Mimicry completeness measurement system and method, medium and computer device

Abstract

According to the mimicry completeness measurement system and method, the medium and the computer device, through static analysis and dynamic detection, according to the mimicry defense theory, the mimicry completeness of a mimicry application system is fairly evaluated, and the security defense capability of the mimicry application system is visually reflected. Development reference is provided for developers, and weak links of the system can be quickly positioned and repaired. Meanwhile, an acceptance tool and a standard are provided for a purchaser and a user and can be used as a bid invitation technical parameter and a scoring basis. The invention provides a clear and quantitative analysis tool for evaluating the safety performance of the mimicry application system.

Description

Technical Field

[0001] The present application relates to the field of mimicry defense technology, and in particular to a mimicry completeness measurement system, method, medium and computer device. Background Art

[0002] Information system software that uses mimicry technology has high complexity in application development, deployment, network design and configuration. At the same time, due to the limitation of manpower, time, technology and other resources, such application systems usually make appropriate compromises in terms of executor heterogeneity, network isolation and other aspects, and cannot achieve 100% of the ideal conditions of mimicry systems, that is, 100% mimicry completeness is usually impossible to achieve in reality. For an incomplete mimicry application system, how to effectively measure its completeness and give a reasonable evaluation has become an important issue faced in the development of mimicry application systems.

[0003] At present, although there are some patents published that attempt to solve the technical problem of effective measurement, each of them still has some problems.

[0004] For example, the invention patent with publication number CN109657478A does disclose "A method and system for quantifying heterogeneity", which proposes a method for measuring heterogeneity in a mimicking environment. In this patent, the degree of heterogeneity of the executive body is considered to be an important consideration when measuring the completeness of the mimicry. However, the patent only proposes a broad mathematical formula, and does not specifically explain the method for taking the values ​​of each parameter in the formula, which limits the operability of the formula in the actual application environment. Specifically, the method mentioned in the patent includes determining the complexity CK and the difference FDQk of the executive body component set, and calculating the heterogeneity of the executive body set based on these parameters, but does not give the specific calculation method or value basis of these parameters, which makes the method difficult to implement in actual applications. Therefore, although the patent provides a theoretical basis for the quantification of heterogeneity in mimicking systems, further research and development are still needed in actual applications to solve the specific problems of parameter value taking and application implementation.

[0005] For another example, the invention patent with publication number CN118282722A proposes a method for evaluating the heterogeneity of the executable based on the results of the attack test. The core of this method is to use the results of the attack test to measure the heterogeneity of the system, so as to evaluate the completeness of the mimic system. However, the heterogeneity evaluation results of this method are limited by the existing attack technology, attack means and attack paths, and it is difficult to be sufficient and fair, and it is very susceptible to the impact of the target executable environment. For example, if the target executable is first scanned for vulnerabilities, then the corresponding patches are applied and then tested according to the target patent method, a completely different value will be obtained. But in fact, in the mimicry theory, whether the executable is patched has no significant effect on the heterogeneity of the executable, which deviates from the concept of being able to effectively defend against attacks launched by unknown vulnerabilities, unknown backdoors, and unknown technologies required by the mimicry defense theory. Therefore, the method of this patent cannot fully reflect the heterogeneity of the executable because it relies on known attack means and paths, and the core of mimicry defense is to fight against unknown threats. Summary of the invention

[0006] In view of the above-mentioned shortcomings of the prior art, the purpose of the present application is to provide a mimicry completeness measurement system, method, medium and computer device to solve the technical problem that mimicry completeness measurement is not accurate enough.

[0007] To achieve the above-mentioned purpose and other related purposes, the first aspect of the present application provides a mimicry completeness measurement system, including: a user interaction module, which is used to provide a user input interface in the form of a form for collecting information of the mimicry defense system to be tested; the collected information includes any one of the following information or a combination of multiple information: deployment information of each component, network topology information, business access portal, business function list, mimicry defense function list and other information; an agent deployment module, connected to the user interaction module, for automatically distributing agent components for testing to each component according to the deployment information of each component collected by the user interaction module; the agent component has a built-in test The required network isolation detection module, execution body heterogeneity detection module, mimetic bracket security detection module, service availability detection module, and key point integrity analysis module; a comprehensive analysis and report generation module, connected to the user interaction module and the agent deployment module, for generating test plans and test instructions based on the information collected by the user interaction module, and sending the test instructions to the agent components on each node of the mimetic application system to be tested, so that the agent components can start to execute various test operations after receiving the test instructions; a corresponding mimetic completeness report is generated based on the information sent by each test module in the agent component of the agent deployment module and the key point integrity analysis results.

[0008] In some embodiments of the first aspect of the present application, the network isolation detection module performs network isolation detection through cross-node monitoring and communication, and sends the network isolation detection results to the comprehensive analysis and report generation module; the content of the network isolation detection includes the isolation between multiple executors, the isolation between the distributor and the arbitrator, whether the communication between the distributor-executor-arbitrator is one-way and irreversible, whether the executor can communicate with components outside the mimetic brackets, and whether the business side can access other nodes except the distributor.

[0009] In some embodiments of the first aspect of the present application, the executable heterogeneity detection module is used to evaluate the heterogeneity between each executable body in the mimic defense system to be tested. It collects software and hardware information through agent components deployed on each executable body, including CPU instruction set, operating system version, kernel version, middleware version and related information of business applications.

[0010] In some embodiments of the first aspect of the present application, the executable heterogeneity detection module uses any one of the quantification algorithms of vulnerability quantification, function quantification, entropy quantification, and complexity-difference two-dimensional quantification to evaluate the heterogeneity between different executables.

[0011] In some embodiments of the first aspect of the present application, the mimetic bracket security detection module collects security configuration information of each node of the mimetic bracket through agent components distributed on the mimetic bracket-related nodes, evaluates the security status of the mimetic bracket nodes, and sends the collected data to the comprehensive analysis and report generation module.

[0012] In some embodiments of the first aspect of the present application, the service availability detection module simulates failures and attacks on the executor to evaluate the business continuity and service correctness of the executor under various abnormal situations, and feeds the evaluation results back to the comprehensive analysis and report generation module.

[0013] In some embodiments of the first aspect of the present application, the key point integrity analysis module is used to perform a comprehensive analysis based on the overall business information and key point information of the mimetic defense collected by the user interaction module, evaluate whether the protection scope of the mimetic defense system to be tested covers all core key modules of the business system, and analyze the potential risks of uncovered modules.

[0014] To achieve the above-mentioned purpose and other related purposes, the second aspect of the present application provides a mimetic completeness measurement method, including: providing a user input interface in the form of a form for collecting information of the mimetic defense system to be tested; the collected information includes any one of the following information or a combination of multiple information: deployment information of each component, network topology information, business access portal, business function list, mimetic defense function list and other information; according to the deployment information of each component collected by the user interaction module, automatically distributing the agent component for testing to each component; the agent component has a network isolation detection module, an execution body heterogeneity detection module, a mimetic bracket security detection module, a service availability detection module, and a key integrity analysis module required for the test; generating a test plan and test instructions based on the collected information of the mimetic defense system to be tested, and sending the test instructions to the agent components on each node of the mimetic application system to be tested, so that the agent components can start to execute various test operations after receiving the test instructions; generating a corresponding mimetic completeness report based on the information sent by each test module in the agent component of the agent deployment module and the key integrity analysis results.

[0015] To achieve the above-mentioned purpose and other related purposes, the third aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the mimicry completeness measurement method when executed by a processor.

[0016] To achieve the above-mentioned purpose and other related purposes, the fifth aspect of the present application provides a computer device, including a memory, a processor and a computer program stored in the memory; the processor executes the computer program to implement the mimicry completeness measurement method.

[0017] As described above, the mimetic completeness measurement system, method, medium and computer device of the present application have the following beneficial effects: the present invention can realize a fair measurement evaluation of the mimetic completeness of the mimetic application system by static analysis and dynamic detection of the mimetic application system, combined with various technical requirements of the mimetic defense theory, and the mimetic security defense capability of the current mimetic application system can be directly reflected through the measurement score of the mimetic completeness. Through the present invention, a reference and guidance for the development process can be provided to the developers of the mimetic application system. The developer of the application system can quickly locate the weak links in the mimetic application system in the analysis report provided by the present invention, and carry out targeted development and repair. Through the present invention, an acceptance tool and acceptance benchmark can be provided for the purchaser and user of the mimetic application system. The mimetic completeness evaluation result calculated by the present invention can also be used as the technical parameters and scoring basis in the bidding document. In short, through the present invention, a clear and quantitative analysis and evaluation can be provided for the mimetic application system, which can assist relevant personnel to understand the security capability of the target mimetic application system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Shown is a structural schematic diagram of a mimicry completeness measurement system in one embodiment of the present application.

[0019] Figure 2 Shown is a schematic diagram of the workflow of a service availability detection module in one embodiment of the present application.

[0020] Figure 3 Shown is a schematic diagram of the workflow of a key site integrity analysis module in one embodiment of the present application.

[0021] Figure 4 Shown is a schematic diagram of the overall workflow of the mimicry completeness measurement system in one embodiment of the present application.

[0022] Figure 5 Shown is a flow chart of a mimic completeness measurement method in one embodiment of the present application.

[0023] Figure 6 Shown is a schematic diagram of the structure of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0024] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0025] In order to solve the technical problems in the above-mentioned background technology, the present invention proposes a mimetic completeness measurement system and method, which aims to comprehensively analyze the dimensions of executor heterogeneity, network isolation, mimetic bracket security, service availability, and key integrity with the mimetic system by combining static analysis of input data with dynamic detection of each module agent, and finally form a completeness analysis report and give a comprehensive evaluation score.

[0026] Before further describing the present invention in detail, the nouns and terms involved in the embodiments of the present invention are explained. The nouns and terms involved in the embodiments of the present invention are applicable to the following interpretations:

[0027] (1) Mimicry defense: A cyberspace defense theory based on the principle of biological mimicry, which aims to deal with various unknown threats in cyberspace. It builds a dynamically changing multi-parallel collaborative architecture, roots the security gene in the network information system, establishes an immune system with endogenous effects, and effectively solves the defense problem of unknown attacks that exploit unknown vulnerabilities and unknown backdoors.

[0028] (2) Security of mimetic brackets: The mimetic brackets consist of input allocation and proxy, output proxy and arbiter. They are the protection boundary of a heterogeneous mimetic bracket set that may contain unknown vulnerabilities, backdoors, viruses, Trojans and other uncertain disturbance factors. The security of the mimetic brackets is particularly critical to ensuring the overall security of the system, because it is the entrance for users to access the mimetic system and is a component that is the focus of attacks. Its security is related to the effective operation of the mimetic defense mechanism.

[0029] Figure 1 The structural diagram of a mimetic completeness measurement system in an embodiment of the present invention is shown. The mimetic completeness measurement system in this embodiment is deployed to a server or personal terminal connected to all nodes in the mimetic application system to be tested; the mimetic completeness measurement system mainly includes the following modules: a user interaction module 101, an agent deployment module 102, and a comprehensive analysis and report generation module 103.

[0030] It should be understood here that all nodes mentioned in the mimetic application system need to access multiple subnets at the same time, such as the business network, management network, internal network, etc., that is, different network nodes (which can be servers, personal terminals, virtual machines, etc.) need to be connected to different network subnets to meet different functional and security requirements. Business network refers to the network used to provide external business services. The management network is used for network management and monitoring systems. It allows administrators to remotely log in to network devices (such as routers, switches, servers, etc.) for configuration, updating and troubleshooting. This mainly refers to the management of the mimetic system itself. The internal network refers to the network for communication between mimetic bracket components and executors, which is used for daily office activities such as file sharing, printing services, internal communications, etc.

[0031] The user interaction module 101 is used to provide a user input interface in the form of a form for collecting information about the mimicry defense system to be tested; the collected information includes but is not limited to: deployment information of each component, network topology information, business access portal, business function list, mimicry defense function list and other information.

[0032] The deployment information of each component includes the IP address, login credentials (user name and password), application name, programming development language, and middleware list of each component. This information is crucial to understanding the architecture and configuration of the system. Network topology information is used to describe the structure of the network, including the location of devices in the network and the connections between them, which is crucial for analyzing the network-level security and performance of the system. Business access portals refer to the entry points for users or systems to access business services, which is very important for identifying potential security risks and attack vectors. The business function list is used to list all business functions provided by the system, which helps to identify which functions may become targets of attacks. The mimicry defense function list is used to detail the mimicry defense measures that the system has implemented, and is used to evaluate the overall security and defense capabilities of the system.

[0033] The proxy deployment module 102 is connected to the user interaction module 101, and is used to automatically distribute proxy components for testing to each component based on the deployment information of each component collected by the user interaction module 101; the proxy component has built-in network isolation detection module 102a, execution body heterogeneity detection module 102b, mimetic bracket security detection module 102c, service availability detection module 102d, and key point integrity analysis module 102e required for testing.

[0034] The network isolation detection module 102a performs network isolation detection through cross-node monitoring and communication, and sends the network isolation detection result to the comprehensive analysis and report generation module 103; the content of the isolation detection includes the isolation between multiple executors, the isolation between the distributor and the arbitrator, whether the communication between the distributor-executor-arbitrator is one-way and irreversible, whether the executor can communicate with the components outside the mimetic brackets, and whether the business side can access other nodes except the distributor.

[0035] Specifically, the working mechanism of the network isolation detection module 102a is to monitor network communication information through proxy components deployed on different nodes, and query the local listening port and protocol list to obtain the listening port and protocol information related or unrelated to the business flow. The network isolation detection module 102a can make cross-node access attempts and judge the isolation between nodes by the feasibility of data communication, that is, nodes that can communicate are considered to be connected, and nodes that cannot communicate are considered to be isolated. The detection results of the network isolation detection module 102a will be sent to the comprehensive analysis and report generation module 103 for further analysis and reporting.

[0036] It should be noted here that the isolation between multiple executors refers to the detection of whether there is strict isolation between different executors (different processing units in the system) to ensure that the security issues of one executor will not affect other executors. The isolation between the distributor and the arbiter means that the distributor is responsible for assigning tasks to the executors, and the arbiter is responsible for receiving results from the executors and making decisions. Detecting whether they are isolated can prevent potential attacks or affect another component through one component. Whether the communication between the distributor, executor and arbiter is one-way and irreversible is to ensure that the communication from the distributor to the executor and then to the arbiter is one-way and irreversible, which can prevent data from being tampered with or traced back and enhance the security of the system. Whether the executor can communicate with components outside the mimetic brackets, the mimetic brackets refer to the distributor, the arbiter and the negative feedback mechanism, and the executor should not be able to communicate with any other components outside these components to prevent potential security vulnerabilities. Whether the business side can access other nodes except the distributor means that the business side (the user interface or front end of the system) should only access the distributor, but not other nodes, which can limit the potential attack surface and protect the core components of the system.

[0037] The isolation detection of the network isolation detection module 102a can improve security, ensure strict isolation between components, and reduce the risk of system attacks. Limit unnecessary communications and reduce the possibility of sensitive data leakage. Enhance the robustness of the system. Even if a part of the system is attacked, other parts can still run safely and will not be affected. Improve system reliability. By ensuring the unidirectionality and irreversibility of communication, the reliability of system processing tasks is enhanced. Reduce maintenance costs. Through automated isolation detection, the need for manual detection is reduced, reducing maintenance costs and the possibility of human error.

[0038] The executable heterogeneity detection module 102 b collects software and hardware information of the executables through agent components distributed on the executables to quantify the heterogeneity between different executables, and sends the collected information to the comprehensive analysis and report generation module 103 .

[0039] Specifically, the execution body heterogeneity detection module 102b is used to evaluate the heterogeneity between each execution body in the system (i.e., different processing units in the system). It collects software and hardware information through the agent components deployed on each execution body, including CPU instruction set, operating system version, kernel version, middleware version, and relevant information of business applications (such as development language, file size, fuzzy hash calculation value, etc.), which is crucial for understanding and quantifying the degree of heterogeneity between execution bodies. It should be understood that heterogeneity refers to the differences in structure, function, behavior, etc. between different components in the system. In the mimetic system, heterogeneity is an important security attribute because it can increase the difficulty for attackers to identify and exploit system vulnerabilities. By quantifying these heterogeneities, the system can evaluate its security gain and optimize its defense strategy accordingly.

[0040] Exemplarily, the execution body heterogeneity detection module 102b uses any one of the quantification algorithms of vulnerability quantification, function quantification, entropy quantification, and complexity-difference two-dimensional quantification to evaluate the heterogeneity between different execution bodies. Vulnerability quantification quantifies heterogeneity by counting and evaluating the number of vulnerabilities and their severity in the execution body. For example, the number of vulnerabilities contained in the component can be obtained through CVE (Common Vulnerabilities & Exposures), and the score of the vulnerability can be obtained through CVSS (Common Vulnerability Scoring System). Function quantification focuses on the function set provided by the execution body and its differences. Different execution bodies may have different functions. This functional difference can be used as a dimension for quantifying heterogeneity. Entropy quantification uses the concept of information entropy to measure the uncertainty and diversity of the system. In heterogeneity quantification, entropy can be used to measure the diversity of the execution body set, thereby evaluating the heterogeneity of the system. Complexity-difference two-dimensional quantification comprehensively considers the complexity and difference of the execution body set. Complexity can refer to the functional complexity of the execution body, while difference refers to the difference between different execution bodies. Through the combination of these two dimensions, the heterogeneity of the system can be more comprehensively quantified.

[0041] The mimetic bracket security detection module 102c collects the security configuration information of each node of the mimetic bracket through the proxy components distributed on the mimetic bracket related nodes, evaluates the security status of the mimetic bracket nodes based on this, and sends the collected data to the comprehensive analysis and report generation module 103; the security configuration information includes: the hardware configuration, operating system, kernel version, firewall policy, other security component policies, and mimetic bracket application information of each node of the mimetic bracket.

[0042] The mimetic bracket is a key component of the mimetic defense system, including input distribution and proxy, output proxy and arbiter, which constitute the protection boundary of the heterogeneous executor set and may contain uncertain disturbance factors such as unknown vulnerabilities, backdoors or viruses and Trojans. This module collects information about the hardware configuration, operating system, kernel version, firewall policy, other security component policies and mimetic bracket applications (such as distributors, arbiters, and negative feedback) of each node by deploying proxy components on the mimetic bracket related nodes. This information is crucial for evaluating the security of the mimetic bracket because it involves the underlying security and operating environment of the system. For example, information about the operating system and kernel version can help identify known security vulnerabilities and potential attack surfaces; information about firewall policies and other security component policies is directly related to the system's defense capabilities against external threats. Information about mimetic bracket applications involves the core mechanisms of the mimetic defense system, including how to distribute inputs and arbitrate outputs, which are key factors in evaluating the security of the system. The collected information will be sent to the comprehensive analysis and report generation module, which will further analyze the data, identify potential security risks, and generate corresponding security reports. Such a mechanism can help system administrators understand the security status of the system in a timely manner and take necessary measures to strengthen the security of the system, ensuring that the mimicry defense system can effectively resist unknown security threats.

[0043] The service availability detection module 102d simulates failures and attacks on the execution body to evaluate the business continuity and service correctness of the execution body under various abnormal situations, and feeds back the evaluation results to the comprehensive analysis and report generation module 103.

[0044] The service availability detection module 102d is used to evaluate the system's ability to maintain service operation in the face of various potential failures and security threats. The core function of this module is to perform a series of destructive operations on the executor to test its business-side service availability under different abnormal conditions. These abnormal conditions include network disconnection, application failure, simulated vulnerability injection and activation, etc. The availability of the detection includes two aspects: one is whether the service can be provided normally, that is, the accessibility of the service; the other is whether the service content provided is correct, that is, the accuracy of the service.

[0045] Specifically, the workflow of the service availability detection module 102d is as follows: Figure 2 As shown, including:

[0046] Step S21: By performing destructive operations on the executable, abnormal conditions such as network disconnection, application failure, and vulnerability injection are simulated to test the reaction and performance of the executable in these situations.

[0047] Step S22: Evaluate whether the execution body can continue to provide business services under the above abnormal state, that is, test the continuity of the service.

[0048] Step S23: If the service can continue to be provided, further verify the correctness of the service content to ensure that the service output is consistent with expectations.

[0049] Step S24: The test results and related information are collected and sent to the comprehensive analysis and report generation module for in-depth analysis and generation of detailed reports.

[0050] Therefore, the advantage of this detection method is that it can detect and fix problems that may affect service availability in advance, thereby improving system reliability and user satisfaction. By simulating real failure and attack scenarios, the service availability detection module can provide a comprehensive availability assessment for the system, helping system administrators optimize system design and improve the system's fault tolerance and recovery capabilities.

[0051] The key integrity analysis module 102e performs a comprehensive analysis based on the overall business information and key information of the mimicry defense collected by the user interaction module 101, evaluates whether the protection scope of the mimicry defense system to be tested covers all core key modules of the business system, and analyzes the potential risks of uncovered modules.

[0052] Specifically, the key integrity analysis module 102e is a security analysis tool that performs a comprehensive analysis on the overall business information collected by the user interaction module and the key information of the mimicry defense (i.e., the business scope protected by the mimicry technology, i.e., the functional list of the executable application). The core purpose of this module is to verify whether the protection scope of the mimicry system fully covers all the core key modules of the business system.

[0053] Figure 3 The workflow diagram of the site integrity analysis module is shown, including the following steps:

[0054] Step S31: Obtain business information and key information of mimicry defense from the user interaction module, which includes a list of business functions and a protected scope.

[0055] Step S32: Collect the real data flow information when the business side accesses through the proxy component deployed on the execution body.

[0056] Step S33: Cross-check the collected business information and key information of the mimicry defense with the real traffic information to verify whether the mimicry defense system covers all key business modules.

[0057] Step S34: Identify and evaluate business function points that are not within the protection range of the mimicry defense system.

[0058] For example, to make the analysis more accurate, the knowledge and experience of experts can be combined to conduct in-depth analysis of the cross-comparison results, so as to identify and evaluate business function points that are not within the protection scope of the mimicking system.

[0059] Step S35: Analyze uncovered business function points one by one, and evaluate the impact on the overall business system after being breached.

[0060] Step S36: Send all acquired information and analysis results to the comprehensive analysis and report generation module for further analysis and report generation.

[0061] Therefore, through this analysis, the key integrity analysis module can provide system administrators with a clear perspective to understand which business modules are effectively protected and which modules have potential risks, so that they can take corresponding security measures to enhance the security of the entire business system.

[0062] The comprehensive analysis and report generation module 103 is connected to the user interaction module 101 and the agent deployment module 102, and is used to generate a test plan and test instructions according to the information collected by the user interaction module 101, and send the test instructions to the agent components on each node of the mimic application system to be tested, so that the agent components can start to perform various test operations after receiving the test instructions, such as network isolation test, execution body heterogeneity test, mimic bracket security test, service availability test, etc. A corresponding mimic completeness report is generated according to the information sent by each test module in the agent component of the agent deployment module 102 and the key integrity analysis results.

[0063] Specifically, the comprehensive analysis and report generation module 103 integrates data from different detection modules, including all data from the network isolation detection module 102a, the execution body heterogeneity detection module 102b, the mimetic bracket security detection module 102c, the service availability detection module 102d, and the key integrity analysis module 102e, involving network communication information, business flow information, system configuration information, etc. Subsequently, these integrated data are cleaned, filtered, and counted to ensure the accuracy of the analysis, and the collected data are analyzed in depth using data analysis techniques, such as Python's data processing library Pandas. The comprehensive analysis and report generation module 103 can support user-defined report templates, including content, format, and style, so that the report can be customized according to the specific needs of the user. According to user needs and predefined templates, the system automatically fills in the report content and generates a report, including automatic generation, batch import, editing and processing, etc. for data processing.

[0064] For ease of understanding, the following is combined with Figure 4 The displayed flowchart further illustrates the mimicry completeness measurement system provided in this application.

[0065] The user interaction module, agent deployment module, and comprehensive analysis and report generation module in the present invention are deployed to a server or a personal terminal, and the server or terminal is connected to all nodes of the mimetic application system to be tested through a network, for example, multiple subnets such as a business network, a management network, and an internal network are simultaneously connected. The overall workflow of the mimetic completeness measurement system provided in this application is as follows:

[0066] Step S41: The user accesses the user interaction module in the present invention through a browser, and fills in the relevant information of the system under test as required, including the deployment information of each component (IP address, user name, password, application name, programming development language, middleware list, etc.), network topology information, business access portal, business function list, mimicry defense function list, etc.

[0067] Step S42: The agent deployment module in the mimic completeness measurement system performs push deployment operations of the agent components according to the deployment node information collected in the previous step, and deploys a set of agent components in all nodes involved in the mimic application system to be tested.

[0068] Step S43: The comprehensive analysis and report generation module in the mimic completeness measurement system generates a test plan and test instructions based on the information collected by the user interaction module, and sends the test instructions to the agent component of each node.

[0069] Step S44: The proxy component performs test operations such as network isolation, execution body heterogeneity, mimetic bracket security, and service availability according to the test instructions, and sends the information collected during the test to the comprehensive analysis and report generation module.

[0070] Step S45: The expert personnel analyzes and judges the key integrity of the target system through the input information collected in step S41 and the test information collected in step S44, and enters the review opinions through the user interaction module.

[0071] Step S46: The comprehensive analysis and report generation module performs comprehensive analysis and judgment based on the information collected in steps S44 and S45, and generates a mimic completeness analysis report for the target system.

[0072] Step S47: The user can view the analysis report generated in the previous step through the browser.

[0073] The following table shows an example of scoring for each item of the mimicry system. This example is only used as a preferred recommended parameter of the present invention and is not a required item of the present invention. In actual use, the user can adjust the items and scores in the scoring example as needed.

[0074]

[0075]

[0076] It is worth noting that, compared with the existing patent technology that can only give a broad mathematical formula but cannot be applied to the actual environment, the heterogeneity measurement in the present invention is only one dimension of the mimetic completeness measurement, and the execution body heterogeneity measurement method used in the present invention is more practical. In addition, compared with the existing patent technology, it cannot effectively defend against attacks launched by unknown vulnerabilities, unknown backdoors, and unknown technologies, but adopts static analysis combined with script detection and verification, relying on the configuration of empirical parameters rather than based on attack results, and therefore does not rely on attack methods.

[0077] It should be understood that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0078] Figure 5 A flowchart of a method for measuring the completeness of a mimicry according to an embodiment of the present invention is shown, and includes the following steps:

[0079] Step S51: Provide a user input interface in the form of a form for collecting information about the mimicry defense system to be tested; the collected information includes any one of the following information or a combination of multiple information: deployment information of each component, network topology information, business access portal, business function list, mimicry defense function list and other information.

[0080] Step S52: According to the deployment information of each component collected by the user interaction module, the proxy component for testing is automatically distributed to each component; the proxy component has built-in network isolation detection module, execution body heterogeneity detection module, mimetic bracket security detection module, service availability detection module, and key integrity analysis module required for testing.

[0081] Step S53: Generate a test plan and test instructions based on the collected information of the mimetic defense system to be tested, and send the test instructions to the agent components on each node of the mimetic application system to be tested, so that the agent components can start to execute various test operations after receiving the test instructions; generate a corresponding mimetic completeness report based on the information sent by each test module in the agent component of the agent deployment module and the results of the key integrity analysis.

[0082] It should be noted that the implementation method and principle of the mimicry completeness measurement method provided in the embodiment of the present invention are similar to those of the mimicry completeness measurement system described above, and will not be described in detail here.

[0083] It should be understood that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0084] In the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items with substantially the same functions and effects. For example, the first XX and the second XX are only used to distinguish different XXs, and do not limit their order. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0085] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" represent examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0086] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc or abc, where a, b, c can be single or multiple.

[0087] Figure 6 is a schematic block diagram of a computer device provided in an embodiment of the present application. Figure 6As shown in FIG. 6 , the computer device includes: at least one processor 601, a memory 602, at least one network interface 603, and a user interface 605. The various components in the device are coupled together via a bus system 604. It can be understood that the bus system 604 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 604 is not described in detail. Figure 6 In the specification, various buses are labeled as bus systems.

[0088] The user interface 605 may include a display, a keyboard, a mouse, a trackball, a click gun, keys, buttons, a touch pad or a touch screen.

[0089] It is understood that the memory 602 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM). The memory described in the embodiments of the present invention is intended to include but is not limited to these and any other suitable categories of memory.

[0090] The memory 602 in the embodiment of the present invention is used to store various types of data to support the operation of the computer device 600. Examples of these data include: any executable program for operating on the computer device 600, such as an operating system 6021 and an application 6022; the operating system 6021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application 6022 can include various applications, such as a media player (Media Player), a browser (Browser), etc., for implementing various application services. The implementation of the XX method provided in the embodiment of the present invention can be included in the application 6022.

[0091] The method disclosed in the above embodiment of the present invention can be applied to the processor 601, or implemented by the processor 601. The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 601 or the instruction in the form of software. The above processor 601 may be a general processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 601 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general processor 601 may be a microprocessor or any conventional processor, etc. In combination with the steps of the accessory optimization method provided in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0092] In an exemplary embodiment, the computer device 600 may be one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD) to execute the aforementioned method.

[0093] According to the method provided in the embodiment of the present application, the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes the mimic completeness measurement method.

[0094] According to the method provided in the embodiment of the present application, the present application also provides a computer-readable storage medium, which stores a program code. When the program code runs on a computer, the computer executes the above-mentioned mimicry completeness measurement method.

[0095] The terms "component", "module", "system", etc. used in this specification are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program and / or a computer. By way of illustration, both applications running on a computing device and a computing device can be components. One or more components may reside in a process and / or an execution thread, and a component may be located on a computer and / or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may, for example, communicate through local and / or remote processes according to signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system and / or a network, such as the Internet interacting with other systems through signals).

[0096] Those of ordinary skill in the art will appreciate that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0097] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0098] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0099] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0100] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0101] In the above embodiments, the functions of each functional unit can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When loading and executing computer program instructions (programs) on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integrations. Available media may be magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., high-density digital video discs (DVDs), or semiconductor media (e.g., solid state disks (SSDs), etc.).

[0102] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0103] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0104] In summary, the present application provides a mimetic completeness measurement system, method, medium and computer device. The present invention can realize a fair measurement evaluation of the mimetic completeness of the mimetic application system by static analysis and dynamic detection of the mimetic application system, combined with various technical requirements of the mimetic defense theory. The mimetic security defense capability of the current mimetic application system can be directly reflected through the measurement score of the mimetic completeness. Through the present invention, a reference and guidance for the development process can be provided for the developers of the mimetic application system. The developer of the application system can quickly locate the weak links in the mimetic application system in the analysis report provided by the present invention, and carry out targeted development and repair. Through the present invention, an acceptance tool and acceptance benchmark can be provided for the purchaser and user of the mimetic application system. The mimetic completeness evaluation result calculated by the present invention can also be used as the technical parameters and scoring basis in the bidding document. In short, through the present invention, a clear and quantitative analysis and evaluation can be provided for the mimetic application system, which can assist relevant personnel to understand the security capability of the target mimetic application system. Therefore, the present application effectively overcomes the various shortcomings in the prior art and has a high industrial utilization value.

[0105] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A mimic completeness measurement system, characterized in that: include: A user interaction module is used to provide a user input interface in the form of a form for collecting information about the mimicry defense system to be tested; the collected information includes any one of the following information or a combination of multiple information: deployment information of each component, network topology information, business access portal, business function list, mimicry defense function list, etc.; An agent deployment module is connected to the user interaction module and is used to automatically distribute agent components for testing to each component according to the deployment information of each component collected by the user interaction module; the agent component has a network isolation detection module, an execution body heterogeneity detection module, a mimetic bracket security detection module, a service availability detection module, and a key integrity analysis module built in the test; A comprehensive analysis and report generation module is connected to the user interaction module and the agent deployment module, and is used to generate a test plan and test instructions based on the information collected by the user interaction module, and send the test instructions to the agent components on each node of the mimic application system to be tested, so that the agent components can start to execute various test operations after receiving the test instructions; and generate a corresponding mimic completeness report based on the information sent by each test module in the agent component of the agent deployment module and the key integrity analysis results.

2. The mimic completeness measurement system according to claim 1, characterized in that: The network isolation detection module performs network isolation detection through cross-node monitoring and communication, and sends the network isolation detection results to the comprehensive analysis and report generation module; the content of the network isolation detection includes the isolation between multiple executors, the isolation between the distributor and the arbitrator, whether the communication between the distributor-executor-arbitrator is one-way and irreversible, whether the executor can communicate with the components outside the mimetic brackets, and whether the business side can access other nodes except the distributor.

3. The mimic completeness measurement system according to claim 1, characterized in that: The executable heterogeneity detection module is used to evaluate the heterogeneity between the executables in the mimic defense system to be tested. It collects software and hardware information, including CPU instruction set, operating system version, kernel version, middleware version and related information of business applications, through the agent components deployed on each executable.

4. The mimic completeness measurement system according to claim 3, characterized in that: The executable heterogeneity detection module uses any one of the quantification algorithms of vulnerability quantification, function quantification, entropy quantification, and complexity-difference two-dimensional quantification to evaluate the heterogeneity between different executables.

5. The mimic completeness measurement system according to claim 1, characterized in that: The mimetic bracket security detection module collects security configuration information of each mimetic bracket node through agent components distributed on mimetic bracket related nodes, evaluates the security status of the mimetic bracket nodes, and sends the collected data to the comprehensive analysis and report generation module.

6. The mimic completeness measurement system according to claim 1, characterized in that: The service availability detection module simulates failures and attacks on the execution body to evaluate the business continuity and service correctness of the execution body under various abnormal situations, and feeds back the evaluation results to the comprehensive analysis and report generation module.

7. The mimic completeness measurement system according to claim 1, characterized in that: The key point integrity analysis module is used to conduct a comprehensive analysis based on the overall business information and key point information of the mimetic defense collected by the user interaction module, evaluate whether the protection scope of the mimetic defense system to be tested covers all core key modules of the business system, and analyze the potential risks of uncovered modules.

8. A method for measuring mimic completeness, characterized in that: include: A user input interface is provided in the form of a form for collecting information of the mimicry defense system to be tested; the collected information includes any one of the following information or a combination of multiple information: deployment information of each component, network topology information, business access portal, business function list, mimicry defense function list, etc.; According to the deployment information of each component collected by the user interaction module, the proxy component for testing is automatically distributed to each component; the proxy component has built-in network isolation detection module, execution body heterogeneity detection module, mimetic bracket security detection module, service availability detection module, and key integrity analysis module required for testing; Generate a test plan and test instructions based on the collected information of the mimetic defense system to be tested, and send the test instructions to the agent components on each node of the mimetic application system to be tested, so that the agent components can start to execute various test operations after receiving the test instructions; generate a corresponding mimetic completeness report based on the information sent by each test module in the agent component of the agent deployment module and the results of the key integrity analysis.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for measuring the mimic completeness of claim 8 is implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the mimic completeness measurement method according to claim 8.

Images