Multi-mode decision method

Abstract

The invention provides a multi-mode decision method, which comprises the following steps of: inputting flow data into a plurality of execution bodies built in mimicry network equipment to obtain an output result of each execution body in the plurality of execution bodies; obtaining the credibility of each execution body in the plurality of execution bodies; determining an average isomerism degree among a plurality of execution bodies outputting the same result; calculating the score of each output result in the plurality of output results according to the credibility of each execution body and the average isomerism degree among the plurality of execution bodies outputting the same result; and outputting the output result with the highest score as a multi-mode judgment result. And the accuracy of a multi-mode judgment result can be improved. According to the scheme, the technical problem of low accuracy of the existing multi-mode judgment is solved, and the technical effect of effectively improving the accuracy of the multi-mode judgment is achieved.

Description

Technical Field

[0001] The present application belongs to the field of network information security technology, and in particular, relates to a multi-mode decision method. Background Art

[0002] In network devices based on mimetic architecture, the multi-mode decision unit is a decisive module. The multi-mode decision unit compares the outputs of multiple built-in execution units with the same functions but different structures in the mimetic network device at the bit level, load level, and behavior level, thereby filtering out local anomalies caused by system failures or external attacks, and realizing the perception of internal functional anomalies in the system to ensure the normal operation of the system.

[0003] The existing multi-mode decision method is mainly the majority consensus voting method, that is, selecting the output with the maximum number of approvals from the output sets of different execution units. This decision method has a relatively simple logic, but when the maximum number of approvals is the same, the output is random.

[0004] There is currently no effective solution to the problem of low accuracy of the decisions made by existing multi-mode adjudications. Summary of the invention

[0005] The purpose of this application is to provide a multi-mode decision method, which can improve the accuracy of multi-mode decision results.

[0006] The present application provides a multi-mode decision method which is implemented as follows:

[0007] A multi-mode decision method, comprising:

[0008] Input the traffic data into multiple built-in executors in the mimic network device to obtain output results of each of the multiple executors;

[0009] Obtaining the credibility of each of the multiple executable bodies;

[0010] Determine the degree of heterogeneity between multiple executions that output the same result;

[0011] According to the credibility of each executor and the heterogeneity between multiple executors that output the same result, the score of each output result in multiple output results is calculated;

[0012] The output result with the highest score is output as the multi-modal decision result.

[0013] In one embodiment, the flow data is input into a plurality of executable bodies built into the mimetic network device, including:

[0014] Determining a format requirement for each of the plurality of executables;

[0015] Convert the flow data into a format according to the format requirements of each executable body;

[0016] The format-converted traffic data is equivalently input into a plurality of execution bodies built into the mimetic network device.

[0017] In one embodiment, calculating the heterogeneity between multiple execution bodies that output the same result includes:

[0018] Multiple executables that output the same result are used as the target executable group;

[0019] Acquire multiple performance parameters of each executable body in the target executable body group;

[0020] Convert multiple performance parameters of each actuator into a feature vector corresponding to each actuator;

[0021] Calculating the distance between any two executable bodies in the target executable body group according to the feature vectors corresponding to the respective executable bodies, wherein the target executable body group includes at least three executable bodies;

[0022] Determining an average value of distances between any two executors in the target executor group;

[0023] The average value is used as the heterogeneity degree among the multiple execution bodies that output the same result.

[0024] In one embodiment, the score of each output result in the multiple output results is calculated based on the credibility of each execution body and the heterogeneity between multiple execution bodies that output the same result, including:

[0025] Multiple executables that output the same result are used as the target executable group;

[0026] Calculating the sum of the credibility of each executable body in the target executable body group as a first intermediate result;

[0027] Calculate a value with a natural base as the base and an opposite number of the heterogeneity between the plurality of executors in the target executor group as the exponent as the second intermediate result;

[0028] The target value is obtained by dividing the first intermediate result by the second intermediate result, and the target value is used as the score of the current output result.

[0029] In one embodiment, the credibility of each of the multiple executables is determined as follows:

[0030] In an offline state, sending an attack message to the mimic network device by simulating a network attack;

[0031] Detecting the flow at the exit of each of the multiple executors of the mimic network device to obtain the detection result of each executor;

[0032] The credibility of each of the multiple executable bodies is determined according to the distribution of normal data and abnormal data in the detection results of each executable body.

[0033] In one embodiment, determining the credibility of each of the plurality of executables according to the distribution of normal data and abnormal data in the detection results of each executable includes:

[0034] Inputting the detection results of each actuator into a pre-established neural network model to obtain the credibility of each actuator in the multiple actuators;

[0035] The neural network module includes: an input embedding layer, a time coding layer and a prediction layer, wherein the input embedding layer is used to convert the traffic data into a fixed-length vector that can be subsequently processed, the time coding layer is used to add time information to the traffic data to obtain a data sequence and determine the dependency between the data sequence and time, and the prediction layer is used to convert the output sequence of the time coding layer into a distribution prediction of normal data and abnormal data.

[0036] In one embodiment, a benchmark data set in the field of network traffic anomaly detection is traffic data collected in a real environment through a simulated network device.

[0037] A multi-mode decision device, comprising:

[0038] An input module, used to input traffic data into multiple executable bodies built into the mimetic network device, and obtain output results of each of the multiple executable bodies;

[0039] An acquisition module, used to acquire the credibility of each of the multiple executable bodies;

[0040] A determination module, used to determine the degree of heterogeneity between multiple execution bodies that output the same result;

[0041] A judgment module, used for calculating the score of each output result among multiple output results according to the credibility of each executor and the heterogeneity between multiple executors that output the same result;

[0042] The output module is used to output the output result with the highest score as the multi-mode decision result.

[0043] An electronic device comprises a processor and a memory for storing instructions executable by the processor, wherein the steps of the above method are implemented when the processor executes the instructions.

[0044] A computer-readable storage medium stores a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0045] The multi-mode decision method of the mimetic network device provided by the present application obtains the output result of each of the multiple executable bodies by inputting the flow data into the multiple executable bodies built into the mimetic network device, and then determines the score of each output result according to the heterogeneity between the multiple executable bodies that output the same result and the credibility of each executable body, thereby obtaining the final decision result. Because when performing multi-mode decision, the credibility and heterogeneity of the executable body are considered at the same time, the result of multi-mode decision is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0047] Figure 1 is a method flow chart of an embodiment of the multi-mode arbitration method provided by the present application;

[0048] Figure 2 It is a structural diagram of an embodiment of a multi-mode arbitration system for a mimetic network device provided by the present application;

[0049] Figure 3 It is a method flow chart of an embodiment of a multi-mode adjudication method based on credibility and mutual heterogeneity provided by the present application;

[0050] Figure 4 It is a schematic diagram of a multi-mode arbitration system deployed in a mimetic router provided by the present application;

[0051] Figure 5 It is a schematic diagram of a multi-mode arbitration system deployed in a mimetic firewall provided by the present application;

[0052] Figure 6 It is a hardware structure block diagram of an electronic device of a multi-mode decision method for a mimicking network device provided by the present application;

[0053] Figure 7 It is a schematic diagram of the module structure of an embodiment of a multi-mode arbitration device for a mimetic network device provided in the present application. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0055] It should also be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0056] In order to improve the accuracy of multi-mode adjudication results, it is considered that by constructing the historical output records of the executor, different executors are given trust weights according to the previous output results, and then the result with the highest credibility is selected as the final output result when performing multi-mode adjudication. However, further consideration is given to the problem that if only the credibility of the executor is considered without considering the heterogeneity of the executor, the output results between executors with small heterogeneity are similar, which will lead to the common mode escape phenomenon. Based on this, in this example, on the basis of the executor credibility optimization algorithm, the degree of heterogeneity between different executors is considered. While improving the correctness of the multi-mode adjudication results, it also avoids the phenomenon of false trust in the results, improves the overall security protection performance of the system, and enables multi-mode adjudication to still show good defense performance without prior knowledge.

[0057] Figure 1 It is a method flow chart of an embodiment of the multi-mode arbitration method provided by the present application. Although the present application provides method operation steps or device structures as shown in the following embodiments or drawings, more or fewer operation steps or module units may be included in the method or device based on routine or no creative labor. In the steps or structures that do not logically have a necessary causal relationship, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure described in the embodiments of the present application and shown in the drawings. When the method or module structure is applied to an actual device or terminal product, it can be connected according to the method or module structure shown in the embodiments or drawings for sequential execution or parallel execution (for example, a parallel processor or a multi-threaded processing environment, or even a distributed processing environment).

[0058] Specifically, Figure 1 As shown, the above multi-mode decision method may include the following steps:

[0059] Step 101: inputting the traffic data into multiple built-in executable bodies in the mimic network device, and obtaining output results of each of the multiple executable bodies;

[0060] Among them, the executable body refers to the comprehensive expression of code and data to achieve a specific purpose. It depends on the execution environment such as hardware system, firmware system, operating system, application or virtual machine to execute. The executable body can be executed independently in the execution environment, or it can be embedded in other executable bodies or data for execution. In the network, the executable body exists in the form of files (such as .exe executable files, .sys driver files) and non-file embedded forms. For example, in the Linux system, the executable body is the basic unit of CPU scheduling and resource allocation, and each executable body has a unique task_struct data structure to store its execution context. Common executable bodies include processes, lightweight processes, and kernel threads. They are created through the clone function, and different flags parameters are used to specify the shared resource amount and execution status of the newly created executable body. In the mimetic firewall, the executable body can be a firewall executable body, that is, multiple firewall executable bodies are set in the mimetic firewall; in the mimetic router, the executable body can be a routing executable body, that is, the first brand routing executable body, the second brand routing executable body, the third brand routing executable body, etc. are set in the mimetic router.

[0061] For a mimetic network device, multiple executors are built in. The output results given by different executors may be different. Therefore, a relatively accurate result should be selected from the multiple results as the final output. Considering that the adapted data type or format of each executor is different, when implementing it, it can be adjusted according to the data format adaptation principle of the corresponding executor based on the type of executor running online, and then the data can be distributed equally to different executors. Specifically, the format requirements of each executor among the multiple executors can be determined; the traffic data can be formatted according to the format requirements of each executor; and the format-converted traffic data can be equivalently input into the multiple executors built into the mimetic network device.

[0062] Step 102: Obtain the credibility of each of the multiple executables;

[0063] The credibility of each executable body can be determined offline and can be directly called when the result is output. Specifically, the credibility of each executable body in the multiple executable bodies can be determined in the following manner:

[0064] S1: In an offline state, sending an attack message to the mimic network device by simulating a network attack;

[0065] S2: Detecting the flow at the exit of each of the multiple executors of the mimic network device to obtain the detection result of each executor;

[0066] S3: Determine the credibility of each of the multiple executables according to the distribution of normal data and abnormal data in the detection results of each executable.

[0067] During implementation, the detection results of each executive body may be input into a pre-established neural network model to obtain the credibility of each executive body among the multiple executive bodies.

[0068] In this example, the selection of the neural network model takes into account that the existing data processing methods cannot automatically extract complex and hierarchical features from a large amount of data. To this end, in this example, it is considered to learn the intrinsic patterns and correlations of the data through a multi-layer neural network structure to provide higher accuracy and efficiency in complex decision-making systems. In this example, a structured state space model is introduced into the neural network model. Specifically, the input sequence is decomposed into multiple subsequences, and the state space model is applied to each subsequence, thereby effectively reducing the computational complexity. The neural network model divides the input traffic sequence into multiple levels, and each level applies a different processing method: the low level uses the Transformer's self-attention mechanism, and the high level uses the structured state space model, thereby effectively balancing the modeling of local and global dependencies.

[0069] In one embodiment, the above-mentioned neural network module may include: an input embedding layer, a time coding layer and a prediction layer, wherein the input embedding layer is used to convert the traffic data into a fixed-length vector that can be subsequently processed, the time coding layer is used to add time information to the traffic data to obtain a data sequence and determine the dependency between the data sequence and time, and the prediction layer is used to convert the output sequence of the time coding layer into a distribution prediction of normal data and abnormal data.

[0070] Among them, the above-mentioned time encoding layer may include: a time series processing layer, a preprocessing layer, and a scaling layer, wherein the time series processing layer is used to add time information to help the model understand the order and time dependency of the sequence; the preprocessing layer is used to preprocess the encoded input data, and the output is passed through the addition and normalization layers to obtain stable and standardized data; the scaling layer includes: a masked multi-head attention mechanism and a convolution block, wherein the masked multi-head attention mechanism allows the model to focus on different parts of the input sequence, and the convolution block is used to process data through a state space model and a convolution layer.

[0071] That is, for the calculation of credibility, an interface of the mimetic network device can be connected to the Internet to receive attacks from the external network; a large number of attack messages are sent to the interface, because different executors have different sensitivities to attack traffic and inherent vulnerabilities are exploited, so the traffic distribution at the outbound interface of different execution units is different; the ratio of normal traffic / abnormal traffic is counted by the neural network model, so that the credibility of different executors can be quantified. Among them, the traffic data set for training the neural network model can include: a benchmark data set in the field of network traffic anomaly detection, and traffic data collected in a real environment through the mimetic network device. Specifically, the original data set may include: normal traffic (Normal), generic attacks (Generic), vulnerability exploits (Exploits), denial of service attacks (DoS), backdoor attacks (Backdoor), scanning attacks (Scan) and other categories of attack traffic. For the original data set, after data enhancement, data cleaning, and data conversion exception processing, the neural network model can be trained in a ratio of 7:3 between the training set and the test set.

[0072] The calculated credibility of each executor may be stored in a memory, and when needed, the credibility of each executor may be directly called from the memory and then participate in the multi-mode decision.

[0073] Step 103: Determine the degree of heterogeneity between multiple execution bodies that output the same result;

[0074] Heterogeneity refers to the fact that two functionally equivalent executive bodies have different structural compositions. It describes the differences between the two executive bodies, which can ensure that the same attack will not cause both executive bodies to fail at the same time. Because the vulnerabilities and backdoors of functional executive bodies are unique, for example, the SNMP software functional vulnerability of Cisco 2600 series routers is different from the SNMP vulnerability of 6500 series, and the probability of being the same as the SNMP vulnerability of Juniper routers is almost zero. Therefore, an attack method will only work on one functional executive body. In other words, if an output result is supported by executive bodies with large heterogeneity at the same time, then the output result is considered to be more reliable. Based on this, in this example, the heterogeneity between multiple executive bodies that output the same result is introduced as a consideration dimension to measure the credibility of the output result, thereby improving the accuracy of the result.

[0075] For example, suppose the number of executors N=5, represented by the set {n1, n2, n3, n4, n5}, and there are three types of output results {C1, C2, C3} in the output agent, where the output results of executors n1 and n2 are C1, the output results of executors n3 and n4 are C2, and the output result of executor n5 is C3. In this way, the output results of each executor can be classified. Because there are three output results, it is necessary to determine which result is more accurate as the final result. In this example, the concepts of executor credibility and heterogeneity are introduced to score each result, and the result with the highest score is selected as the final output result.

[0076] In order to improve accuracy, in the actual calculation process, when multiple executors support the same result, the heterogeneity between multiple executors that output the same result can be calculated.

[0077] Specific:

[0078] 1) When there are three or more executables that output the same result, the following steps may be included:

[0079] S1: multiple executables that output the same result are used as the target executable group;

[0080] S2: Acquire multiple performance parameters of each executable body in the target executable body group;

[0081] S3: converting multiple performance parameters of each actuator into a feature vector corresponding to each actuator;

[0082] Specifically, considering that different isomers in a mimicking device have differences in hardware characteristics, operating systems, computing performance, etc., these parameters can be converted into a set of feature vectors as performance parameters, and then the distance method is used to quantify the heterogeneity between computers.

[0083] Since the characteristic units and ranges of the characteristic values ​​are different (for example, the CPU frequency is GHz, and the memory capacity is GB), standardization can be performed before calculation to make the characteristics comparable. Specifically, the following formula can be used for standardization:

[0084]

[0085] Among them, x represents the original eigenvalue, mean(x) represents the mean of the feature, and std(x) represents the standard deviation of the feature.

[0086] S4: Calculating the distance between any two executable bodies in the target executable body group according to the feature vectors corresponding to the executable bodies;

[0087] S5: Determine the average value of the distance between any two executors in the target executor group;

[0088] S6: Using the average value as the heterogeneity degree between the multiple execution bodies that output the same result.

[0089] 2) If there are two executables that output the same result, the following steps may be included:

[0090] S1: Take the two executables that output the same result as the target executable group;

[0091] S2: Acquire multiple performance parameters of two executable bodies in the target executable body group;

[0092] S3: converting multiple performance parameters of the two actuators into feature vectors corresponding to the two actuators;

[0093] S4: Calculate the heterogeneity between the two executables according to the feature vectors corresponding to the respective executables.

[0094] 3) When there is only one executable that outputs the same result, the degree of heterogeneity of the executable is set to 1.

[0095] For example, the heterogeneity between executors can be calculated as follows:

[0096] S1: Standardize the eigenvalues;

[0097] S2: Extract feature vectors of different execution bodies:

[0098] Taking executive body A and executive body B as examples, the extracted feature vectors of executive body A and executive body B can be expressed as:

[0099]

[0100] S3: Calculate the degree of heterogeneity between any two executors:

[0101] The heterogeneity between executor A and executor B is calculated according to the following formula:

[0102]

[0103] Among them, h(A,B) represents the heterogeneity between executors A and B, and w i Represents the weight value of the feature.

[0104] S4: For multiple (three or more) execution bodies that support the same result, calculate the average heterogeneity, where the average heterogeneity is the average of all pairwise distances:

[0105]

[0106] Among them, H 异构度 is the average heterogeneity, and N is the number of executors.

[0107] Step 104: Calculate the score of each output result in the multiple output results according to the credibility of each execution body and the heterogeneity between multiple execution bodies that output the same result.

[0108] If three or more executors output the same result, the average heterogeneity between the multiple executors is calculated. If two executors output the same result, the heterogeneity between the two executors corresponding to the executor that outputs the result is calculated. If only one executor outputs a certain result, the heterogeneity corresponding to the executor that outputs the result is defined as 1.

[0109] Specifically, multiple executors that output the same result can be used as a target executor group; the sum of the credibility of each executor in the target executor group is calculated as a first intermediate result; a value with a natural base as the base and the opposite number of the average heterogeneity between multiple executors in the target executor group as the exponent is calculated as a second intermediate result; the target value is obtained by dividing the first intermediate result by the second intermediate result, and the target value is used as the score of the current output result.

[0110] For example, suppose the number of executables N=5, represented by the set {n1, n2, n3, n4, n5}, and there are three types of output results {C1, C2, C3} in the output agent, among which the output results of executables n1 and n2 are C1, the output results of executables n3 and n4 are C2, and the output result of executable n5 is C3. Take C1 as an example, calculate the C1 score:

[0111] S1: Calculate the sum of the credibility of executor n1 and executor n2:

[0112]

[0113] Among them, r 12 is the sum of the credibility of executive body n1 and executive body n2, r1 is the credibility of executive body 1, and r2 is the credibility of executive body 2.

[0114] S2: The calculation is based on the natural base e, and the exponent is the opposite number of the heterogeneity between the execution body n1 and the execution body n2:

[0115]

[0116] Among them, z is the intermediate number, and h(1,2) is the inverse number of the heterogeneity between executive n1 and executive n2.

[0117] S3: Divide the result calculated by S1 by the result calculated by S2 to get the score of C1:

[0118]

[0119] Among them, Score c1 Indicates the score of C1.

[0120] The above method can be used to calculate the comprehensive scores of C1, C2, and C3. If C1 has the highest score, then C1 will be output as the result.

[0121] Step 105: Output the output result with the highest score as the multi-mode decision result.

[0122] In the above example, the flow data is input into multiple executors built into the mimetic network device to obtain the output results of each of the multiple executors. Then, the output results of each of the multiple executors are classified, and the scores of each output result are determined based on the average heterogeneity between multiple executors that output the same result and the credibility of each executor, thereby obtaining the final decision result. Because the credibility and heterogeneity of the executors are considered at the same time when making multi-mode decisions, the results of multi-mode decisions are more accurate.

[0123] The above method is described below in conjunction with a specific embodiment. However, it should be noted that this specific embodiment is only for better illustrating the present application and does not constitute an improper limitation on the present application.

[0124] In this example, a multi-mode decision method based on the credibility and heterogeneity of the executor is provided. By introducing a neural network model, the traffic at the output interfaces of multiple executors built into the mimic network device is detected respectively. According to the detection results, the distribution of normal data and abnormal data is quantified as the credibility of different executors. Furthermore, according to the differences in the system state characteristic data of different executors, a difference calculation method is designed to quantify the heterogeneity between executors. Then, the credibility value and the average heterogeneity are calculated for executors with the same output results, so as to calculate the output result score. That is, in this example, on the basis of the executor credibility optimization algorithm, the degree of heterogeneity between different executors is taken into account. While improving the correctness of the multi-mode decision results, it also avoids the phenomenon of false trust in the results, thereby improving the overall security protection performance of the system.

[0125] Specifically, in this example, the multi-mode decision method in the existing mimetic architecture model is optimized, a neural network model is introduced, and a heterogeneity calculation method is designed, which comprehensively considers the trustworthiness and heterogeneity of the executor to perform multi-mode decision. For the calculation of trustworthiness, an interface of the mimetic network device can be connected to the Internet to receive attacks from the external network; a large number of attack messages are sent to the interface, because different executors have different sensitivities to attack traffic and inherent vulnerabilities that are exploited, so the traffic distribution at the outbound interface of different execution units is different; the ratio of normal traffic to abnormal traffic is statistically analyzed through the neural network model, so that the trustworthiness of different executors can be quantified.

[0126] In this example, the selection of the neural network model takes into account that the existing data processing methods cannot automatically extract complex and hierarchical features from a large amount of data. To this end, in this example, it is considered to learn the intrinsic patterns and associations of the data through a multi-layer neural network structure to provide higher accuracy and efficiency in complex decision-making systems. In this example, a structured state space model is introduced into the neural network model. Specifically, the input sequence is decomposed into multiple subsequences, and the state space model is applied to each subsequence, thereby effectively reducing the computational complexity. The neural network model divides the input traffic sequence into multiple levels, and each level applies a different processing method: the low level uses the Transformer self-attention mechanism, and the high level uses the structured state space model, thereby effectively balancing the modeling of local and global dependencies. Among them, the low level mainly refers to the short-term relationship in the input traffic sequence, such as: short-term traffic fluctuations, emergencies and local pattern recognition (such as traffic spikes, short-term trends, etc.), and the high level mainly refers to the long-term trend of traffic, contextual traffic sequence dependencies, etc.

[0127] Specifically, in this example, a multi-mode arbitration system is provided, such as Figure 2 As shown, the system includes:

[0128] 1) Input agent, which is used to distribute input data to different heterogeneous executors (heterogeneous executor 1, heterogeneous executor 2...heterogeneous executor n). The same data needs to be format-adapted for different executors to complete equivalent input.

[0129] 2) Output agent, which is used to store the output results of each execution body and classify the results.

[0130] 3) A neural network model is used to calculate the credibility of each executor. The model includes: an input embedding layer, a time encoding layer, and a prediction layer. The input embedding layer is used to convert the network data stream into a fixed-length vector that can be processed by the subsequent model; the time encoding layer is used to capture the feature information in the traffic data and learn the deep relationship and pattern between the data; the prediction layer is used to convert the output sequence of the above process into a distribution prediction of normal traffic / abnormal traffic. The time encoding layer may include: a time series processing layer, a preprocessing layer, and a scaling layer. The time series processing layer is used to add time information to help the model understand the order and time dependency of the sequence; the preprocessing layer is used to preprocess the encoded input data, and the output is passed through the addition and normalization layers to obtain stable and standardized data; the scaling layer includes: a masked multi-head attention mechanism and a convolution block. The masked multi-head attention mechanism allows the model to focus on different parts of the input sequence, and the convolution block is used to process data through a state space model and a convolution layer.

[0131] For this neural network model, the original traffic data set used for training can be a benchmark data set from the field of network traffic anomaly detection (for example, the UNSW-NB15 data set), and mixed with the traffic data collected in the real environment through the simulated network device as the original data set, which is used as the data for the experiment. Among them, the original data set can include: normal traffic (Normal), generic attacks (Generic), vulnerability exploits (Exploits), denial of service attacks (DoS), backdoor attacks (Backdoor), scanning attacks (Scan) and other categories of attack traffic. For the original data set, after data enhancement, data cleaning, and data conversion exception processing, the neural network model is trained in a ratio of 7:3 between the training set and the test set.

[0132] 4) Heterogeneity calculation module, used to calculate the heterogeneity between the executors. Specifically, different isomers in a mimic device have differences in hardware characteristics, operating systems, computing performance, etc. These parameters are represented as a set of feature vectors, and then the distance method is used to quantify the heterogeneity between computers. Specifically, the following steps may be included:

[0133] S1: Standardized eigenvalues:

[0134] Since the characteristic units and ranges of the characteristic values ​​are different (for example, the CPU frequency is GHz, and the memory capacity is GB), standardization is required to make the characteristics comparable. The following formula can be used for standardization:

[0135]

[0136] Among them, x represents the original eigenvalue, mean(x) represents the mean of the feature, and std(x) represents the standard deviation of the feature.

[0137] S2: Extract feature vectors of different execution bodies:

[0138] Taking executive body A and executive body B as examples, the extracted feature vectors of executive body A and executive body B can be expressed as:

[0139]

[0140] S3: Calculate the heterogeneity between executors:

[0141] The heterogeneity between executor A and executor B is calculated according to the following formula:

[0142]

[0143] Among them, h(A,B) represents the heterogeneity between executors A and B, and w i Represents the weight value of the feature.

[0144] S4: For multiple (three or more) execution bodies that support the same result, calculate the average heterogeneity, where the average heterogeneity is the average of all pairwise distances:

[0145]

[0146] Among them, H 异构度 is the average heterogeneity, and N is the number of executors.

[0147] 5) The optimized multi-modal decision module is used to take the output result set of the output agent with the highest score as the final output after considering the credibility and heterogeneity to complete the multi-modal decision.

[0148] In the above multi-mode decision algorithm, it is assumed that the number of executors N=5, represented by the set {n1, n2, n3, n4, n5}, and there are three types of output results {C1, C2, C3} in the output agent, among which executors n1 and n2 support result C1, executors n3 and n4 support result C2, and executor n5 supports result C3.

[0149] The final score calculation method is as follows, taking C1 as an example:

[0150] S1: Calculate the sum of the credibility of executor n1 and executor n2:

[0151]

[0152] Among them, r 12is the sum of the credibility of executive body n1 and executive body n2, r1 is the credibility of executive body 1, and r2 is the credibility of executive body 2.

[0153] S2: The calculation is based on the natural base e, and the exponent is the opposite number of the heterogeneity between the execution body n1 and the execution body n2:

[0154]

[0155] Among them, z is the intermediate number, and h(1,2) is the inverse number of the heterogeneity between executive n1 and executive n2.

[0156] S3: Divide the result calculated by S1 by the result calculated by S2 to get the score of C1:

[0157]

[0158] Among them, Score c1 Indicates the score of C1.

[0159] The above method can be used to calculate the comprehensive scores of C1, C2, and C3. If C1 has the highest score, C1 is output as the result.

[0160] In this case, a multi-modal adjudication method based on credibility and mutual heterogeneity is provided, such as Figure 3 As shown, the following steps may be included:

[0161] S1: Input data: The data input terminal inputs the original data into the data broker;

[0162] S2: Data distribution: The input agent makes adjustments based on the types of online executables and the data format adaptation principle of the corresponding executables, and then distributes the data equally to different executables;

[0163] S3: Executor units calculate results separately: different executors calculate the input data;

[0164] S4: Output data storage: The output results are stored in the result buffer of the output agent, and the same output results are classified by the output agent to obtain an output result set;

[0165] S5: Result judgment: In the offline state, attack messages are sent to the mimic network device by simulating network attacks, and the distribution of normal / abnormal data at the flow output interfaces of different executors is obtained through the neural network model, and then the credibility of the executors is calculated; the heterogeneity between any two executors or the average heterogeneity between multiple executors is calculated; the score values ​​of different results in the output result set are calculated through the above-mentioned multi-mode judgment algorithm to obtain the judgment result;

[0166] S6: Result output.

[0167] In the above example, a multi-mode arbitration optimization method based on credibility and mutual heterogeneity is provided. The distribution of normal data and abnormal data in the output results of different executors is obtained through a neural network model, so as to calculate the credibility of different execution units. At the same time, a calculation method for heterogeneity is designed based on the differences in hardware characteristics, operating systems, computing performance, etc. of the executors. The above method improves the security performance of the system and ensures the reliability of data transmission. In other words, the relevant factors that affect the correctness of the results are fully considered. The introduction of heterogeneity can effectively avoid the common mode escape phenomenon caused by the low difference between executors. The method based on deep learning can accurately measure the trustworthiness of the executors and improve the intrinsic security performance of the dynamic heterogeneous redundant architecture.

[0168] The above multi-mode decision optimization method based on credibility and mutual heterogeneity can be applied to, for example, determining whether a route is added, determining whether a firewall is intercepted, determining whether a modification request is modified, etc.

[0169] For example, deploying the above method in a mimic router can be done as follows Figure 4 As shown, it includes: message distribution (routing agent and management protocol agent), router heterogeneous executor pool (first brand routing executor, second brand routing executor, third brand routing executor, fifth brand routing executor), central controller, multi-mode decision (decided by credibility and heterogeneity). Among them, the message distribution unit distributes the external data received by the input, sends the data of the routing / management plane to the heterogeneous router body pool for processing, and different routers calculate the relevant information such as independent routing tables after receiving the data, and hand over different calculation results to the multi-mode decision module, so as to select the output through the above scheme.

[0170] For example, deploying the above method in a mimic firewall can be as follows: Figure 5 As shown, it includes: message distribution (Nginx, Apache, Lighttpd), firewall heterogeneous executor pool (firewall executor 1, firewall executor 2...firewall executor n), central controller, multi-mode judgment (judgment by credibility and heterogeneity). In view of the possible vulnerabilities and backdoors in the web management layer and data flow processing layer of firewall products, the mimic defense technology is used, and the dynamic heterogeneous redundant architecture (DHR) is used as a guide to transform the existing firewall architecture. The above multi-mode judgment method is used to make the judgment, which can increase the difficulty of network attackers at the management and data levels, thereby effectively defending against the inherent intrusion in security access and providing reliable access control guarantees.

[0171] The above solution can be expanded to handle large-scale data sets while maintaining sensitivity to new situations, achieving efficient traffic management and prediction. Furthermore, it strengthens the system's ability to resist external attacks and provides effective support for the secure transmission, reliable forwarding and trusted bearing of data in the network.

[0172] The method embodiments provided in the above embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on an electronic device as an example, Figure 6 1 is a hardware structure block diagram of an electronic device of a multi-mode decision method provided by the present application. Figure 6 As shown, the electronic device 10 may include one or more (only one is shown in the figure) processors 02 (the processor 02 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 04 for storing data, and a transmission module 06 for communication functions. It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components as shown, or with Figure 6 Different configurations shown.

[0173] The memory 04 can be used to store software programs and modules of application software, such as program instructions / modules corresponding to the multi-mode decision method in the embodiment of the present application. The processor 02 executes various functional applications and data processing by running the software programs and modules stored in the memory 04, that is, the multi-mode decision method of the above-mentioned application is realized. The memory 04 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 04 may further include a memory remotely arranged relative to the processor 02, and these remote memories may be connected to the electronic device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0174] The transmission module 06 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 10. In one example, the transmission module 06 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 06 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0175] At the software level, the multi-mode decision device can be Figure 7 As shown, including:

[0176] An input module 701 is used to input the traffic data into multiple executable bodies built into the mimetic network device to obtain output results of each of the multiple executable bodies;

[0177] An acquisition module 702 is used to acquire the credibility of each of the multiple executables;

[0178] A determination module 703 is used to determine the degree of heterogeneity between multiple execution bodies that output the same result;

[0179] A decision module 704, configured to calculate a score of each output result among multiple output results according to the credibility of each executor and the heterogeneity between multiple executors that output the same result;

[0180] The output module 705 is used to output the output result with the highest score as the multi-mode decision result.

[0181] In one embodiment, the above-mentioned input module 701 is specifically used to determine the format requirements of each of the multiple executable bodies; convert the format of the traffic data according to the format requirements of each executable body; and input the format-converted traffic data equivalently to the multiple executable bodies built into the mimetic network device.

[0182] In one embodiment, the above-mentioned determination module 703 is specifically used to take multiple execution bodies that output the same result as a target execution body group; obtain multiple performance parameters of each execution body in the target execution body group; convert the multiple performance parameters of each execution body into a feature vector corresponding to each execution body; calculate the distance between any two execution bodies in the target execution body group according to the feature vector corresponding to each execution body; determine the average value of the distance between any two execution bodies in the target execution body group; and use the average value as the heterogeneity between the multiple execution bodies that output the same result.

[0183] In one embodiment, the above-mentioned arbitration module 704 can be specifically used to take multiple executors that output the same result as a target executor group; calculate the sum of the credibility of each executor in the target executor group as a first intermediate result; calculate a value with a natural base as the base and an average heterogeneity between multiple executors in the target executor group as an index as a second intermediate result; obtain a target value by dividing the first intermediate result by the second intermediate result, and use the target value as the score of the current output result.

[0184] In one embodiment, the credibility of each of the multiple executable bodies can be determined in the following manner: in an offline state, an attack message is sent to the mimetic network device by simulating a network attack; the traffic at the exit of each of the multiple executable bodies of the mimetic network device is detected to obtain the detection result of each executable body; the credibility of each of the multiple executable bodies is determined based on the distribution of normal data and abnormal data in the detection results of each executable body.

[0185] In one embodiment, determining the credibility of each executor among the multiple executors based on the distribution of normal data and abnormal data in the detection results of each executor can include: inputting the detection results of each executor into a pre-established neural network model to obtain the credibility of each executor among the multiple executors; wherein the neural network module includes: an input embedding layer, a time coding layer and a prediction layer, wherein the input embedding layer is used to convert the flow data into a vector of a fixed length that can be subsequently processed, the time coding layer is used to add time information to the flow data to obtain a data sequence and determine the dependency between the data sequence and time, and the prediction layer is used to convert the output sequence of the time coding layer into a distribution prediction of normal data and abnormal data.

[0186] In one embodiment, the traffic data set used to train the neural network model may include: a benchmark data set in the field of network traffic anomaly detection, and traffic data collected in a real environment through a simulated network device.

[0187] The embodiment of the present application also provides a specific implementation of an electronic device capable of implementing all the steps in the multi-mode decision method of the mimetic network device in the above embodiment, and the electronic device specifically includes the following contents: a processor, a memory, a communication interface and a bus; wherein the processor, the memory and the communication interface communicate with each other through the bus; the processor is used to call the computer program in the memory, and when the processor executes the computer program, all the steps in the multi-mode decision method of the mimetic network device in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0188] Step 1: Input the traffic data into multiple built-in executors in the mimic network device to obtain the output results of each of the multiple executors;

[0189] Step 2: Obtain the credibility of each of the multiple executable bodies;

[0190] Step 3: Determine the degree of heterogeneity between multiple executions that output the same result;

[0191] Step 4: Calculate the score of each output result among the multiple output results according to the credibility of each executor and the heterogeneity between multiple executors that output the same result;

[0192] Step 5: Output the output result with the highest score as the multi-modal decision result.

[0193] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps in the multi-mode decision method for a mimetic network device in the above embodiments. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all the steps in the multi-mode decision method for a mimetic network device in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0194] Step 1: Input the traffic data into multiple built-in executors in the mimic network device to obtain the output results of each of the multiple executors;

[0195] Step 2: Obtain the credibility of each of the multiple executable bodies;

[0196] Step 3: Determine the degree of heterogeneity between multiple executions that output the same result;

[0197] Step 4: Calculate the score of each output result among the multiple output results according to the credibility of each executor and the heterogeneity between multiple executors that output the same result;

[0198] Step 5: Output the output result with the highest score as the multi-modal decision result.

[0199] As can be seen from the above description, the embodiment of the present application obtains the output results of each of the multiple executors by inputting traffic data into multiple executors built into the mimetic network device, and then determines the score of each output result according to the heterogeneity between the multiple executors that output the same result and the credibility of each executor, thereby obtaining the final decision result. Because when performing multi-mode decision, the credibility and heterogeneity of the executor are considered at the same time, making the result of multi-mode decision more accurate.

[0200] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the hardware + program embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0201] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0202] Although the present application provides method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the actual device or client product is executed, it can be executed in the order of the method shown in the embodiments or the drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment).

[0203] Although the embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements.

[0204] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing the embodiments of this specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0205] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0206] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0207] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0208] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0209] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0210] The above is only an example of the embodiment of the present specification and is not intended to limit the embodiment of the present specification. For those skilled in the art, the embodiment of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiment of the present specification shall be included in the scope of the claims of the embodiment of the present specification.

Claims

1. A multi-mode decision method, characterized in that: include: Input the traffic data into multiple built-in executors in the mimic network device to obtain output results of each of the multiple executors; Obtaining the credibility of each of the multiple executable bodies; Determine the degree of heterogeneity between multiple executions that output the same result; According to the credibility of each executor and the heterogeneity between multiple executors that output the same result, the score of each output result in multiple output results is calculated; The output result with the highest score is output as the multi-modal decision result.

2. The method according to claim 1, characterized in that The traffic data is fed into multiple executives built into the mimic network device, including: Determining a format requirement for each of the plurality of executables; Convert the flow data into a format according to the format requirements of each executable body; The format-converted traffic data is equivalently input into a plurality of execution bodies built into the mimetic network device.

3. The method according to claim 1, characterized in that Calculate the heterogeneity between multiple executions that output the same result, including: Multiple executables that output the same result are used as the target executable group; Acquire multiple performance parameters of each executable body in the target executable body group; Convert multiple performance parameters of each actuator into a feature vector corresponding to each actuator; Calculating the distance between any two executable bodies in the target executable body group according to the feature vectors corresponding to the respective executable bodies, wherein the target executable body group includes at least three executable bodies; Determining an average value of distances between any two executors in the target executor group; The average value is used as the heterogeneity degree among the multiple execution bodies that output the same result.

4. The method according to claim 1, characterized in that: According to the credibility of each executor and the heterogeneity between multiple executors that output the same result, the score of each output result in multiple output results is calculated, including: Multiple executables that output the same result are used as the target executable group; Calculating the sum of the credibility of each executable body in the target executable body group as a first intermediate result; Calculate a value with a natural base as the base and an opposite number of the heterogeneity between the plurality of executors in the target executor group as the exponent as the second intermediate result; The target value is obtained by dividing the first intermediate result by the second intermediate result, and the target value is used as the score of the current output result.

5. The method according to claim 1, characterized in that The credibility of each of the multiple executables is determined in the following manner: In an offline state, sending an attack message to the mimic network device by simulating a network attack; Detecting the flow at the exit of each of the multiple executors of the mimic network device to obtain the detection result of each executor; The credibility of each of the multiple executable bodies is determined according to the distribution of normal data and abnormal data in the detection results of each executable body.

6. The method according to claim 5, characterized in that Determining the credibility of each of the plurality of executables according to the distribution of normal data and abnormal data in the detection results of each executable, including: Inputting the detection results of each actuator into a pre-established neural network model to obtain the credibility of each actuator in the multiple actuators; The neural network module includes: an input embedding layer, a time coding layer and a prediction layer, wherein the input embedding layer is used to convert the traffic data into a fixed-length vector that can be subsequently processed, the time coding layer is used to add time information to the traffic data to obtain a data sequence and determine the dependency between the data sequence and time, and the prediction layer is used to convert the output sequence of the time coding layer into a distribution prediction of normal data and abnormal data.

7. The method according to claim 6, characterized in that The traffic data set used to train the neural network model includes: a benchmark data set in the field of network traffic anomaly detection, and traffic data collected in a real environment through a simulated network device.

8. A multi-mode decision device, characterized in that: include: An input module, used to input traffic data into multiple executable bodies built into the mimetic network device, and obtain output results of each of the multiple executable bodies; An acquisition module, used to acquire the credibility of each of the multiple executable bodies; A determination module, used to determine the degree of heterogeneity between multiple execution bodies that output the same result; A judgment module, used for calculating the score of each output result among multiple output results according to the credibility of each executor and the heterogeneity between multiple executors that output the same result; The output module is used to output the output result with the highest score as the multi-mode decision result.

9. An electronic device comprising a processor and a memory for storing instructions executable by the processor, characterized in that: When the processor executes the instructions, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images