed before step 204, and step 207 is executed after step 204.

[0129] In step 205, specifically, the response header fields in the first non-empty packet response message set are traversed, the mapping relationship of the response header fields is extracted, and then the reverse mapping relationship of the response header fields is constructed based on the mapping relationship of the response header fields.

[0130] In one implementation, such as Figure 7 As shown, step 205 includes steps 701-703.

[0131] Step 701: Based on the preset response header field mapping relationship extraction rules, filter the target response header fields from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set; wherein, the preset response header field mapping relationship extraction rules are used to extract the response header fields on the response header field list, and the response header field list includes multiple random number type fields that affect the normal operation of the mimicry system business.

[0132] For example, assume that the first non-empty packet response message set contains response messages from 5 executors, where executor represents the executor and IP represents the executor identifier. The IPs of the 5 executors are IP_1, IP_2, IP_3, IP_4, and IP_5, with IP_1 being the smallest. Each non-empty packet response message from an executor has one response header, therefore there are a total of 5 response headers.

[0133] Assume each response header has 3 fields, and the field keys (which can be understood as field names) of these 3 fields are Field_1, Field_2, and Field_3.

[0134] The five response headers are as follows:

[0135] [Response Header 1]

[0136] Field_1:value_1_executor1

[0137] Field_2:value_2_executor1

[0138] Field_3:value_3_executor1

[0139] [Response Header 2]

[0140] Field_1:value_1_executor2

[0141] Field_2:value_2_executor2

[0142] Field_3:value_3_executor2

[0143] [Response Header 3]

[0144] Field_1:value_1_executor3

[0145] Field_2:value_2_executor3

[0146] Field_3:value_3_executor3

[0147] [Response Header 4]

[0148] Field_1:value_1_executor4

[0149] Field_2:value_2_executor4

[0150] Field_3:value_3_executor4

[0151] [Response Header 5]

[0152] Field_1:value_1_executor5

[0153] Field_2:value_2_executor5

[0154] Field_3:value_3_executor5.

[0155] The preset response header field mapping relationship extraction rules are used to extract response header fields from the response header field list, which includes multiple random number type fields that affect the normal operation of the mimicry system.

[0156] Optionally, the preset response header field mapping rules may include one or a combination of the following rules:

[0157] Rule 1: Fields that can match any element in the field key list [field key 1, field key 2, ...] are used to extract the response header field mapping relationship and construct the reverse mapping relationship;

[0158] Rule 2: Fields that can match any element in the field key regular expression list [field key regular expression 1, field key regular expression 2, ...] are used to extract the response header field mapping relationship and construct the reverse mapping relationship.

[0159] Rule 1 is used for exact matching of field keys; a match is considered successful if the field key to be processed matches any field key in the list. Rule 2 is used for fuzzy matching of field keys; a match is considered successful if the field key to be processed matches any field key in the list of regular expressions.

[0160] Regular expressions can be used to leverage the one-to-many matching capability of fuzzy matching patterns, reducing the number of elements in the preset rule list. Exact matching is used to compensate for the matching requirements of certain special fields where fuzzy matching is inconvenient, serving as a supplement to fuzzy matching to ensure the completeness of the matching.

[0161] In practical implementation, assuming that the combination of rule 1 and rule 2 is used as the preset response header field mapping relationship extraction rule, we can first perform regular expression fuzzy matching, and if it fails to match, then perform precise matching. Finally, after a successful match, we can obtain the target response header field, which can improve the accuracy and efficiency of response header field mapping relationship extraction and reverse mapping relationship construction.

[0162] Step 702: If the target response header field is selected, for each target response header field, extract the correspondence between the temporary decision value of the target response header field and the multiple field values ​​of the target response header field from the first non-empty packet response message set, and use it as the mapping relationship corresponding to the target response header field.

[0163] Optionally, for the provisional decision value, a target response header may be selected from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set; and the field value of the target response header field in the target response header may be determined as the provisional decision value of the target response header field.

[0164] Optionally, the response header corresponding to the execution entity with the smallest execution entity identifier is selected from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set, and used as the target response header. Preferably, the execution entity identifier is the Internet Protocol (IP) address of the execution entity.

[0165] For example, if the selected target response header field is Field_1, the field value value_1_executor1 of Field_1 in response header 1 is extracted from the above 5 response headers and used as the temporary adjudication value for Field_1. The multiple field values ​​of Field_1 include: value_1_executor1, value_1_executor2, value_1_executor3, value_1_executor4, and value_1_executor5. Therefore, the mapping relationship corresponding to Field_1 is:

[0166] value_1_executor1:{

[0167] IP_1:value_1_executor1

[0168] IP_2:value_1_executor2

[0169] IP_3:value_1_executor3

[0170] IP_4:value_1_executor4

[0171] IP_5:value_1_executor5

[0172] }

[0173] Step 703: Based on the mapping relationship corresponding to each target response header field, construct the correspondence between multiple field values ​​of the target response header field and the temporary decision value of the target response header field, as a set of reverse mapping relationships corresponding to the target response header field.

[0174] For example, based on the mapping relationship corresponding to Field_1 extracted above, a set of reverse mapping relationships corresponding to Field_1 is constructed:

[0175] reverse:IP_1:value_1_executor1:value_1_executor1

[0176] reverse:IP_2:value_1_executor2:value_1_executor1

[0177] reverse:IP_3:value_1_executor3:value_1_executor1

[0178] reverse:IP_4:value_1_executor4:value_1_executor1

[0179] reverse:IP_5:value_1_executor5:value_1_executor1.

[0180] In this context, reverse mapping relationships are represented as key-value pairs. Taking the first reverse mapping relationship in a set of reverse mapping relationships as an example, reverse:IP_1:value_1_executor1 is the key of the reverse mapping relationship, and value_1_executor1 is the value of the reverse mapping relationship.

[0181] Therefore, the number of mapping relationships equals the number of reverse mapping relationships. It should be noted that in the example above, if the number of fields conforming to the preset response header field mapping relationship extraction rules is 1, then the number of mapping relationships and the number of reverse mapping relationships are both 1. If the number of fields conforming to the preset response header field mapping relationship extraction rules is 2, then the number of mapping relationships and the number of reverse mapping relationships are both 2; this embodiment is not limited to this.

[0182] In this implementation, firstly, target response header fields that conform to preset response header field mapping relationship extraction rules are selected from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set. Then, the correspondence between the temporary ruling value of the target response header field and multiple field values ​​of the target response header field is extracted from the first non-empty packet response message set, serving as the mapping relationship corresponding to the target response header field. Finally, based on the mapping relationship corresponding to the target response header field, the correspondence between multiple field values ​​of the target response header field and the temporary ruling value of the target response header field is constructed, serving as a set of reverse mapping relationships corresponding to the target response header field, thereby completing the extraction of response header field mapping relationships and the construction of reverse mapping relationships.

[0183] In one implementation, such as Figure 8 As shown, the method for storing the mapping and reverse mapping relationships of response header fields may include the following steps:

[0184] Step 801: For each target response header field, iterate through the keys of each reverse mapping relationship corresponding to the target response header field, and query whether the keys of each reverse mapping relationship already exist in the cache server;

[0185] Step 802: If the keys for each reverse mapping relationship do not exist in the cache server, then store the mapping relationship corresponding to the target response header field and each reverse mapping relationship in the cache server;

[0186] Step 803: If any key of a reverse mapping relationship exists in the cache server, stop traversing, use the value of the existing reverse mapping relationship in the cache server as the key, and query and retrieve the corresponding mapping relationship in the cache server.

[0187] Step 804: Use the key of the obtained mapping relationship as the key of the new mapping relationship, and use the union of the value of the obtained mapping relationship and the value of the mapping relationship corresponding to the target response header field as the value of the new mapping relationship to construct a new mapping relationship;

[0188] Step 805: Based on the new mapping relationship, construct a new set of reverse mapping relationships.

[0189] Step 806: Store the new mapping relationship and each new reverse mapping relationship in the cache server.

[0190] For example, suppose the mapping relationship to be stored in the cache server is as follows:

[0191] value_2:{IP_1:value_1,IP_2:value_2,...,IP_n:value_n}.

[0192] The corresponding set of reverse mappings to be stored on the cache server is as follows:

[0193] reverse:IP_1:value_1:value_2

[0194] reverse:IP_2:value_2:value_2 ...

[0196] reverse:IP_n:value_n:value_2.

[0197] Assuming that the cache server already has relevant mapping relationships and reverse mapping relationships for the field values ​​of this target response header field:

[0198] Mapping relationship:

[0199] value_1:{IP_1:value_1,IP_2:value_2,...,IP_n:value_n};

[0200] Inverse mapping relationship:

[0201] reverse:IP_1:value_1:value_1

[0202] reverse:IP_2:value_2:value_1 ...

[0204] reverse:IP_n:value_n:value_1.

[0205] First, iterate through the keys of the set of reverse mappings to be stored in the cache server, checking if the keys for each reverse mapping already exist in the cache server. If the keys for each reverse mapping do not exist in the cache server, then store the mappings to be stored in the cache server along with the set of reverse mappings. In this example, the key for the reverse mapping (reverse:IP_1:value_1) exists in the cache server, so the iteration stops. The value (value_1) of the existing reverse mapping in the cache server is used as the key to query and retrieve the corresponding mapping in the cache server: value_1:{IP_1:value_1,IP_2:value_2,...,IP_n:value_n}.

[0206] Then, the key (value_1) of the obtained mapping relationship is used as the key of the new mapping relationship. The union of the values ​​of the obtained mapping relationship {IP_1:value_1,IP_2:value_2,...,IP_n:value_n} and the values ​​of the mapping relationship to be stored in the cache server {IP_1:value_1,IP_2:value_2,...,IP_n:value_n} is used as the value of the new mapping relationship {IP_1:value_1,IP_2:value_2,...,IP_n:value_n}, thus constructing a new mapping relationship: value_1:{IP_1:value_1,IP_2:value_2,...,IP_n:value_n}.

[0207] Next, based on the new mapping relationship, construct a new set of reverse mapping relationships:

[0208] reverse:IP_1:value_1:value_1

[0209] reverse:IP_2:value_2:value_1 ...

[0211] reverse:IP_n:value_n:value_1.

[0212] Finally, the new mapping relationships and each new reverse mapping relationship are stored in the cache server.

[0213] In this implementation, if the cache server does not have the keys for the reverse mappings corresponding to the target response header fields, the mappings for the target response header fields and the reverse mappings are directly stored in the cache server. If the cache server has the key for any reverse mapping corresponding to the target response header field, the value of the existing reverse mapping in the cache server is used as the key to query and retrieve the corresponding mapping in the cache server; the key of the retrieved mapping is used as the key of the new mapping; the union of the value of the retrieved mapping and the value of the mapping corresponding to the target response header field is used as the value of the new mapping, and a new mapping is constructed; based on the new mapping, a new set of reverse mappings is constructed; and the new mapping and each new reverse mapping are stored in the cache server. In this way, response header field mappings and reverse mappings can be selectively stored for different scenarios.

[0214] In one implementation, after step 205, the method further includes: filtering the response header fields in the response headers of multiple non-empty packet response messages in the first non-empty packet response message set based on preset response header field filtering rules; the preset response header field filtering rules are used to filter response header fields of random number type and time type in the response header filtering field list. Step 203, which divides the first non-empty packet response message set into one or more second groups based on response header consistency, includes: dividing the filtered first non-empty packet response message set into one or more second groups based on response header consistency.

[0215] Optionally, the preset response header field filtering rules include one or a combination of the following rules:

[0216] Rule 1': Fields that match any element in the field key list [field key 1, field key 2, ...] are filtered.

[0217] Rule 2': Fields that match any element in the field key regular expression list [field key regular expression 1, field key regular expression 2, ...] are filtered.

[0218] Rule 1' is used for filtering in the case of exact match of field keys, and rule 2' is used for filtering in the case of fuzzy match of field keys.

[0219] In practical implementation, assuming that the combination of rule 1' and rule 2' is used as the preset response header field filtering rule, we can first perform fuzzy matching of field keys, and if the matching fails, then perform exact matching of field keys. Finally, after a successful match, we can perform filtering to improve the accuracy and efficiency of filtering.

[0220] Optionally, the filtering method can be to set the value to zero or to directly remove the field.

[0221] The response header fields in the first set of non-empty packet response messages are filtered. Based on the consistency of the response headers, the filtered set of first non-empty packet response messages is divided into one or more second groups, which can filter out random number type and time type fields. Determining the mapping relationship and reverse mapping relationship of the response header fields before filtering can make the mapping relationship and reverse mapping relationship of the response header fields more comprehensive.

[0222] In this embodiment, the response header fields in the response headers of multiple non-empty packet response messages in the first non-empty packet response message set are filtered according to the preset response header field filtering rules. This can eliminate the influence of random number type and time type fields on the response header consistency decision and effectively improve the accuracy of response header decision.

[0223] In step 206, specifically, for the response body of the structured data type, the response body fields in the second non-empty packet response message set are traversed, the mapping relationship of the response body fields is extracted, and then the reverse mapping relationship of the response body fields is constructed based on the mapping relationship of the response body fields.

[0224] In one embodiment, such as Figure 9 As shown, step 206 includes:

[0225] Step 901: For the response body of the structured data type, according to the preset response body field mapping relationship extraction rules, select target response body fields from the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set; wherein, the preset response body field mapping relationship extraction rules are used to extract response body fields on the response body field list, and the response body field list includes multiple random number type fields that affect the normal operation of the mimicry system business.

[0226] Step 902: If the target response body field is selected, for each target response body field, extract the correspondence between the temporary ruling value of the target response body field and the multiple field values ​​of the target response body field from the second non-empty packet response message set, and use it as the mapping relationship corresponding to the target response body field.

[0227] Step 903: Based on the mapping relationship corresponding to each target response body field, construct the correspondence between multiple field values ​​of the target response body field and the temporary adjudication value of the target response body field, as a set of reverse mapping relationships corresponding to the target response body field.

[0228] Optionally, for the provisional decision value, a target response body can be selected from the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set; and the field value of the target response body field in the target response body can be determined as the provisional decision value of the target response body field.

[0229] Optionally, the response body corresponding to the execution body with the smallest execution body identifier is selected from the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set, and used as the target response body. Preferably, the execution body identifier is the Internet Protocol address of the execution body.

[0230] Optionally, the preset response body field mapping relationship extraction rules may include one or a combination of the following rules:

[0231] Rule 1: Fields that can match any element in the field key list [field key 1, field key 2, ...] are used to extract the field mapping relationship in the response body and construct the reverse mapping relationship;

[0232] Rule 2: Fields that can match any element in the field key regular expression list [field key regular expression 1, field key regular expression 2, ...] are processed to extract the field mapping relationship in the response body and construct the reverse mapping relationship;

[0233] Rule 3: Fields that can match any element in the list of field value regular expressions [field value regular expression 1, field value regular expression 2, ...] are processed to extract the field mapping relationship in the response body and construct the reverse mapping relationship.

[0234] Rule 1 is used for exact matching of field keys, rule 2 is used for fuzzy matching of field keys, and rule 3 is used for fuzzy matching of field values.

[0235] In practical implementation, assuming that the combination of rule 1, rule 2 and rule 3 is used as the preset response body field mapping relationship extraction rule, we can first perform fuzzy matching of field keys. If the matching fails, we can then perform exact matching of field keys. If the matching fails, we can then perform fuzzy matching of field values. Finally, after a successful match, we can perform response body field mapping relationship extraction and reverse mapping relationship construction. This can improve the accuracy and efficiency of response body field mapping relationship extraction and reverse mapping relationship construction, and prevent omissions.

[0236] It should be noted that the process of extracting the mapping relationship of the response body fields and constructing the reverse mapping relationship is similar to the process of extracting the mapping relationship of the response header fields and constructing the reverse mapping relationship, and will not be described in detail here.

[0237] In this implementation, firstly, for the response body of a structured data type, target response body fields that conform to preset response body field mapping relationship extraction rules are selected from the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set. Then, the correspondence between the temporary ruling value of the target response body field and multiple field values ​​of the target response body field is extracted from the second non-empty packet response message set, serving as the mapping relationship corresponding to the target response body field. Finally, based on the mapping relationship corresponding to the target response body field, the correspondence between multiple field values ​​of the target response body field and the temporary ruling value of the target response body field is constructed, serving as a set of reverse mapping relationships corresponding to the target response body field, thereby completing the extraction of response body field mapping relationships and the construction of reverse mapping relationships.

[0238] In one implementation, such as Figure 10 As shown, the method for storing the mapping and reverse mapping relationships of response body fields may include the following steps:

[0239] Step 1001: For each target response body field, iterate through the keys of each reverse mapping relationship corresponding to the target response body field, and query whether the keys of each reverse mapping relationship already exist in the cache server;

[0240] Step 1002: If the keys for each reverse mapping relationship do not exist in the cache server, then store the mapping relationship corresponding to the target response body field and each reverse mapping relationship in the cache server;

[0241] Step 1003: If any key of a reverse mapping relationship exists in the cache server, stop traversing, use the value of the existing reverse mapping relationship in the cache server as the key, and query and obtain the corresponding mapping relationship in the cache server.

[0242] Step 1004: Use the key of the obtained mapping relationship as the key of the new mapping relationship, and use the union of the value of the obtained mapping relationship and the value of the mapping relationship corresponding to the target response body field as the value of the new mapping relationship to construct a new mapping relationship;

[0243] Step 1005: Based on the new mapping relationship, construct a new set of reverse mapping relationships;

[0244] Step 1006: Store the new mapping relationship and each new reverse mapping relationship in the cache server.

[0245] It should be noted that the stored procedures for the mapping and reverse mapping of response body fields are similar to those for the mapping and reverse mapping of response header fields, and will not be elaborated here.

[0246] In this implementation, if the cache server does not have keys for the reverse mapping relationships corresponding to the target response body fields, the mapping relationships corresponding to the target response body fields and the reverse mapping relationships are directly stored in the cache server. If the cache server has keys for any reverse mapping relationship corresponding to the target response body fields, the value of the existing reverse mapping relationship in the cache server is used as the key to query and retrieve the corresponding mapping relationship in the cache server; the key of the retrieved mapping relationship is used as the key of the new mapping relationship, and the union of the value of the retrieved mapping relationship and the value of the mapping relationship corresponding to the target response body fields is used as the value of the new mapping relationship to construct a new mapping relationship; based on the new mapping relationship, a new set of reverse mapping relationships is constructed; and the new mapping relationship and each new reverse mapping relationship are stored in the cache server. In this way, the response body field mapping relationships and reverse mapping relationships can be selectively stored for different scenarios.

[0247] In one implementation, after step 206, the method further includes: filtering the response body fields of multiple non-empty packet response messages in the second non-empty packet response message set based on preset response body field filtering rules for response bodies of structured data types; the preset response body field filtering rules are used to filter response body fields of random number type and time type in the response body filtering field list. Step 204, which divides the second non-empty packet response message set into one or more third groups based on the data type of the response body, includes: dividing the filtered second non-empty packet response message set into one or more third groups for response bodies of structured data types.

[0248] Optionally, the preset response header field filtering rules include one or a combination of the following rules:

[0249] Rule 1': Fields that match any element in the field key list [field key 1, field key 2, ...] are filtered.

[0250] Rule 2': Fields that can match any element in the field key regular expression list [field key regular expression 1, field key regular expression 2, ...] are filtered;

[0251] Rule 3': Fields that can match any element in the list of field value regular expressions [field value regular expression 1, field value regular expression 2, ...] are filtered.

[0252] Rule 1' is used for filtering in the case of exact match of field keys, rule 2' is used for filtering in the case of fuzzy match of field keys, and rule 3' is used for filtering in the case of fuzzy match of field values.

[0253] In practical implementation, assuming that the combination of rule 1', rule 2' and rule 3' is used as the preset response body field filtering rule, we can first perform fuzzy matching of field keys. If the matching fails, we can then perform exact matching of field keys. If the matching fails, we can then perform fuzzy matching of field values. Finally, after a successful match, we can perform filtering to improve the accuracy and efficiency of the filtering process.

[0254] Optionally, the filtering method can be to set the value to zero or to directly remove the field.

[0255] For response bodies of structured data types, the response body fields in the second set of non-empty packet response messages are filtered. The filtered second set of non-empty packet response messages is then divided into one or more third groups, which can filter out random number type fields and time type fields. Determining the mapping and reverse mapping relationships of the response body fields before filtering makes these relationships more comprehensive.

[0256] In this embodiment, the response body fields of multiple non-empty packet response messages in the second non-empty packet response message set are filtered according to the preset response body field filtering rules. This can eliminate the influence of random number type and time type fields on the response body consistency decision and effectively improve the accuracy of the response body decision.

[0257] In step 207, specifically, if the adjudication result message in the adjudication result is a non-empty packet response message, then the response header field values ​​and response body field values ​​of the adjudication result message are rewritten according to the reverse mapping relationship of the response header field and the response body field in the cache server. This ensures that the random number type field has the same output even when the execution bodies of the two adjudication results are inconsistent, which can solve the conflict problem caused by the inconsistency of the random number type field value when the execution body of the adjudication result changes for the client corresponding to the execution body service in the mimicry system between multiple adjudications. The rewritten new adjudication result message is returned to the client, and the information of the abnormal execution body of the adjudication is reported to the negative feedback controller, providing the negative feedback controller with the basis for scheduling abnormal execution bodies.

[0258] After completing the random number type field processing, which includes extracting the mapping relationship, constructing the reverse mapping relationship, storing the mapping relationship and the reverse mapping relationship in the cache server, and rewriting the adjudication result message based on the reverse mapping relationship in the cache server, the effect is illustrated by the following example.

[0259] Because information systems typically use random numbers generated by random number algorithms to identify objects managed by the system when providing services, this results in a large number of random numbers in the interaction messages between the client and the system service. Related technologies only filter the random number type field to eliminate its impact on consistency decisions, but this solution has the following problems: 1) After the dispatcher distributes the request, the execution body service in the mimicry system cannot recognize the random number type field.

[0260] 2) Conflicts arise when the client encounters inconsistent values ​​in the random number type field during changes to the execution body of the adjudication result across multiple adjudications. Both of these issues hinder the normal operation of the mimicry system.

[0261] like Figure 11 As shown, Figure 11 The schematic diagram of the business operation process of the mimicry system, which lacks a random number type field processing mechanism, faces two problems that hinder the operation of the mimicry system. Specifically, the first problem is that after the dispatcher distributes the request, the execution service in the mimicry system cannot recognize the random number type field. First, based on Figure 11 Let's illustrate the cause of problem one with an example. The initial business message exchange process is as follows:

[0262] (1) The client first initiates a GET request to query all field keys and field values;

[0263] (2) The dispatcher copies the request from the client and dispatches the request to Executor 1 and Executor 2;

[0264] (3) Assume that the field with the key id is a random number type field, the field value corresponding to the key id in execution body 1 is uuid1, and the field value corresponding to the key id in execution body 2 is uuid2 (the same below); after receiving the request, both execution body 1 and execution body 2 respond to the GET method request. In the response message of execution body 1, the field value corresponding to the key id is uuid1, and in the response message of execution body 2, the field value corresponding to the key id is uuid2.

[0265] (4) The response messages returned by Executor 1 and Executor 2 are processed to obtain the arbitration result. Assuming that the arbitration result Executor is Executor 1, the field value corresponding to the field key id in the arbitration result message received by the client is uuid1.

[0266] The client and the execution service have completed their first business message exchange. Following this, the second business message exchange process is as follows:

[0267] (1) The client initiates a DELETE method request to delete the object in the execution body whose field key is id and field value is uuid1;

[0268] (2) The dispatcher copies and distributes the DELETE method request to both executors;

[0269] (3) After receiving the request, Executor 1, as the executor of the previous ruling, can respond to the DELETE method request and perform the action of deleting the object because the field keys and values ​​inside it are consistent with the DELETE method request. Executor 2 cannot recognize the field because the field value corresponding to the field key id inside it is uuid2, which is inconsistent with the field value uuid1 in the DELETE method request, resulting in an error in the action.

[0270] Of the two problems hindering the operation of the mimicry system, problem two refers to the conflict caused by inconsistent values ​​of the random number type field when the execution body of the decision changes between multiple decisions, affecting the client. Next, based on... Figure 11 An example illustrates the cause of problem two. The initial business message exchange process is as follows:

[0271] (1) The client first initiates a GET request to query all field keys and field values;

[0272] (2) The dispatcher copies the request from the client and dispatches the request to Executor 1 and Executor 2;

[0273] (3) After receiving the request, both Executor 1 and Executor 2 responded to the GET method request. The field value corresponding to the field key id in the response message of Executor 1 is uuid1, and the field value corresponding to the field key id in the response message of Executor 2 is uuid2.

[0274] (4) The response messages returned by Executor 1 and Executor 2 are processed to obtain the arbitration result. Assuming that the arbitration result is Executor 1, the client obtains the field key id and the corresponding field value is uuid1.

[0275] The client and the execution service have completed the first business message exchange. Next, assuming the negative feedback controller, based on a predetermined scheduling strategy, schedules execution 1 offline and selects execution 2 online as the synchronization source. The prepared execution is then synchronized and brought online. Since synchronization will bring the state and business data of the execution to be brought online consistent with the synchronization source execution, the value of the field with the key 'id' in the newly brought online execution (execution 1') will be 'uuid2'. At this point, based on the first business message exchange, the second business message exchange process is as follows:

[0276] (1) The client initiates a GET request to query all field keys and field values;

[0277] (2) The dispatcher copies the request from the client and dispatches the request to Executor 1' and Executor 2;

[0278] (3) At this time, the field value corresponding to the field key id in execution body 1' is uuid2, and the field value corresponding to the field key id in execution body 2 is uuid2; after receiving the request, both execution body 1' and execution body 2 responded to the GET method request. The field value corresponding to the field key id in the response message of execution body 1' is uuid2, and the field value corresponding to the field key id in the response message of execution body 2 is also uuid2;

[0279] (4) The response messages returned by Executor 1' and Executor 2 are processed to obtain the arbitration result. Regardless of whether the Executor of the arbitration result is Executor 1' or Executor 2, the field value corresponding to the field key id in the arbitration result message received by the client is uuid2.

[0280] This conflicted with the response message received by the client at the end of the first business message exchange, causing operational issues in the mimicry system. It's worth noting that the "client" refers to the client corresponding to the execution service in the mimicry system; this client can be a non-mimicry service or a client of the mimicry system itself. The non-mimicry service obtains the field value and continues subsequent processing, while the mimicry system's client receives the field value and displays it. The conflict could manifest as merely a change in the content displayed by the mimicry system's client, or as the non-mimicry service being unable to recognize the field value, ultimately affecting user experience and the system's normal operation. It should be pointed out that, considering the cost of mimicry and the rationality of selecting the mimicry scope, when performing mimicry modifications on information systems, the entire information system is often not mimicked; instead, a portion is selected for mimicry modification. For example, there is a tendency to treat control services as mimicry services and treat specific execution services as non-mimicry services without mimicry. This is a common approach to mimicry in the field of information system mimicry defense. The advantage is that it can balance the cost of mimicry transformation, the scope and effectiveness of mimicry defense. It has wide applications in the mimicry transformation of distributed storage, cloud platforms, etc., which is also the reason for the existence of non-mimicry services.

[0281] To address the two problems hindering the operation of the mimicry system, such as Figure 12 As shown, in Figure 11 Based on this, a random number type field processing mechanism has been added. The following is based on Figure 12 To illustrate the principle behind solving problem one, the initial business message exchange process is as follows:

[0282] (1) The client first initiates a GET request to query all field keys and field values;

[0283] (2) Since the HTTP request method is GET and the request does not contain a random number type field value that needs to be rewritten, the dispatcher does not need to query the cache server;

[0284] (3) The dispatcher copies the request from the client and dispatches the request to Executor 1 and Executor 2;

[0285] (4) After receiving the request, both Executor 1 and Executor 2 respond to the GET method request. The field value corresponding to the field key id in the response message of Executor 1 is uuid1, and the field value corresponding to the field key id in the response message of Executor 2 is uuid2.

[0286] (5) After receiving the response messages from Executor 1 and Executor 2, the adjudication device extracts the mapping relationship from the field value of the key id, and constructs a reverse mapping relationship based on the mapping relationship. The mapping relationship is uuid1:{IP_1:uuid1,IP_2:uuid2}, where IP_1 and IP_2 are the IP addresses of Executor 1 and Executor 2, respectively, with IP_1 being smaller. A set of reverse mapping relationships is constructed, including reverse:IP_1:uuid1:uuid1 and reverse:IP_2:uuid2:uuid1. Taking the second reverse mapping relationship as an example, reverse:IP2:uuid2 is the key of the reverse mapping relationship (reverse is a fixed prefix for the key, used to distinguish it from the mapping relationship), and uuid1 is the value of the reverse mapping relationship. Traversing the keys of the two reverse mapping relationships, the cache server is queried, and it is found that neither of them exists in the cache server.

[0287] (6) Store the mapping relationship and reverse mapping relationship in the cache server;

[0288] (7) Assuming the adjudication result execution body is execution body 1, and the value of the field with the key 'id' in the adjudication result message is uuid1, before returning the adjudication result message to the client, the field value uuid1 corresponding to the key 'id' is rewritten to uuid1 according to the reverse mapping relationship reverse:IP_1:uuid1:uuid1 in the cache server. The field value corresponding to the key 'id' in the adjudication result response message received by the client is uuid1.

[0289] The second business message exchange process is as follows:

[0290] (1) The client initiated a DELETE method request to delete the object in the execution body whose field key is id and whose field value is uuid1;

[0291] (2) The dispatcher uses the field value uuid1 in the client request message as the key to query the mapping relationship uuid1:{IP_1:uuid1,IP_2:uuid2} in the cache server. Then, based on the IP address IP_1 of execution body 1 and the IP address IP_2 of execution body 2, it rewrites the field values ​​in the request message. The result of the rewriting is that the field value uuid1 corresponding to the field key id in the request dispatched to execution body 2 is rewritten to uuid2, while the field value uuid1 in the request dispatched to execution body 1 remains unchanged. It should be noted that when the dispatcher rewrites the client's request, the field value to be rewritten can be in any one or more places in the URL, request header, and request body.

[0292] (3) The dispatcher distributes the request to Executor 1 and Executor 2;

[0293] (4) The field values ​​in the DELETE method requests received by Executor 1 and Executor 2 are consistent with the field values ​​that the Executor can recognize. Both Executors can respond to the DELETE method requests normally and perform the action of deleting objects. The problem of the Executor service not recognizing random number type fields is solved, and the mimicry system can continue to operate normally.

[0294] like Figure 12 As shown, in Figure 11 Based on this, a random number type field processing mechanism has been added. The following is based on Figure 12 Let's illustrate the principle behind solving problem two with an example. The first business message interaction process, again exemplified by the client initiating a GET request to query all field keys and values, is identical to the first business message interaction process used to explain the principle behind problem one, and will not be repeated here.

[0295] After the first business message exchange is completed, the negative feedback controller, based on a predetermined scheduling strategy (e.g., randomly selecting executors for periodic cleaning), schedules executor 1 offline and selects executor 2 online as the synchronization source. The prepared executor is then synchronized and brought online. Since synchronization will bring the state and business data of the executor to be brought online consistent with the synchronization source executor, the value of the field with the id key in the newly brought online executor (executor 1') is uuid2. At this point, based on the first business message exchange, the second business message exchange process is as follows:

[0296] (1) The client initiated a GET request to query all field keys and field values;

[0297] (2) Since the HTTP request method is GET and the request does not contain a random number type field value that needs to be rewritten, the dispatcher does not need to query the cache server;

[0298] (3) The dispatcher copies the request from the client and dispatches the request to Executor 1' and Executor 2;

[0299] (4) After receiving the request, both execution body 1' and execution body 2 responded to the GET method request. The field value corresponding to the field key id in the response message of execution body 1' is uuid2, and the field value corresponding to the field key id in the response message of execution body 2 is also uuid2.

[0300] (5) Upon receiving the response messages returned by Executor 1' and Executor 2, the adjudication device extracts the mapping relationship uuid2:{IP_1':uuid2,IP_2:uuid2}, constructs a set of reverse mapping relationships reverse:IP_1':uuid2:uuid2, reverse:IP_2:uuid2:uuid2; iterates through the reverse mapping relationships, using the key of the reverse mapping relationship as the key to query the cache server for the reverse mapping relationship reverse:IP_2:uuid2:uuid1 stored during the first business message interaction, and uses the reverse mapping relationship in the cache server to retrieve the reverse mapping relationship reverse:IP_2:uuid2:uuid1 stored during the first business message interaction. The value of rse:IP_2:uuid2:uuid1, with uuid1 as the key, is used to query the cache server. A mapping relationship, uuid1:{IP_1:uuid1,IP_2:uuid2}, stored during the first business message interaction, is found. Using the key uuid1 of this mapping relationship in the cache server as the key of a new mapping relationship, the union of the values ​​{IP_1:uuid1,IP_2:uuid2} in the cache server and the values ​​{IP_1':uuid2,IP_2:uuid2} of the mapping relationship to be stored in the cache server (i.e., the mapping relationship extracted in this step) is used to find the new mapping relationship. d1, IP_2:uuid2, IP_1':uuid2} are used as the values ​​of the new mapping relationship, forming a new mapping relationship uuid1:{IP_1:uuid1,IP_2:uuid2,IP_1':uuid2}; based on the new mapping relationship, a new set of reverse mapping relationships reverse:IP_1:uuid1:uuid1,reverse:IP_2:uuid2:uuid1,reverse:IP_1':uuid2:uuid1 are constructed;

[0301] (6) Store the new mapping relationship and the new reverse mapping relationship in the cache server;

[0302] (7) After obtaining the ruling result, assuming the ruling result execution body is execution body 1', before returning the ruling result message to the client, query the reverse mapping relationship reverse:IP_1':uuid2:uuid1 stored in the cache server in the above steps, and rewrite the value of the field with the key id in the ruling result message uuid2 to uuid1 based on this reverse mapping relationship; similarly, assuming the ruling execution body is execution body 2, the value of the field with the key id in the ruling result message uuid2 can also be rewritten to uuid1.

[0303] (8) In the response message received by the client, the field value of the key id is still uuid1.

[0304] This is consistent with the value of the field in the response message received by the client at the end of the first business message exchange. The conflict no longer exists, and the second problem that hindered the operation of the mimicry system has been resolved.

[0305] It's worth noting that the example given for Problem 2 above was based on an execution body scheduling scenario. In reality, besides execution body scheduling, any scenario that causes changes to the execution body of the decision result between multiple decisions, leading to inconsistencies in the values ​​of the same random number type field obtained by the client in two consecutive message exchanges, will also cause conflicts. For example, this problem will also occur in scenarios where the execution body changes due to an abnormal decision (since the message content contains more than just a random number type field with the key 'id', inconsistencies in other fields or content may lead to the decision being judged as an abnormal execution body; therefore, the execution body of the decision result from the first decision might be judged as an abnormal execution body in the second decision, and is no longer the same as the second decision's decision result). How Problem 2 arises in this scenario and how it is resolved through the random number type field processing mechanism can be derived using similar analysis methods in the execution body scheduling scenario, and will not be repeated here. Furthermore, for the sake of brevity and clarity, three simplifications have been made in explaining Problems 1 and 2 above:

[0306] (1) A relatively basic but typical message interaction process was selected;

[0307] (2) This explanation will only take two online executors as an example;

[0308] (3) Only the main steps of the technical solution are described, rather than all the details. For example: Before the first business message interaction process, it is assumed that there is no mapping relationship or reverse mapping relationship related to the random number type field with the key id in the cache server. This allows the focus to be on explaining the key issues causing the problem and the key technologies for solving the problem.

[0309] In fact, in real business scenarios of mimicry systems with random number type fields (such as continuous interaction of multiple message exchanges such as adding, deleting, modifying, and querying, multiple online execution entities, execution entity scheduling, and adjudication of anomalies), the random number type field processing mechanism provided by this invention can also ensure the continuous normal operation of mimicry system business.

[0310] Therefore, the random number type field processing mechanism can provide data support for the mapping relationship of random number type field values ​​to solve the problem that the execution body service cannot recognize the random number type field after the mimicry system dispatcher distributes the request, and solve the conflict problem caused by the inconsistency of random number type field values ​​when the execution body of the adjudication result changes between multiple adjudications, thereby ensuring that the mimicry system business can continue to operate normally.

[0311] In this embodiment, the random number type field processing mechanism specifically includes: extracting the mapping relationship of response header fields from the first non-empty packet response message set, and constructing the reverse mapping relationship of response header fields based on the mapping relationship of response header fields; for response bodies of structured data types, extracting the mapping relationship of response body fields from the second non-empty packet response message set, and constructing the reverse mapping relationship of response body fields based on the mapping relationship of response body fields; if the adjudication result message in the adjudication result is a non-empty packet response message, then the response header field value and response body field value of the adjudication result message are rewritten based on the reverse mapping relationship of response header fields and the reverse mapping relationship of response body fields in the cache server to form a new adjudication result message; in this way, data support for the mapping relationship of random number type field values ​​can be provided to solve the problem that the execution body service cannot recognize random number type fields after the mimicry system dispatcher distributes requests, and to solve the conflict problem caused by the inconsistency of random number type field values ​​when the client corresponding to the execution body service in the mimicry system changes the adjudication result execution body between multiple adjudications. Therefore, this embodiment can solve the problem that the execution body service in the mimicry system cannot recognize the random number type field, and the conflict caused by the inconsistent value of the random number type field when the execution body changes the decision result between multiple decisions, so as to ensure that the mimicry system business can continue to operate normally.

[0312] In one embodiment, the method further includes: logging abnormal scenarios during the adjudication process to obtain adjudication abnormal logs; performing multi-dimensional analysis on the adjudication abnormal logs, including at least one of the following dimensions: attack time, attack source location, attack type, and number of attacks, to obtain multi-dimensional analysis results; and generating an attack situation analysis report based on the multi-dimensional analysis results.

[0313] Specifically, logging abnormal scenarios during the adjudication process can support the tracing and localization of anomalies. Big data analysis is then performed on the adjudication anomaly logs, including multi-dimensional analysis results encompassing at least one of the following dimensions: attack time, attack source location, attack type, and attack frequency. These multi-dimensional analysis results are then combined to generate an attack posture analysis report.

[0314] Optionally, this embodiment also supports multi-condition combination query of attack situation, graphical display of attack situation diagram, and output of attack situation analysis report.

[0315] For the analysis of the attack source location dimension, the attack source location can be obtained by looking up a table based on the client IP.

[0316] For attack type analysis, feature analysis can be performed based on the adjudication exception logs to determine the attack type. The sources of these features include the Uniform Resource Locator (URL), method, request headers, request body, and N-way response messages of the request message. Attack types include: DoS attacks, XSS attacks, CSRF attacks, etc.

[0317] Attack posture analysis reports can serve as a basis for system security improvements, thus forming a closed-loop mechanism from adjudicating anomalies to mimicking system security improvements. Taking DoS attacks as an example, by strengthening firewalls, blocking the attack source IP, and simultaneously denying service to request packets that match specific characteristics, more effective security defenses can be achieved.

[0318] In this embodiment, the adjudication anomaly log is fully utilized to conduct multi-dimensional attack situation analysis. The analysis results can serve as the basis for improving system security, thereby forming a closed-loop mechanism from adjudication anomalies to mimicry system security improvement, and thus enhancing the security of the mimicry system.

[0319] The following describes the adjudication device for the Hypertext Transfer Protocol (HTTP) response message of the mimicry system provided by the present invention. The adjudication device for the Hypertext Transfer Protocol (HTTP) response message of the mimicry system described below can be referred to in correspondence with the adjudication method for the Hypertext Transfer Protocol (HTTP) response message of the mimicry system described above.

[0320] Please refer to Figure 13 , Figure 13 This is a schematic diagram of the structure of the adjudication device for the Hypertext Transfer Protocol response message of the mimicry system provided in an embodiment of the present invention. Figure 13 As shown, the device may include:

[0321] The first adjudication module 10 is used to receive multiple non-empty packet response messages returned by an odd number of executors in the mimicry system within a preset timeout period; construct empty packet response messages for the executors that do not return non-empty packet response messages; and selectively obtain adjudication results or parse and obtain response information including response status codes, response headers and response bodies based on the relationship between the number of empty packet response messages and the number of each executor.

[0322] The second adjudication module 20 is used to divide the received non-empty packet response messages into one or more first groups based on the consistency of the response status codes, and selectively obtain the adjudication result or obtain the first non-empty packet response message set based on the relationship between the maximum number of messages in each first group and the number of empty packet response messages.

[0323] The third adjudication module 30 is used to divide the first non-empty packet response message set into one or more second groups based on the consistency of the response header, and selectively obtain the adjudication result or obtain the second non-empty packet response message set based on the relationship between the maximum number of messages in each second group and the number of empty packet response messages.

[0324] The fourth adjudication module 40 is used to divide the second non-empty packet response message set into one or more third groups based on the data type of the response body, and to obtain an adjudication result based on the relationship between the maximum number of messages in each third group and the number of empty packet response messages.

[0325] In one embodiment, the first adjudication module 10 is specifically used for:

[0326] If the ratio between the number of empty packet response messages and the number of each executor is greater than a preset ratio, then the empty packet response message is determined to be the adjudication result message, the executor corresponding to any empty packet response message is the adjudication result executor, and the executor corresponding to each non-empty packet response message is the abnormal executor, thereby obtaining the adjudication result and ending the adjudication; the preset ratio is less than 1.

[0327] If the ratio between the number of empty packet response messages and the number of each execution body is less than or equal to a preset ratio, then based on the Hypertext Transfer Protocol, each received non-empty packet response message is parsed to obtain response information including the response status code, response header, and response body.

[0328] In one embodiment, the second adjudication module 20 is specifically used for:

[0329] The first target packet is determined based on the first packet corresponding to the maximum number of packets;

[0330] If the number of messages in the first target group is less than the number of empty packet response messages, then the empty packet response message is determined to be the adjudication result message, the execution body corresponding to any empty packet response message is the adjudication result execution body, and the execution body corresponding to each non-empty packet response message is the abnormal execution body, thereby obtaining the adjudication result and ending the adjudication;

[0331] If the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is equal to 1, then the only non-empty packet response message in the first target group is determined to be the adjudication result message, the execution body corresponding to the only non-empty packet response message in the first target group is the adjudication result execution body, and the execution bodies corresponding to all other response messages except the first target group are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication;

[0332] If the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is greater than 1, then each non-empty packet response message in the first target group is determined to be the first non-empty packet response message set.

[0333] In one embodiment, the second adjudication module 20 is specifically used for:

[0334] If the first group corresponding to the maximum number of messages is not unique, then the historical confidence or heterogeneous environment confidence of each execution entity in the first group corresponding to the maximum number of messages is summed, and the first group corresponding to the maximum summation result is selected as the first target group.

[0335] If the first packet corresponding to the maximum number of packets is unique, then the first packet corresponding to the maximum number of packets is determined as the first target packet.

[0336] In one embodiment, the device further includes:

[0337] The first construction module is used to extract the mapping relationship of the response header fields from the first non-empty packet response message set, and construct the reverse mapping relationship of the response header fields based on the mapping relationship of the response header fields;

[0338] The second construction module is used to extract the mapping relationship of response body fields from the second non-empty packet response message set for response bodies of structured data types, and construct the reverse mapping relationship of response body fields based on the mapping relationship of response body fields.

[0339] The rewrite module is used to rewrite the values ​​of the response header field and response body field of the decision result message if the decision result message in the decision result is a non-empty packet response message, based on the reverse mapping relationship of the response header field and the reverse mapping relationship of the response body field in the cache server, to form a new decision result message.

[0340] In one embodiment, the first construction module is specifically used for:

[0341] Based on the preset response header field mapping relationship extraction rules, target response header fields are selected from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set; wherein, the preset response header field mapping relationship extraction rules are used to extract response header fields on the response header field list, and the response header field list includes multiple random number type fields that affect the normal operation of the mimicry system business;

[0342] If the target response header field is selected, then for each target response header field, the correspondence between the temporary decision value of the target response header field and the multiple field values ​​of the target response header field is extracted from the first non-empty packet response message set, and used as the mapping relationship corresponding to the target response header field;

[0343] Based on the mapping relationship corresponding to each target response header field, construct a correspondence between multiple field values ​​of the target response header field and the temporary decision value of the target response header field, as a set of reverse mapping relationships corresponding to the target response header field.

[0344] In one embodiment, the first construction module is specifically used for:

[0345] Select a target response header from the response headers of multiple non-empty packet response messages in the first set of non-empty packet response messages;

[0346] The field value of the target response header field in the target response header is determined as the provisional decision value of the target response header field.

[0347] In one embodiment, the first construction module is specifically used for:

[0348] Select the response header corresponding to the execution body with the smallest execution body identifier from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set, and use it as the target response header.

[0349] In one embodiment, the executor identifier is the Internet Protocol address of the executor.

[0350] In one embodiment, the device further includes a storage module, specifically used for:

[0351] For each target response header field, iterate through the keys of each reverse mapping relationship corresponding to the target response header field, and query whether the keys of each reverse mapping relationship already exist in the cache server;

[0352] If the keys for each reverse mapping relationship do not exist in the cache server, then the mapping relationship corresponding to the target response header field and each reverse mapping relationship are stored in the cache server.

[0353] If any key of a reverse mapping relationship exists in the cache server, stop traversing, use the value of the existing reverse mapping relationship in the cache server as the key, query and retrieve the corresponding mapping relationship in the cache server; use the key of the retrieved mapping relationship as the key of the new mapping relationship, and use the union of the value of the retrieved mapping relationship and the value of the mapping relationship corresponding to the target response header field as the value of the new mapping relationship to construct a new mapping relationship; construct a new set of reverse mapping relationships based on the new mapping relationship; and store the new mapping relationship and each new reverse mapping relationship in the cache server.

[0354] In one embodiment, the device further includes a filtering module, specifically used for:

[0355] After extracting the mapping relationship of response header fields from the first set of non-empty packet response messages, and constructing the reverse mapping relationship of response header fields based on the mapping relationship of response header fields, the response header fields in the response headers of multiple non-empty packet response messages in the first set of non-empty packet response messages are filtered based on the preset response header field filtering rules; the preset response header field filtering rules are used to filter response header fields of random number type and time type in the response header filtering field list.

[0356] The third adjudication module 30 is specifically used to: divide the filtered first non-empty packet response message set into one or more second groups based on the consistency of the response header.

[0357] In one embodiment, the fourth adjudication module 40 is specifically used for:

[0358] For response bodies of structured data types, the second set of non-empty packet response messages is divided into one or more third groups based on response body consistency;

[0359] For response bodies of unstructured data types, the hash values ​​of the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set are calculated based on a preset hash algorithm. Based on the consistency of the response body hash values, the second non-empty packet response message set is divided into one or more third groups.

[0360] In one embodiment, the fourth adjudication module 40 is specifically used for:

[0361] The third target packet is determined based on the third packet corresponding to the maximum number of packets;

[0362] If the number of messages in the third target group is less than the number of empty packet response messages, then the empty packet response message is determined to be the adjudication result message, the execution body corresponding to any empty packet response message is the adjudication result execution body, and the execution body corresponding to each non-empty packet response message is the abnormal execution body, thereby obtaining the adjudication result and ending the adjudication;

[0363] If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is equal to 1, then the only non-empty packet response message in the third target group is determined to be the adjudication result message, the execution body corresponding to the only non-empty packet response message in the third target group is the adjudication result execution body, and the execution bodies corresponding to all other response messages except the third target group are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication.

[0364] If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the second target group is greater than 1, then any non-empty packet response message in the third target group is determined as the adjudication result message, the execution body corresponding to the adjudication result message is the adjudication result execution body, and the execution bodies corresponding to all other response messages except the third target group are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication.

[0365] In one embodiment, it further includes: an attack posture analysis module, specifically used for:

[0366] Abnormal scenarios are logged during the adjudication process to obtain adjudication exception logs;

[0367] Perform multi-dimensional analysis on the adjudication anomaly log, including at least one of the following dimensions: attack time, attack source location, attack type, and number of attacks, and obtain the multi-dimensional analysis results.

[0368] An attack situation analysis report is generated based on the results of multi-dimensional analysis.

[0369] Figure 14 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 14 As shown, the electronic device may include a processor 1410, a communications interface 1420, a memory 1430, and a communication bus 1440. The processor 1410, communications interface 1420, and memory 1430 communicate with each other via the communication bus 1440. The processor 1410 can call logical instructions in the memory 1430 to execute the adjudication method for the hypertext transfer protocol response message of the mimicry system; details will not be elaborated here.

[0370] Furthermore, the logical instructions in the aforementioned memory 1430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0371] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the adjudication method for the hypertext transfer protocol response message of the mimicry system provided in the above-described method embodiments, which will not be elaborated here.

[0372] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program implements the adjudication method for the hypertext transfer protocol response message of the mimicry system provided in the above-described method embodiments, which will not be elaborated here.

[0373] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0374] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0375] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for adjudicating Hypertext Transfer Protocol (HTTP) response messages in a mimicry system, characterized in that, include: Receive multiple non-empty packet response messages returned by an odd number of actuators in the mimicry system within a preset timeout period; For the portion of the execution bodies that did not return the non-empty packet response message, an empty packet response message is constructed; if the ratio between the number of empty packet response messages and the number of each execution body is less than or equal to a preset ratio, each received non-empty packet response message is parsed based on the Hypertext Transfer Protocol to obtain response information including the response status code, response header, and response body. Based on the consistency of the response status code, the received non-empty packet response messages are divided into one or more first groups, and the first target group is determined based on the first group corresponding to the maximum number of messages. If the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is greater than 1, then each of the non-empty packet response messages in the first target group is determined to be the first set of non-empty packet response messages. Based on response header consistency, the first non-empty packet response message set is divided into one or more second groups. The second target group is determined based on the second group corresponding to the maximum number of messages. If the number of messages in the second target group is greater than or equal to the number of empty packet response messages and the number of messages in the second target group is greater than 1, each of the non-empty packet response messages in the second target group is determined as the second non-empty packet response message set. For the response body of the structured data type, the second non-empty packet response message set is divided into one or more third groups based on the consistency of the response body. A third target group is determined based on the third group corresponding to the maximum number of messages. If the number of messages in the third target group is less than the number of empty packet response messages, the empty packet response message is determined to be the adjudication result message. If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is equal to 1, then the only non-empty packet response message in the third target group is determined to be the decision result message. If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is greater than 1, then any one of the non-empty packet response messages in the third target group is determined to be the decision result message.

2. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 1, characterized in that, Also includes: If the ratio between the number of empty packet response messages and the number of each execution body is greater than a preset ratio, then the empty packet response message is determined to be an adjudication result message, the execution body corresponding to any one of the empty packet response messages is an adjudication result execution body, and the execution bodies corresponding to each of the non-empty packet response messages are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication; The preset ratio is less than 1.

3. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 1, characterized in that, Also includes: If the number of messages in the first target group is less than the number of empty packet response messages, then the empty packet response message is determined to be the adjudication result message, the execution body corresponding to any one of the empty packet response messages is the adjudication result execution body, and the execution body corresponding to each of the non-empty packet response messages is the abnormal execution body, thereby obtaining the adjudication result and ending the adjudication; If the number of messages in the first target group is greater than or equal to the number of empty packet response messages, and the number of messages in the first target group is equal to 1, then the only non-empty packet response message in the first target group is determined to be the adjudication result message, the execution body corresponding to the only non-empty packet response message in the first target group is the adjudication result execution body, and the execution bodies corresponding to all other response messages except the first target group are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication.

4. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 1, characterized in that, The step of determining the first target packet based on the first packet corresponding to the maximum number of packets includes: If the first group corresponding to the maximum number of messages is not unique, then the historical confidence or heterogeneous environment confidence of each execution entity of the first group corresponding to the maximum number of messages is summed, and the first group corresponding to the maximum summation result is selected as the first target group. If the first packet corresponding to the maximum number of packets is unique, then the first packet corresponding to the maximum number of packets is determined to be the first target packet.

5. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 1, characterized in that, Also includes: Extract the mapping relationship of the response header fields from the first set of non-empty packet response messages, and construct the reverse mapping relationship of the response header fields based on the mapping relationship of the response header fields; For response bodies of structured data types, the mapping relationship of response body fields is extracted from the second non-empty packet response message set, and the reverse mapping relationship of response body fields is constructed based on the mapping relationship of response body fields. If the decision result message in the decision result is a non-empty packet response message, then the response header field values ​​and response body field values ​​of the decision result message are rewritten based on the reverse mapping relationship of the response header field and the reverse mapping relationship of the response body field in the cache server to form a new decision result message.

6. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 5, characterized in that, The step of extracting the mapping relationship of response header fields from the first non-empty packet response message set, and constructing the reverse mapping relationship of response header fields based on the mapping relationship of response header fields, includes: Based on a preset response header field mapping relationship extraction rule, target response header fields are selected from the response headers of multiple non-empty packet response messages in the first non-empty packet response message set; wherein, the preset response header field mapping relationship extraction rule is used to extract response header fields from the response header field list, and the response header field list includes multiple random number type fields that affect the normal operation of the mimicry system business; If the target response header field is selected, then for each target response header field, the correspondence between the temporary ruling value of the target response header field and multiple field values ​​of the target response header field is extracted from the first non-empty packet response message set, and used as the mapping relationship corresponding to the target response header field; Based on the mapping relationship corresponding to each of the target response header fields, a correspondence is constructed between multiple field values ​​of the target response header field and the temporary ruling value of the target response header field, which serves as a set of reverse mapping relationships corresponding to the target response header field.

7. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 6, characterized in that, The provisional decision value for the target response header field is determined through the following steps: Select a target response header from the response headers of the plurality of non-empty packet response messages in the first set of non-empty packet response messages; The field value of the target response header field in the target response header is determined as the temporary ruling value of the target response header field.

8. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 7, characterized in that, Selecting a target response header from the response headers of the plurality of non-empty packet response messages in the first non-empty packet response message set includes: Select the response header corresponding to the execution body with the smallest execution body identifier from the response headers of the multiple non-empty packet response messages in the first non-empty packet response message set, and use it as the target response header.

9. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 8, characterized in that, The executor identifier is the Internet Protocol address of the executor.

10. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 6, characterized in that, Also includes: For each of the target response header fields, iterate through the keys of each of the reverse mapping relationships corresponding to the target response header field, and query whether the keys of each of the reverse mapping relationships already exist in the cache server; If the key for each of the reverse mapping relationships does not exist in the cache server, then the mapping relationship corresponding to the target response header field and each of the reverse mapping relationships are stored in the cache server; If any key of the reverse mapping relationship exists in the cache server, the traversal stops. The value of the existing reverse mapping relationship in the cache server is used as the key to query and obtain the corresponding mapping relationship in the cache server. The key of the obtained mapping relationship is used as the key of the new mapping relationship. The union of the value of the obtained mapping relationship and the value of the mapping relationship corresponding to the target response header field is used as the value of the new mapping relationship to construct a new mapping relationship. Based on the new mapping relationship, a new set of reverse mapping relationships is constructed. The new mapping relationship and each of the new reverse mapping relationships are stored in the cache server.

11. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 5, characterized in that, After extracting the mapping relationship of response header fields from the first set of non-empty packet response messages, and constructing the reverse mapping relationship of response header fields based on the mapping relationship of response header fields, the method further includes: Based on preset response header field filtering rules, the response header fields in the response headers of multiple non-empty packet response messages in the first non-empty packet response message set are filtered; the preset response header field filtering rules are used to filter response header fields of random number type and time type in the response header filtering field list. The first set of non-empty packet response messages is divided into one or more second groups based on response header consistency, including: Based on the consistency of the response header, the filtered set of first non-empty packet response messages is divided into one or more second groups.

12. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 1, characterized in that, Also includes: For response bodies of unstructured data types, the hash values ​​of the response bodies of multiple non-empty packet response messages in the second non-empty packet response message set are calculated based on a preset hash algorithm. Based on the consistency of the response body hash values, the second non-empty packet response message set is divided into one or more third groups.

13. The method for adjudicating Hypertext Transfer Protocol response messages in a mimicry system according to claim 1, characterized in that, Also includes: If the number of messages in the third target group is less than the number of empty packet response messages, after determining that the empty packet response message is the adjudication result message, the execution body corresponding to any one of the empty packet response messages is the adjudication result execution body, and the execution body corresponding to each of the non-empty packet response messages is the abnormal execution body, thereby obtaining the adjudication result and ending the adjudication; If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is equal to 1, after determining that the only non-empty packet response message in the third target group is the adjudication result message, the execution body corresponding to the only non-empty packet response message in the third target group is the adjudication result execution body, and the execution bodies corresponding to all other response messages except the third target group are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication; If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is greater than 1, after determining that any one of the non-empty packet response messages in the third target group is an adjudication result message, the execution body corresponding to the adjudication result message is the adjudication result execution body, and the execution bodies corresponding to all other response messages except the third target group are abnormal execution bodies, thereby obtaining the adjudication result and ending the adjudication.

14. The method for adjudicating Hypertext Transfer Protocol response messages of a mimicry system according to any one of claims 1-13, characterized in that, Also includes: Abnormal scenarios are logged during the adjudication process to obtain adjudication exception logs; The adjudication anomaly log is subjected to multi-dimensional analysis including at least one of the following dimensions: attack time, attack source location, attack type, and number of attacks, to obtain the multi-dimensional analysis results. Based on the multi-dimensional analysis results, an attack situation analysis report is generated.

15. A device for adjudicating Hypertext Transfer Protocol (HTTP) response messages in a mimicry system, characterized in that, include: The first adjudication module is used to receive multiple non-empty packet response messages returned by an odd number of executors in the mimicry system within a preset timeout period; For the portion of the execution bodies that did not return the non-empty packet response message, an empty packet response message is constructed; if the ratio between the number of empty packet response messages and the number of each execution body is less than or equal to a preset ratio, each received non-empty packet response message is parsed based on the Hypertext Transfer Protocol to obtain response information including the response status code, response header, and response body. The second adjudication module is used to divide the received non-empty packet response messages into one or more first groups based on the consistency of the response status codes, determine the first target group based on the first group corresponding to the maximum number of messages, and determine each of the non-empty packet response messages in the first target group as the first non-empty packet response message set when the number of messages in the first target group is greater than or equal to the number of empty packet response messages and the number of messages in the first target group is greater than 1. The third adjudication module is used to divide the first non-empty packet response message set into one or more second groups based on the consistency of the response header, determine the second target group based on the second group corresponding to the maximum number of messages, and determine each of the non-empty packet response messages in the second target group as the second non-empty packet response message set when the number of messages in the second target group is greater than or equal to the number of empty packet response messages and the number of messages in the second target group is greater than 1. The fourth adjudication module is used to divide the second non-empty packet response message set into one or more third groups based on the consistency of the response body for the response body of the structured data type, determine the third target group based on the third group corresponding to the maximum number of messages, and determine the empty packet response message as the adjudication result message if the number of messages in the third target group is less than the number of empty packet response messages. If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is equal to 1, then the only non-empty packet response message in the third target group is determined to be the decision result message. If the number of messages in the third target group is greater than or equal to the number of empty packet response messages, and the number of messages in the third target group is greater than 1, then any one of the non-empty packet response messages in the third target group is determined to be the decision result message.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for adjudicating Hypertext Transfer Protocol response messages of a mimicry system as described in any one of claims 1 to 14.

17. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for adjudicating Hypertext Transfer Protocol response messages of a mimicry system as described in any one of claims 1 to 14.

18. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for adjudicating Hypertext Transfer Protocol response messages of a mimicry system as described in any one of claims 1 to 14.

Images