Mimicry judgment method and device based on Bayesian probability

Abstract

The invention provides a mimicry judgment method and device based on Bayesian probability, and belongs to the technical field of endogenous safety mimicry judgment, and the method comprises the steps: obtaining a current output result outputted by each heterogeneous execution body of a mimicry defense system in a current voting period, and determining a corresponding current voting type; if the current voting type represents that the number of the consistent output results reaches a preset value, taking the consistent output results as mimicry judgment results, otherwise, screening according to the current voting type to obtain a first execution body and a second execution body with the maximum Bayesian probability; the current output result is evaluated according to the output results of the first execution body and the second execution body, and if the evaluation is passed, a mimicry judgment result is obtained according to the current output result. The current voting type is taken as a consideration factor, the error is small, the method can adapt to a new environment, the current output result is evaluated through the output results of the first execution body and the second execution body, a wrong voting result is prevented from being output, and the accuracy of mimicry judgment result output is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of endogeneous security mimicry adjudication, and particularly to a mimicry adjudication method and device based on Bayesian probability. Background Art

[0002] The endogeneous security mechanism refers to a non-specific immune mechanism inherent in the system, which can naturally resist various network threats and security attacks, thereby providing a general defense ability. The mimicry defense technology effectively solves the endogeneous security problem, effectively defends classic network attacks based on internal vulnerabilities and backdoors of software and hardware, such as vulnerability exploitation, backdoor setting, virus planting, and trojan hiding, strongly inhibits or controls definite or indefinite risks, known or unknown security threats, and focuses on solving the security protection problem of the system itself. The mimicry defense technology belongs to the category of endogeneous security and is a network space security technology application based on the endogeneous security mechanism.

[0003] Existing mimicry defense technologies usually adopt a Dynamical Heterogeneous Redundant (DHR) architecture, which can sense generalized uncertain perturbations, use dynamic, random, and diverse executors for dynamically equivalent switching of functions, realize an uncertain, heterogeneous, and non-persistent mimicry environment, and determine whether the target system has been attacked by detecting the consistency between the executors. Therefore, the strategy of voting on the consistency of executors in the mimicry architecture is crucial.

[0004] Existing voting strategies mainly calculate the executor credibility by counting the number of times the executor passes the vote during the voting cycle, and use it as a consideration factor for selecting the executor for the next stage of voting, in order to avoid the randomness of voting. However, taking the number of times an event occurs within a certain period of time as the probability of the event occurring has a large error, and has the disadvantages of large error and inability to adapt to the new environment in measuring the executor credibility. Moreover, when making mimicry adjudication, the impact of the current voting result on the mimicry defense system is omitted, thereby affecting the accuracy of the output of the mimicry adjudication result. Summary of the Invention

[0005] The present invention provides a mimicry adjudication method and device based on Bayesian probability, which can effectively improve the accuracy of the mimicry adjudicator's voting.

[0006] The present invention provides a mimicry adjudication method based on Bayesian probability, including: Obtaining the current output results of each executor of the mimicry defense system in the current voting cycle, and determining the current voting type corresponding to the current output results, where the current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle, and the executor is a heterogeneous executor; If the number of consistent output results represented by the current voting type reaches a preset value, the consistent output results are used as the mimicry adjudication result; Otherwise, according to the current voting type, the first executor with the largest Bayesian probability is selected from the first posterior probability matrix of each executor in good operating condition determined in advance, and the second executor with the largest Bayesian probability is selected from the second posterior probability matrix of each executor in the case of being breached by a network attack; the current output result is evaluated according to the output result of the first executor and the output result of the second executor, and if the evaluation passes, the mimicry adjudication result is obtained according to the current output result.

[0007] According to a mimicry adjudication method based on Bayesian probability provided by the present invention, the evaluating the current output result according to the output result of the first executor and the output result of the second executor, and if the evaluation passes, obtaining the mimicry adjudication result according to the current output result includes: Determining whether the most numerous consistent output results in the current output result are the same as the output result of the first executor and different from the output result of the second executor; If so, it is determined that the evaluation passes, and the most numerous consistent output results in the current output result are used as the mimicry adjudication result.

[0008] According to a mimicry adjudication method based on Bayesian probability provided by the present invention, it further includes: If the evaluation fails, control each executor to vote again, return to the step of obtaining the current output result output by each executor of the mimicry defense system in the current voting cycle, and determine the current voting type corresponding to the current output result, until the number of times of passing or failing the evaluation reaches a preset value, and an alarm is issued.

[0009] According to a mimicry adjudication method based on Bayesian probability provided by the present invention, the steps of determining the first posterior probability matrix and the second posterior probability matrix include: Obtain a voting data set within a preset voting cycle range, where the voting data set includes a class attribute set determined by the executor and a conditional attribute set determined by the voting type; According to the voting data set and the Bayesian probability algorithm, determine the first posterior probability matrix of each executor in good operating condition and the second posterior probability matrix of each executor in the case of being breached by a network attack; or, according to the voting data set, determine the first posterior probability matrix of each executor in good operating condition and the second posterior probability matrix of each executor in the case of being breached by a network attack.

[0010] A mimicry adjudication method based on Bayesian probability provided by the present invention, the Bayesian model corresponding to the Bayesian probability algorithm includes an executor as the parent node and several voting types as the child nodes. Any child nodes are independent of each other. The directed edges of the Bayesian model represent that the output result of the executor belongs to the voting type corresponding to any child node, and the value of the directed edge represents the probability that the executor is in the voting type corresponding to the mimicry adjudication result.

[0011] A mimicry adjudication method based on Bayesian probability provided by the present invention, according to the voting data set and the Bayesian probability algorithm, determining the first posterior probability matrix of each executor in a good operating condition and the second posterior probability matrix of each executor in a condition of being broken through by a network attack, includes: According to the Bayesian model, determining the prior probability expression of the executor's defense against network attacks and the conditional probability expression of the voting type; According to the prior probability expression of the executor's defense against network attacks and the conditional probability expression of the voting type, determining the first posterior probability expression of the executor in a good operating condition and the second posterior probability expression of the executor in a condition of being broken through by a network attack; According to the samples in the voting data set and the first posterior probability expression, obtaining the first posterior probability matrix of each executor in a good operating condition, and according to the samples in the voting data set and the second posterior probability expression, obtaining the second posterior probability matrix of each executor in a condition of being broken through by a network attack.

[0012] A mimicry adjudication method based on Bayesian probability provided by the present invention, according to the voting data set, determining the first posterior probability matrix of each executor in a good operating condition and the second posterior probability matrix of each executor in a condition of being broken through by a network attack, includes: According to the number of occurrences of each voting type in the voting data set, determining the occurrence probability of each voting type; According to the voting data set, determining the voting types and the number of occurrences of each executor in a good operating condition to obtain the conditional probability of each executor in a good operating condition; According to the voting data set, determining the voting types and the number of occurrences of each executor in a condition of being broken through by a network attack to obtain the conditional probability of each executor in a condition of being broken through by a network attack; According to the occurrence probability of each voting type and the conditional probability of each executor in a good operating condition, determining the first posterior probability matrix of each executor in a good operating condition; According to the occurrence probability of each voting type and the conditional probability of each executor in a condition of being broken through by a network attack, determining the second posterior probability matrix of each executor in a condition of being broken through by a network attack.

[0013] The present invention also provides a mimicry adjudication device based on Bayesian probability, including: A determination module, configured to obtain the current output results output by each executor of the mimicry defense system in the current voting cycle, and determine the current voting type corresponding to the current output results, where the current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle, and the executor is a heterogeneous executor; An adjudication module, configured to, if the number of consistent output results characterized by the current voting type reaches a preset value, use the consistent output results as the mimicry adjudication results; otherwise, screen the first posterior probability matrix of each executor in good operating condition determined in advance according to the current voting type to obtain the first executor with the largest Bayesian probability, and screen the second posterior probability matrix of each executor in the case of being breached by a network attack determined in advance to obtain the second executor with the largest Bayesian probability; evaluate the current output results according to the output results of the first executor and the output results of the second executor, and if the evaluation passes, obtain the mimicry adjudication results according to the current output results.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where when the processor executes the computer program, the mimicry adjudication method based on Bayesian probability as described in any one of the above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the mimicry adjudication method based on Bayesian probability as described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the mimicry adjudication method based on Bayesian probability as described in any one of the above is implemented.

[0017] The mimicry adjudication method and device based on Bayesian probability provided by the present invention take the current voting type corresponding to the current output results of each executor as a consideration factor, have small errors, can adapt to a new environment, and take into account the current output results. By evaluating the current output results through the output results of the first executor and the second executor respectively, incorrect voting results can be avoided, and the accuracy of the output of the mimicry adjudication results is improved. Description of the Drawings

[0018] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0019] Figure 1 It is one of the schematic flowcharts of the mimicry adjudication method based on Bayesian probability provided by the present invention.

[0020] Figure 2 It is the schematic structural diagram of the Bayesian model provided by the present invention.

[0021] Figure 3 It is the second schematic flowchart of the mimicry adjudication method based on Bayesian probability provided by the present invention.

[0022] Figure 4 It is the schematic structural diagram of the mimicry adjudication device based on Bayesian probability provided by the present invention.

[0023] Figure 5 It is the schematic structural diagram of the electronic device provided by the present invention. Specific embodiments

[0024] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention with reference to the drawings in the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts based on the embodiments in the present invention belong to the scope of protection of the present invention.

[0025] Figure 1 It is one of the schematic flowcharts of the mimicry adjudication method based on Bayesian probability provided by the present invention. As Figure 1 shown, the present invention provides a mimicry adjudication method based on Bayesian probability, including the following steps.

[0026] Step S100: Obtain the current output results of each executor in the mimicry defense system in the current voting cycle, and determine the current voting type corresponding to the current output results. The current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle. The executors in the mimicry defense system are heterogeneous executors.

[0027] Step S200: If the number of consistent output results characterized by the current voting type reaches a preset value, use the consistent output results as the mimicry adjudication results; Step S300. Otherwise, according to the current voting type, screen the first posterior probability matrix of each predetermined executor in a good operating condition to obtain the first executor with the largest Bayesian probability, and screen the second posterior probability matrix of each predetermined executor in a situation of being breached by a cyber-attack to obtain the second executor with the largest Bayesian probability; evaluate the current output result according to the output result of the first executor and the output result of the second executor, and if the evaluation passes, obtain a mimicry adjudication result according to the current output result.

[0028] It can be understood that the present invention takes the current voting type corresponding to the current output result of each executor as a consideration factor, with small error, can adapt to a new environment, and takes into account the current output result. By evaluating the current output result through the respective output results of the first executor and the second executor, incorrect voting results can be avoided, and the accuracy of the output of the mimicry adjudication result is improved.

[0029] Based on the above embodiments, as an optional embodiment, the steps for determining the first posterior probability matrix and the second posterior probability matrix include: Obtain a voting data set within a preset voting period range, where the voting data set includes a class attribute set determined by an executor and a conditional attribute set determined by a voting type; According to the voting data set and the Bayesian probability algorithm, determine the first posterior probability matrix of each executor in a good operating condition and the second posterior probability matrix of each executor in a situation of being breached by a cyber-attack; or, according to the voting data set, determine the first posterior probability matrix of each executor in a good operating condition and the second posterior probability matrix of each executor in a situation of being breached by a cyber-attack.

[0030] Among them, the voting data set can be expressed as , the class attribute set can be expressed as , where the class attribute set is also the executor set in the mimicry defense system, represents an executor, is the number of executors, represents the n th executor. The conditional attribute set can be expressed as , is the number of conditional attribute variables, represents the j th voting type, and the conditional attribute set has a total of voting types.

[0031] The output result set of the executor can be expressed as , represents the state of the i th executor, and the value can be 1 or 0. For The redundant mimic defense system has a total of types of voting, and the calculated result is . For example, if the mimic defense system has 5 executors, there are 5 major categories of voting types. In each major category, due to differences in executors, it can be further divided into 27 sub-categories. The major category situations are 5 / 0 (the maximum number of approvals is 5, that is, the output results of 5 executors are the same), 4 / 1 (the maximum number of approvals is 4, that is, the output results of 4 executors are the same, and the output result of 1 executor is different from the results of the other 4 executors), 3 / 2 (the maximum number of approvals is 3, that is, the output results of 3 executors are the same, the output results of 2 executors are the same, and are different from the results of the other 3 executors), 2 / 2 / 1 (the maximum number of approvals is 2, where the output results of 2 executors are the same, the output results of the other 2 executors are the same, and are different from the output results of the previous 2 executors, and the output result of the last 1 executor is different from the output results of other executors), 1 / 1 / 1 / 1 / 1 (the maximum number of approvals is 1, and the output results of 5 executors are all different from each other). Specifically, in the current mimic adjudication process, identify the current voting result. According to the voting type, when the maximum number of approvals has an absolute advantage, that is, the difference between the maximum number of approvals and the second maximum number of approvals is at least greater than 2, directly output the voting result; when the maximum number of approvals has a slight advantage, that is, the difference between the maximum number of approvals and the second maximum number of approvals is less than 2. For example, for the voting types with a slight advantage in the number of approvals, the difference between the maximum number of approvals and other numbers of approvals is relatively small, which are voting type (the maximum number of approvals is 3, and the second maximum number of approvals is 2), voting type (the maximum number of approvals is 2, and there are 2), voting type (the maximum number of approvals is 2, and there is only one).

[0032] Let the number of voting cycles be , then the voting data set within the preset voting cycle range is determined based on the voting data of the previous voting cycles before the current voting cycle. In each voting cycle, record the mimic adjudication result and the specific voting type information to obtain the mimic adjudication result set , and the corresponding voting type information set is . is the number of samples, that is, the number of voting cycles in the training set. is the mimic adjudication result of the i th voting cycle, and its value range is , 1 indicates that the mimic adjudication result is correct, and 0 indicates that the mimic adjudication result is incorrect. is the voting type, and its value range is .

[0033] It can be understood that the voting types are proposed according to the consistency of the output results of the execution entities. As long as the number of execution entities is fixed and the number and range of voting types are fixed, the reputation degree of the execution entities calculated based on the voting types will not be affected by the environment.

[0034] Figure 2 is a schematic structural diagram of the Bayesian model provided by the present invention. As Figure 2 shown, on the basis of the above embodiments, as an optional embodiment, the Bayesian model corresponding to the Bayesian probability algorithm includes an execution entity as the parent node and several voting types as the child nodes. Any child nodes are independent of each other. The directed edges of the Bayesian model indicate that the output result of the execution entity belongs to any voting type corresponding to the child node, and the value of the directed edge represents the probability that the execution entity is in the voting type corresponding to the mimicry adjudication result.

[0035] It can be understood that the present invention improves the Bayesian model in the Bayesian probability algorithm by using voting types, enhances the stability of the Bayesian model by using the stability of voting types, and at the same time, associates the voting types with the posterior probability by using the Bayesian model, making the voting types become the consideration factors for measuring the reputation degree of execution entities and reducing the reputation degree error.

[0036] On the basis of the above embodiments, as an optional embodiment, determining the first posterior probability matrix of each execution entity in good operating condition and the second posterior probability matrix of being breached by a cyber attack according to the voting data set and the Bayesian probability algorithm includes steps S011 - S013.

[0037] Step S011: According to the Bayesian model corresponding to the Bayesian probability algorithm, determine the prior probability expression for the execution entity to defend against cyber attacks and the conditional probability expression for the voting type.

[0038] Figure 2 In which E represents the execution entity, as the parent node; represents the voting type, as the child node; the directed edge indicates that the output result of the execution entity belongs to the corresponding voting type, and the value of the directed edge is the arrival probability, that is, when the mimicry adjudication result of the mimicry defense system is a certain voting type, the probability that the E execution entity is in its voting type.

[0039] A certain training sample in the voting data set can be represented by and represents the value of the class attribute variable in the training sample, which is a known value, while represents the value of the conditional attribute variable in the training sample.

[0040] For a certain instance belonging to the class attribute The general expression for the posterior probability is as follows: (1) Where is the regularization factor; is the prior probability of class attribute i.e., the prior probability expression for the executor to defend against network attacks; is the conditional probability of class attribute i.e., the conditional probability expression of the voting type, represents the prior probability of conditional attribute

[0041] Step S012: Determine the first posterior probability expression for the executor in a good operating condition and the second posterior probability expression for the case where the executor has been breached by a network attack according to the prior probability expression for the executor to defend against network attacks and the conditional probability expression of the voting type.

[0042] In the voting data training set, select the voting type as the conditional attribute and the executor as the class attribute. Use to represent the probability that the credibility of the executor is 1, i.e., the probability of maintaining a good state without being breached by a network attack during the system operation. Use to represent the probability that the credibility of the executor is 0, i.e., the probability that the executor has been breached, which represents the security performance of the executor from the opposite side of the executor's credibility. When the executor is in a breached state, it represents the probability that the system has been breached by a network attack during the system operation. The credibility probability of the executor can be obtained from the prior initial value by combining the structural composition analysis of the executor. Its value quantifies the reliability of the executor, is affected by the executor itself, and is related to the defense ability of the executor. The higher the defense completeness, the more difficult it is for the executor to be attacked and breached by itself, and the greater the prior probability of the executor's credibility.

[0043] According to formula (1), when the conditional attribute the voting type occurs, the posterior probability that the credibility of the executor is 1, i.e., the first posterior probability expression, is as follows: (2) Where is the th voting type of the system, represents the probability that the credibility of the executor is equal to 1, i.e., the executor is in a good operating condition, and the system votes out ; represents that without conditional restrictions, the system votes out​ probability.

[0044] According to formula (1), under the condition of the conditional attribute when the voting type occurs, the execution body The credibility is equal to 0, that is, the posterior probability that the execution body is compromised That is, the second posterior probability expression is as follows: (3) where is the th voting type of the system, represents the execution body is in the situation of being compromised by a network attack, and the system votes out probability.

[0045] Step S013: According to the samples in the voting dataset and the first posterior probability expression, obtain the first posterior probability matrix of each execution body in a good operating condition. According to the samples in the voting dataset and the second posterior probability expression, obtain the second posterior probability matrix of each execution body in the situation of being compromised by a network attack.

[0046] Substitute the samples in the voting dataset into the first posterior probability expression respectively to obtain the first posterior probability matrix of each execution body in a good operating condition, that is, calculate the first posterior probability matrix of the execution body with a credibility of 1, that is, in a good operating condition, according to formula (2) as follows: where each row element of the first posterior probability matrix is the probability of different execution bodies in good operating condition under the same voting type. For example represents the probability that the first execution body is in good operating condition under the first voting type, and so on. When obtaining the voting type of the current output result, the row elements corresponding to this voting type can be retrieved to obtain the maximum value and the corresponding execution body number.

[0047] Substitute the samples in the voting dataset into the second posterior probability expression respectively to obtain the second posterior probability matrix of each execution body in the situation of being compromised by a network attack, that is, calculate the second posterior probability matrix of the execution body with a credibility of 0, that is, being compromised, according to formula (3) as follows: where each row element of the second posterior probability matrix is the probability of different execution bodies being compromised under the same voting type. For example It represents the probability that the first executor is compromised by a cyber-attack under the first voting type, and so on. When obtaining the voting type of the current output result, the row elements corresponding to this voting type can be retrieved to obtain the maximum value and the corresponding executor number.

[0048] It can be understood that the present invention constructs the first posterior probability matrix and the second posterior probability matrix based on the Bayesian probability algorithm and the voting type, that is, the reputation matrix of the executor running well and the reputation matrix of being compromised by a cyber-attack. Compared with measuring the reputation of the executor by the probability of the event occurring, the reputation of the executor is further refined according to the data feature of the voting type, which has the advantages of small error and easy adaptation to the new environment.

[0049] Based on the above embodiments, as an optional embodiment, determining the first posterior probability matrix of each executor in a good running condition and the second posterior probability matrix of being compromised by a cyber-attack according to the voting data set includes steps S021 - S023.

[0050] Step S021: Determine the occurrence probability of each voting type according to the number of occurrences of each voting type in the voting data set.

[0051] Perform row normalization processing on the data in the voting data set, and count the number of occurrences of each voting type , assuming the number of voting cycles is , then the probability of occurrence of each voting type can be quantified to obtain a set of probability values , where , , .

[0052] Step S022: Determine the voting types and the number of occurrences of each executor in a good running condition according to the voting data set to obtain the conditional probability of each executor in a good running condition.

[0053] Count the voting types and their number of occurrences when each executor maintains a good running state, and calculate the conditional probability with a reputation of 1 according to the number of voting cycles .

[0054] Step S023: Determine the voting types and the number of occurrences of each executor in the case of being compromised by a cyber-attack according to the voting data set to obtain the conditional probability of each executor in the case of being compromised by a cyber-attack.

[0055] Count the voting types and their number of occurrences when each executor is compromised by a cyber-attack to obtain the conditional probability with a reputation of 0 . It should be noted that the execution order of step S022 and step S023 can be adjusted.

[0056] Step S024: Determine the first posterior probability matrix of each execution entity being in good operating condition according to the occurrence probability of each voting type and the conditional probability of each execution entity being in good operating condition.

[0057] Step S025: Determine the second posterior probability matrix of each execution entity being breached by a cyber attack according to the occurrence probability of each voting type and the conditional probability of each execution entity being breached by a cyber attack.

[0058] Analyze the self-defense ability and operation data of the execution entity to obtain the probability of the defense ability of the execution entity, that is, the prior probability with a credibility of 1 , substituting it into formula (2) can obtain the posterior probability with a credibility of 1 when each execution entity appears in different voting types, and form the Bayesian probability matrix with a credibility of 1, that is, the first posterior probability matrix. Similarly, obtain the prior probability with a credibility of 0 , substituting it into formula (3) to obtain the posterior probability with a credibility of 0, and form the Bayesian probability matrix with a credibility of 0, that is, the second posterior probability matrix. It should be noted that the execution order of step S224 and step S225 can be adjusted.

[0059] It can be understood that in the embodiment of the present invention, first determine the occurrence probability of each voting type according to the number of occurrences of the voting type to reduce the calculation amount, and then calculate the posterior probability matrix in combination with the conditional probability of the execution entity. Since the voting type can adapt to different environments, it can reduce the calculation amount and reduce the error at the same time.

[0060] Based on the above embodiment, as an optional embodiment, the evaluating the current output result according to the output result of the first execution entity and the output result of the second execution entity, and if the evaluation passes, obtaining the mimicry adjudication result according to the current output result, includes: Determine whether the most numerous consistent output results in the current output result are the same as the output result of the first execution entity and different from the output result of the second execution entity; If so, determine that the evaluation passes, and use the most numerous consistent output results in the current output result as the mimicry adjudication result.

[0061] If the voting type of the current output result is , retrieve the first posterior probability matrix with a credibility of 1, select the execution entity A corresponding to the maximum Bayesian probability, that is, the first execution entity, retrieve the second posterior probability matrix with a credibility of 0, and select the execution entity B corresponding to the maximum Bayesian probability, that is, the second execution entity.

[0062] When the operation execution result of execution body A is consistent with the output result with the largest quantity in the current output result, and is different from the operation execution result of execution body B, the output result with the largest quantity in the current output result is used as the correct result for output.

[0063] It can be understood that the present invention selects the execution body corresponding to the maximum value of Bayesian probability to evaluate the current output result, which is beneficial to improving the evaluation accuracy. In addition, selecting the execution body to perform positive evaluation and negative evaluation on the current output result in different situations further improves the evaluation accuracy, thereby increasing the correct rate of the mimicry adjudication result output.

[0064] Figure 3 It is the second flowchart of the mimicry adjudication method based on Bayesian probability provided by the present invention. As Figure 3 shown, a mimicry adjudication method based on Bayesian probability provided by the present invention further includes step S400.

[0065] Step S400, if the evaluation fails, control each execution body to vote again, return to the step of obtaining the current output results output by each execution body of the mimicry defense system in the current voting cycle, and determine the current voting type corresponding to the current output results, until the evaluation passes or the number of times of failed evaluation reaches a preset value, and an alarm is issued.

[0066] The technical effects of the present invention will be illustrated by examples in combination with simulations below.

[0067] Under the condition that the probability of each execution body outputting abnormal data under network attacks in the experiment follows a normal distribution, an output data set of all execution bodies is constructed. Specifically, the test data of the CSE-CIC-IDS2017 data set is used as the normal data and abnormal data of the simulation data set, and a dynamic heterogeneous redundancy system is constructed according to the data set. The output data set of 5 execution bodies in one cycle is . When all execution bodies are not under network attacks, in the same execution cycle, the output results of all execution bodies are normal values. Five copies of the normal data in the CSE-CIC-IDS2017 data set are copied and used as the normal output results of the execution bodies respectively.

[0068] There are 7 types of abnormal data in the data set, which are used as the abnormal outputs of 5 execution bodies when suffering from 7 different network attacks. The execution bodies are heterogeneous, and the output results in each execution cycle are independent of other execution bodies and are mutually independent. According to the mean , variance normal distribution to generate abnormal data traffic proportion matrix, and randomly mix the normal data and abnormal data of each execution body, and finally generate the simulation system data set shown in Table 1.

[0069] Execution body output data set of Table 1

[0070] According to the data quantity distribution in Table 1, after randomly scrambling the abnormal data and normal data, the execution output sequences of 5 execution bodies are respectively constructed , is a function of the time period, is the system operation period, and the simulation system has 155,008 execution cycles, that is, the total data quantity of each execution body. In one execution cycle, the operation data set of the system is output from the data sequences of their respective execution bodies in the order of the time period , and the output data of 5 execution bodies enter the mimicry arbiter for voting. According to the proportion of abnormal data in their respective total data quantities, the prior probabilities that the 5 execution bodies cannot be breached can be obtained as .

[0071] According to the majority consistency voting algorithm, the data results of 5 execution bodies enter the mimicry arbiter for voting, and the result with the most approvals wins, and the system outputs the winning result. When there are multiple maximum approval numbers, one of the results is randomly selected for output. When the output results of 5 execution bodies are inconsistent with each other, no result is output. The simulation results are obtained. The correct rate of passing the vote is 97.86%, the error rate of passing the vote is 2.14%, the probability of the correct result passing the vote is 97.90%, the probability of the correct result not passing the vote is 2.10%, the probability of the wrong result passing the vote is 3.02%, and the probability of the wrong result not passing the vote is 96.98%.

[0072] The voting algorithm is optimized by using the Bayesian probability setting selection strategy of the execution body credibility. Using the sample data as the training set, the Bayesian probability matrix about the execution body is obtained through analysis and statistics. Identify the current voting result. According to the voting type, when the maximum approval number has an absolute advantage, that is, the difference between the maximum approval number and the second maximum approval number is at least greater than 2, the voting result is directly output; when the maximum approval number has a slight advantage, that is, the difference between the maximum approval number and the second maximum approval number is less than 2, the Bayesian probability matrix is retrieved to obtain the execution body with the highest probability of credibility of 1 and the execution body with the highest probability of credibility of 0. If the voting result is consistent with the execution body with the best credibility and is not equal to the execution body with the worst credibility, it is output, otherwise the vote is invalid. The simulation results are obtained. The correct rate of passing the vote is 99.11%, the error rate of passing the vote is 0.89%, the probability of the correct result passing the vote is 94.07%, the probability of the correct result not passing the vote is 5.93%, the probability of the wrong result passing the vote is 1.19%, and the probability of the wrong result not passing the vote is 98.81%.

[0073] In summary, compared with the majority consensus voting algorithm, the correct rate of the voting passed by the present invention has increased by 1.25%, and the security of the mimicry adjudication output data has been significantly improved; the non-passing rate of the wrong results has increased by 1.83%, indicating that the present invention can distinguish abnormal data and reduce the probability of abnormal data passing the vote. The comparative experiment results show that the present invention can improve the security and reliability of the mimicry defense system.

[0074] Next, the mimicry adjudication device based on Bayesian probability provided by the present invention will be described. The mimicry adjudication device based on Bayesian probability described below can be mutually corresponding and referred to the mimicry adjudication method based on Bayesian probability described above.

[0075] Figure 4 is a schematic structural diagram of the mimicry adjudication device based on Bayesian probability provided by the present invention. As Figure 4 shown, the present invention also provides a mimicry adjudication device based on Bayesian probability, including the following modules.

[0076] A determination module 410, configured to obtain the current output results of each executor of the mimicry defense system in the current voting cycle, and determine the current voting type corresponding to the current output results, where the current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle, and the executor is a heterogeneous executor; An adjudication module 420, configured to, if the number of consistent output results characterized by the current voting type reaches a preset value, use the consistent output results as the mimicry adjudication results; otherwise, screen the first posterior probability matrix of each executor in a good operating condition determined in advance according to the current voting type to obtain the first executor with the largest Bayesian probability, and screen the second posterior probability matrix of each executor in a situation of being broken by a network attack determined in advance to obtain the second executor with the largest Bayesian probability; evaluate the current output results according to the output results of the first executor and the output results of the second executor, and if the evaluation passes, obtain the mimicry adjudication results according to the current output results.

[0077] As an embodiment, the adjudication module 420 is further configured to: Determine whether the most numerous consistent output results in the current output results are the same as the output results of the first executor and different from the output results of the second executor; If so, determine that the evaluation passes, and use the most numerous consistent output results in the current output results as the mimicry adjudication results.

[0078] As an embodiment, the adjudication module 420 is further configured to: If the evaluation fails, control each executor to vote again, return the current output results output by each executor of the mimic defense system during the current voting cycle, and determine the step of the current voting type corresponding to the current output results, until the evaluation passes or the number of times of failed evaluation reaches the preset value, and issue an alarm.

[0079] As an embodiment, the determining module 410 is further configured to: Obtain a voting data set within a preset voting cycle range, where the voting data set includes a class attribute set determined by an executor and a conditional attribute set determined by a voting type; According to the voting data set and the Bayesian probability algorithm, determine a first posterior probability matrix of each executor in a good operating condition and a second posterior probability matrix of each executor in a situation of being breached by a cyber attack; or, according to the voting data set, determine a first posterior probability matrix of each executor in a good operating condition and a second posterior probability matrix of each executor in a situation of being breached by a cyber attack.

[0080] As an embodiment, the Bayesian model corresponding to the Bayesian probability algorithm includes an executor as a parent node and several voting types as child nodes. Any two child nodes are independent of each other. The directed edges of the Bayesian model represent that the output result of the executor belongs to the voting type corresponding to any child node, and the value of the directed edge represents the probability that the executor is in the voting type corresponding to the mimic adjudication result.

[0081] As an embodiment, the determining module 410 is further configured to: According to the Bayesian model, determine a prior probability expression for the executor to defend against cyber attacks and a conditional probability expression for the voting type; According to the prior probability expression for the executor to defend against cyber attacks and the conditional probability expression for the voting type, determine a first posterior probability expression for the executor in a good operating condition and a second posterior probability expression for the executor in a situation of being breached by a cyber attack; According to the samples in the voting data set and the first posterior probability expression, obtain a first posterior probability matrix of each executor in a good operating condition, and according to the samples in the voting data set and the second posterior probability expression, obtain a second posterior probability matrix of each executor in a situation of being breached by a cyber attack.

[0082] As an embodiment, the determining module 410 is further configured to: According to the number of occurrences of each voting type in the voting data set, determine the occurrence probability of each voting type; According to the voting data set, determine the voting types and the number of occurrences of each executor in a good operating condition to obtain the conditional probability of each executor in a good operating condition; Based on the voting data set, determine the voting types and the number of occurrences of the compromised situation due to cyber attacks for each executor to obtain the conditional probability of each executor being in the compromised situation due to cyber attacks; Based on the occurrence probabilities of each voting type and the conditional probabilities of each executor being in a good operating condition, determine the first posterior probability matrix of each executor being in a good operating condition; Based on the occurrence probabilities of each voting type and the conditional probabilities of each executor being in the compromised situation due to cyber attacks, determine the second posterior probability matrix of each executor being in the compromised situation due to cyber attacks.

[0083] The mimicry adjudication device based on Bayesian probability provided by the present invention is used to execute the mimicry adjudication method based on Bayesian probability described in any of the above embodiments, and has the corresponding technical effects as the mimicry adjudication method based on Bayesian probability, which will not be elaborated here.

[0084] Figure 5 An example of the physical structure diagram of an electronic device is shown as Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540. Among them, the processor 510, the communication interface 520, and the memory 530 complete communication with each other through the communication bus 540. The processor 510 can call the logical instructions in the memory 530 to execute the mimicry adjudication method based on Bayesian probability, and the method includes: obtaining the current output results output by each executor of the mimicry defense system in the current voting cycle, determining the current voting type corresponding to the current output results, where the current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle, and the executor is a heterogeneous executor; if the number of consistent output results characterized by the current voting type reaches a preset value, use the consistent output results as the mimicry adjudication result, otherwise, based on the current voting type, screen the first posterior probability matrix of each executor being in a good operating condition determined in advance to obtain the first executor with the largest Bayesian probability, and screen the second posterior probability matrix of each executor being in the compromised situation due to cyber attacks determined in advance to obtain the second executor with the largest Bayesian probability; evaluate the current output results based on the output results of the first executor and the output results of the second executor, and if the evaluation passes, obtain the mimicry adjudication result based on the current output results.

[0085] In addition, when the logical instructions in the above-mentioned memory 530 can be implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs.

[0086] On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the mimicry adjudication method based on Bayesian probability provided by the above-mentioned various methods. The method includes: obtaining the current output results output by each executor of the mimicry defense system in the current voting cycle, determining the current voting type corresponding to the current output results, where the current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle, and the executors are heterogeneous executors; if the number of consistent output results characterized by the current voting type reaches a preset value, using the consistent output results as the mimicry adjudication results, otherwise, screening the first posterior probability matrix of each executor in a good operating condition determined in advance according to the current voting type to obtain the first executor with the largest Bayesian probability, and screening the second posterior probability matrix of each executor in a situation of being breached by a network attack determined in advance to obtain the second executor with the largest Bayesian probability; evaluating the current output results according to the output results of the first executor and the output results of the second executor, and if the evaluation passes, obtaining the mimicry adjudication results according to the current output results.

[0087] In another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the mimicry adjudication method based on Bayesian probability provided by the above-mentioned various methods. The method includes: obtaining the current output results output by each executor of the mimicry defense system in the current voting cycle, determining the current voting type corresponding to the current output results, where the current voting type is used to characterize the consistency of the output results of each executor in the current voting cycle, and the executor is a heterogeneous executor; if the number of consistent output results characterized by the current voting type reaches a preset value, the consistent output results are used as the mimicry adjudication results, otherwise, according to the current voting type, the first posterior probability matrix of each executor in good operating condition determined in advance is screened to obtain the first executor with the largest Bayesian probability, and the second posterior probability matrix of each executor in the case of being breached by a network attack determined in advance is screened to obtain the second executor with the largest Bayesian probability; evaluating the current output results according to the output results of the first executor and the output results of the second executor, and if the evaluation passes, obtaining the mimicry adjudication results according to the current output results.

[0088] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0089] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A Bayesian probability-based mimetic decision method, characterized in that: include: Obtaining the current output results of each executive body of the mimic defense system in the current voting cycle, determining the current voting type corresponding to the current output result, wherein the current voting type is used to characterize the consistency of the output results of each executive body in the current voting cycle, and the executive body is a heterogeneous executive body; If the number of output results that are consistent with the current voting type reaches a preset value, the consistent output results are used as the mimicry decision results; Otherwise, according to the current voting type, the first posterior probability matrix of each predetermined executable body in a good running condition is screened to obtain the first executable body with the largest Bayesian probability, and the second posterior probability matrix of each predetermined executable body in a condition of being breached by a network attack is screened to obtain the second executable body with the largest Bayesian probability; The current output result is evaluated according to the output result of the first execution body and the output result of the second execution body, and if the evaluation passes, a mimicry decision result is obtained according to the current output result.

2. The Bayesian probability-based mimetic decision method according to claim 1, characterized in that: The step of evaluating the current output result according to the output result of the first execution body and the output result of the second execution body, if the evaluation obtains a mimicry decision result according to the current output result, includes: Determine whether the largest number of consistent output results among the current output results is the same as the output result of the first execution body and different from the output result of the second execution body; If so, the evaluation is determined to be passed, and the output result with the largest number of consistent results in the current output results is used as the mimicry decision result.

3. The Bayesian probability-based mimetic decision method according to claim 1 or 2, characterized in that: Also includes: If the evaluation fails, control each execution body to vote again, return to the execution to obtain the current output results output by each execution body of the mimicry defense system in the current voting cycle, and determine the current voting type corresponding to the current output result, until the number of times the evaluation passes or fails reaches a preset value, an alarm is issued.

4. The Bayesian probability-based mimetic decision method according to claim 1, characterized in that: The step of determining the first a posteriori probability matrix and the second a posteriori probability matrix comprises: Acquire a voting data set within a preset voting cycle range, wherein the voting data set includes a class attribute set determined by an execution body and a condition attribute set determined by a voting type; According to the voting data set and the Bayesian probability algorithm, a first a posteriori probability matrix of each executive body being in a good operating condition and a second a posteriori probability matrix of each executive body being compromised by a network attack are determined; or, according to the voting data set, a first a posteriori probability matrix of each executive body being in a good operating condition and a second a posteriori probability matrix of each executive body being compromised by a network attack are determined.

5. The Bayesian probability-based mimetic decision method according to claim 4, characterized in that: The Bayesian model corresponding to the Bayesian probability algorithm includes an executor as a parent node and several voting types as child nodes. Any child nodes are independent of each other. The directed edges of the Bayesian model indicate that the output result of the executor belongs to the voting type corresponding to any child node, and the value of the directed edge indicates the probability that the executor is in the voting type corresponding to the mimetic decision result.

6. The Bayesian probability-based mimetic decision method according to claim 5, characterized in that: Determining, based on the voting data set and the Bayesian probability algorithm, a first a posteriori probability matrix of each executable body being in a good operating condition and a second a posteriori probability matrix of each executable body being in a condition of being breached by a network attack includes: According to the Bayesian model, determine the prior probability expression of the executive body's defense against network attacks and the conditional probability expression of the voting type; According to the prior probability expression of the executive body defending against the network attack and the conditional probability expression of the voting type, determine the first a posteriori probability expression of the executive body being in a good running condition and the second a posteriori probability expression of the executive body being breached by the network attack; According to the samples in the voting data set and the first a posteriori probability expression, a first a posteriori probability matrix is ​​obtained that each executor is in a good operating condition, and according to the samples in the voting data set and the second a posteriori probability expression, a second a posteriori probability matrix is ​​obtained that each executor is in a condition of being compromised by a network attack.

7. The Bayesian probability-based mimetic decision method according to claim 5, characterized in that: Determining, based on the voting data set, a first a posteriori probability matrix of each executable body being in a good operating condition and a second a posteriori probability matrix of each executable body being in a condition of being breached by a network attack includes: Determining the occurrence probability of each voting type according to the number of occurrences of each voting type in the voting data set; According to the voting data set, determining the voting type and number of times each executive body is in a good operating condition to obtain the conditional probability that each executive body is in a good operating condition; According to the voting data set, determining the voting type and number of times each executive body is in a situation where it is breached by a network attack to obtain a conditional probability that each executive body is in a situation where it is breached by a network attack; Determine a first a posteriori probability matrix of each executor being in a good operating condition according to the occurrence probability of each voting type and the conditional probability that each executor is in a good operating condition; According to the occurrence probability of each voting type and the conditional probability that each execution body is in a situation of being breached by the network attack, a second posterior probability matrix of each execution body being in a situation of being breached by the network attack is determined.

8. A mimetic decision device based on Bayesian probability, characterized in that: include: A determination module is used to obtain the current output results output by each executive body of the mimic defense system in the current voting cycle, and determine the current voting type corresponding to the current output result, wherein the current voting type is used to characterize the consistency of the output results of each executive body in the current voting cycle, and the executive body is a heterogeneous executive body; A decision module, configured to use the consistent output results as the mimetic decision results if the number of output results characterized by the current voting type reaches a preset value; otherwise, based on the current voting type, screen the first posterior probability matrix of each predetermined execution body in a good running state to obtain the first execution body with the largest Bayesian probability, and screen the second posterior probability matrix of each predetermined execution body in a state of being breached by a network attack to obtain the second execution body with the largest Bayesian probability; The current output result is evaluated according to the output result of the first execution body and the output result of the second execution body, and if the evaluation passes, a mimicry decision result is obtained according to the current output result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the Bayesian probability-based mimetic decision method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the Bayesian probability-based mimetic decision method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the Bayesian probability-based mimetic decision method according to any one of claims 1 to 7 is implemented.

Images