Mimicry transformation method and device for communication network node
By constructing a multi-layered heterogeneous redundant DA mimicry architecture for the Tor network, collecting consensus information and calculating health status, and dynamically defending against anomalies, the malicious attacks and easy identification of DA nodes in the Tor network are solved, thereby improving the security and stability of the network.
Patent Information
- Application Number
- CN202511209917.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-27
- Publication Date
- 2025-12-12
AI Technical Summary
The directory authority nodes (DA nodes) of the Tor network face problems of malicious attacks and easy identification, resulting in reduced anonymity and security of user communication and poor network stability.
A multi-layered heterogeneous redundant DA mimicry architecture is constructed. By building a sequence of heterogeneous DA execution entities, consensus information is collected, health calculation and dynamic defense are performed, and anomalies are detected and cleaned and reset using a voting mechanism.
It enhances network security and stability, enabling it to better cope with complex and ever-changing network environments and defend against malicious attacks.
Smart Images
Figure CN121125201A_ABST
Abstract
Description
Technical Field
[0001] The embodiments disclosed herein relate to the field of mimicry modification of communication network nodes, and specifically to methods and apparatus for mimicry modification of communication network nodes. Background Technology
[0002] The Tor network, as an important anonymous communication network, effectively protects user privacy by using a series of globally distributed relay nodes to perform multi-layered encryption and routing of user communication traffic. Its Directory Authority (DA) nodes play a crucial role in the network, responsible for collecting, verifying, and distributing information from relay nodes within the Tor network, generating consensus files for Tor clients to download, and determining data transmission paths.
[0003] However, the current DA nodes on the Tor network face numerous security issues. On one hand, attackers can control some DA nodes to launch attacks, creating valid consensus documents containing malicious relays, misleading Tor clients to use malicious relay nodes, and severely compromising the anonymity and security of user communications. For example, attackers can exploit Tor's DA protocol to send different information to different legitimate organizations, thereby creating consensus documents unknown to other legitimate organizations. On the other hand, Tor network traffic has distinct characteristics, making it easily identifiable and blocked by network censors, resulting in poor network stability in practical use. Summary of the Invention
[0004] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.
[0005] Some embodiments of this disclosure provide methods, apparatuses, electronic devices, and computer-readable media for mimicking communication network nodes to address the technical problems mentioned in the background section above.
[0006] In a first aspect, some embodiments of this disclosure provide a method for mimicking the behavior of communication network nodes. The method includes: constructing a sequence of heterogeneous execution entities for network nodes, wherein each heterogeneous execution entity corresponds to an execution entity identifier; collecting consensus information from each heterogeneous execution entity in the sequence to obtain a consensus information set; in response to determining that consensus information in the consensus information set meets a target condition, sending the consensus information to each heterogeneous execution entity; for each consensus information in the consensus information set that meets an abnormal condition, performing the following feedback steps: determining the heterogeneous execution entity corresponding to the consensus information; calculating the health of the heterogeneous execution entity to obtain a health score; in response to determining that the health score is less than or equal to a preset health score, taking the heterogeneous execution entity offline for cleaning and resetting the health of the heterogeneous execution entity.
[0007] Secondly, some embodiments of this disclosure provide a mimicry modification device for communication network nodes. The device includes: a construction unit configured to construct a sequence of heterogeneous execution entities for network nodes, wherein one heterogeneous execution entity corresponds to one execution entity identifier; a collection unit configured to collect consensus information of each heterogeneous execution entity in the sequence of heterogeneous execution entities to obtain a consensus information set; a sending unit configured to send the consensus information to each heterogeneous execution entity in response to determining that consensus information in the consensus information set meets the target conditions; and a feedback unit configured to perform the following feedback steps for each consensus information in the consensus information set that meets the abnormal conditions: determining the heterogeneous execution entity corresponding to the consensus information; calculating the health of the heterogeneous execution entity to obtain a health score; and, in response to determining that the health score is less than or equal to a preset health score, taking the heterogeneous execution entity offline for cleaning and resetting the health of the heterogeneous execution entity.
[0008] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.
[0009] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.
[0010] The various embodiments disclosed above have the following beneficial effects: Through the mimicry modification method for communication network nodes in some embodiments of this disclosure, a multi-layered heterogeneous redundant DA mimicry architecture is constructed, and dynamic defense of DA nodes is achieved. This includes constructing heterogeneous DA execution entities from three layers: DA application software, operating system, and runtime environment; using multi-threaded real-time collection of consensus information such as node fingerprints and bandwidth weights; implementing abnormal result detection and secure output decisions through a voting mechanism; quantifying the DA health status based on indicators such as system resource consumption and signature failure counts; and achieving dynamic defense through historical health assessment and dynamic switching strategies for the execution entity pool. This enhances the security and stability of the network, enabling it to better cope with complex and ever-changing network environments. Attached Figure Description
[0011] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.
[0012] Figure 1 This is a flowchart of some embodiments of the mimicry modification method for communication network nodes according to the present disclosure;
[0013] Figure 2 This is a schematic diagram of the DA heterogeneous execution entity construction method;
[0014] Figure 3 These are schematic diagrams illustrating the structure of some embodiments of the mimicry modification device for communication network nodes according to this disclosure;
[0015] Figure 4 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation
[0016] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.
[0017] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.
[0018] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.
[0019] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".
[0020] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.
[0021] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.
[0022] Figure 1 This is a flow chart 100 of some embodiments of a method for mimicking communication network nodes according to some embodiments of this disclosure. The method for mimicking communication network nodes includes the following steps:
[0023] Step 101: Construct a sequence of heterogeneous execution entities for network nodes.
[0024] In some embodiments, the execution entity (e.g., a computing device) of the mimicry modification method for communication network nodes can construct a sequence of heterogeneous execution entities for network nodes. Each heterogeneous execution entity corresponds to an execution entity identifier. A heterogeneous execution entity for network nodes can refer to a DA (Discrete Asynchronous Execution Entity) heterogeneous execution entity. A communication network node can refer to a DA node.
[0025] For example, a heterogeneous DA execution entity can be constructed from three levels: DA application software, operating system, and runtime environment.
[0026] At the application software level: For core functional modules of DA, such as consensus computation and information verification, multiple implementations with the same functionality are used. The core program of DA is modified in various ways at the source code level, such as adjusting data structure definitions and function names, generating multiple different versions of binary code as heterogeneous executables.
[0027] At the operating system level: Different types and versions of operating systems, such as different Linux distributions (Ubuntu, CentOS, etc.) and Windows Server, are deployed on the DA execution environment. Running DA applications in different operating system environments leverages the differences in system call interfaces and security mechanisms to enhance overall system security.
[0028] At the runtime environment level: A heterogeneous runtime environment is constructed from both runtime resources and environment configuration perspectives. Different types of runtime resources are used, including but not limited to containers, virtual machines, and bare metal servers with different hardware architectures and configurations. The differences in instruction sets and computational performance characteristics between these architectures are leveraged to increase the difficulty for attackers to exploit architectural vulnerabilities. Different runtime parameters are configured, including but not limited to memory allocation strategies and network port configurations. For example, different network ports are bound to different heterogeneous execution entities to prevent port conflicts and increase the difficulty for attackers to launch attacks through port scanning and other methods.
[0029] like Figure 2 The example demonstrates the method for constructing a heterogeneous DA execution entity as follows:
[0030] First, select servers with different hardware architectures, different versions of virtual machines, and containers as the DA execution environment, such as x86 architecture and ARM architecture servers.
[0031] Second, multiple operating systems, such as Ubuntu, CentOS, and Windows Server, are installed in the operating environment, and the corresponding system environments are configured to ensure that different operating systems can achieve resource isolation and collaborative work.
[0032] Third, the source code of the DA application software is modified. Tools such as code obfuscation and code refactoring are used to process the source code of the DA core program, generating multiple versions with different code structures and instruction orders. These versions are then compiled into binary code to serve as the heterogeneous DA executable. For example, code obfuscation tools are used to randomly replace function names and variable names and rearrange the order of code blocks.
[0033] Step 102: Collect consensus information of each heterogeneous execution entity in the heterogeneous execution entity sequence of network nodes to obtain a consensus information set.
[0034] In some embodiments, the aforementioned execution entity can collect consensus information from each heterogeneous execution entity in the network node heterogeneous execution entity sequence to obtain a consensus information set. For example, the execution entity can collect consensus information from each heterogeneous execution entity in the network node through a distributed, multi-threaded input proxy. The consensus information includes information such as fingerprints, node capability flags, bandwidth weights, and egress policies. A fingerprint can represent the fingerprint of a heterogeneous execution entity in a network node. A node capability flag can represent the computational capability of a heterogeneous execution entity in a network node.
[0035] Step 103: In response to determining that consensus information satisfying the target conditions exists in the consensus information set, the consensus information is sent to the heterogeneous execution entities of each network node.
[0036] In some embodiments, the aforementioned executing entity may, in response to determining that consensus information satisfying a target condition exists in the consensus information set, send the consensus information to the heterogeneous executing entities of each network node. The target condition may be: a certain consensus information is supported by more than half of the heterogeneous executing entities of the network nodes. That is, more than half of the heterogeneous executing entities in the sequence of network nodes support the consensus information.
[0037] Step 104: For each consensus message in the consensus information set that satisfies the abnormal condition, perform the following feedback steps:
[0038] Step 1041: Determine the heterogeneous execution entity of the network node corresponding to the consensus information.
[0039] In some embodiments, the aforementioned execution entity can determine the heterogeneous execution entity of the network node corresponding to the consensus information. That is, one consensus information corresponds to one heterogeneous execution entity of the network node.
[0040] Step 1042: Calculate the health of the heterogeneous execution entities of the network nodes to obtain a health score.
[0041] In some embodiments, the aforementioned execution entity can perform health calculations on the heterogeneous execution entities of the network nodes to obtain a health score.
[0042] In practice, the aforementioned execution entity can perform health calculations on the heterogeneous execution entities of the network nodes through the following steps:
[0043] The first step is to normalize the system resource occupancy, abnormal link request frequency, signature failure count, and vote rejection rate corresponding to the heterogeneous execution entities of the network nodes, respectively, to obtain normalized system resource occupancy, normalized abnormal link request frequency, normalized signature failure count, and normalized vote rejection rate.
[0044] For example, the system resource utilization (including memory and CPU), frequency of abnormal connection requests, number of signature failures, and DA vote rejection rate of heterogeneous execution entities of network nodes can be unified to the range of [0,1].
[0045] x` = (x - min) / (max – min), where x is the current value of the indicator (one of system resource occupancy, abnormal link request frequency, signature failure count, and vote rejection rate), min is the historical minimum value of the indicator node under normal circumstances, and max is the historical maximum value of the indicator node under normal circumstances.
[0046] The second step involves calculating dimensional scores for the normalized system resource occupancy rate, normalized abnormal link request frequency, normalized signature failure count, and normalized vote rejection rate, respectively, to obtain system resource occupancy rate score, abnormal link request frequency score, signature failure count score, and vote rejection rate score.
[0047] System resource utilization score calculation: S_R = (r*x) 、 cpu )+((1–r) * x 、 mem ), where x 、 cpu and x 、 mem These are the normalized CPU and memory values, respectively, where r is the weighting coefficient for CPU and memory. * indicates multiplication.
[0048] Calculation of abnormal link request frequency score: S_N = penalty * x 、 req x 、 req The standardized number of abnormal requests per unit time. When the number of abnormal requests per unit time exceeds a certain value, the penalty coefficient is triggered.
[0049] Signature failure count score calculation: S_C = frac * x 、 fail Consecutive signature failures trigger the frac penalty coefficient.
[0050] Vote rejection rate score calculation: S_V = x 、 fail That is, the standardized non-adoption rate is used as the vote non-adoption rate score.
[0051] The third step is to generate a health score based on the system resource occupancy score, abnormal link request frequency score, signature failure count score, and vote rejection rate score.
[0052] A weighted average can be calculated for the scores across all dimensions:
[0053] .
[0054] Among them, w i These are the weights of each dimension, s i It consists of scores for each dimension (system resource occupancy score, abnormal link request frequency score, signature failure count score, and vote rejection rate score).
[0055] Exponential smoothing prevents instantaneous fluctuations from causing state jumps and calculates the final score:
[0056] .
[0057] Among them, HS current It is the weighted average score of each dimension in the current iteration. HS history Calculated based on historical attenuation:
[0058] .
[0059] The health score is incremented from the previous health score to the Tth health score.
[0060] Step 1043: In response to determining that the health score is less than or equal to a preset health score, the heterogeneous execution entity of the network node is taken offline for cleaning, and the health score of the heterogeneous execution entity of the network node is reset.
[0061] In some embodiments, the aforementioned execution entity may, in response to determining that the health score is less than or equal to a preset health score, take the heterogeneous execution entity of the network node offline for cleaning and reset the health score of the heterogeneous execution entity of the network node. For example, it dynamically switches DA execution entities based on time periods and real-time analysis of multi-dimensional data. It collects the system resource usage of DA execution entities, the frequency of abnormal link requests, the number of signature verification failures, and abnormal voting information output by the policy adjudication module. Based on this information, it calculates the health score of the DA execution entity. When its health score is lower than a threshold, it takes the DA execution entity offline and cleans it, and randomly selects any DA from the execution entity pool to run online.
[0062] Optionally, the reset heterogeneous execution entities of each network node can be added back to the heterogeneous execution entity sequence of the network nodes to update the heterogeneous execution entity sequence of the network nodes.
[0063] In some embodiments, the aforementioned execution entity can re-add the reset heterogeneous execution entities of each network node to the heterogeneous execution entity sequence to update the sequence. The online runtime of each DA execution entity is monitored; when the online runtime reaches a predetermined time, the DA execution entity is actively switched, the DA list of each Tor node is updated, and the health status of the offline DA execution entity in this round is stored for continued use when it comes back online.
[0064] Further reference Figure 3 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of a mimicry modification device for communication network nodes. These device embodiments are similar to... Figure 1 Corresponding to the method embodiments shown, the mimicry device for communication network nodes can be specifically applied to various electronic devices.
[0065] like Figure 3As shown, the mimicry modification device 300 for communication network nodes in some embodiments includes: a construction unit 301, a collection unit 302, a sending unit 303, and a feedback unit 304. The construction unit 301 is configured to construct a sequence of heterogeneous execution entities for network nodes, wherein one heterogeneous execution entity corresponds to one execution entity identifier. The collection unit 302 is configured to collect consensus information of each heterogeneous execution entity in the sequence of heterogeneous execution entities for network nodes to obtain a consensus information set. The sending unit 303 is configured to, in response to determining that consensus information in the consensus information set meets the target conditions, send the consensus information to each heterogeneous execution entity of the network nodes. The feedback unit 304 is configured to, for each consensus information in the consensus information set that meets the abnormal conditions, perform the following feedback steps: determine the heterogeneous execution entity of the network node corresponding to the consensus information; calculate the health of the heterogeneous execution entity of the network node to obtain a health score; in response to determining that the health score is less than or equal to a preset health score, take the heterogeneous execution entity of the network node offline for cleaning and reset the health of the heterogeneous execution entity of the network node.
[0066] It is understandable that the units described in the mimicry modification device 300 of the communication network node are similar to the reference... Figure 1 The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the mimicry modification device 300 for communication network nodes and the units contained therein, and will not be repeated here.
[0067] The following is for reference. Figure 4 It illustrates a schematic diagram of the structure of an electronic device (such as a computing device) suitable for implementing some embodiments of the present disclosure. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality or scope of the embodiments of this disclosure. Figure 4 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The memory may include non-volatile storage media and internal memory. The non-volatile storage media may store an operating system and a computer program. The computer program includes program instructions that, when executed, cause the processor to perform a mimicry modification method for any communication network node. The processor provides computational and control capabilities to support the operation of the entire computer device. The internal memory provides an environment for the execution of the computer program in the non-volatile storage media. When executed by the processor, this computer program causes the processor to perform a mimicry modification method for any communication network node. The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 4The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0068] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.
[0069] In one embodiment, the processor is configured to run a computer program stored in a memory to perform the following steps: constructing a sequence of heterogeneous execution entities for network nodes, wherein one heterogeneous execution entity for a network node corresponds to one execution entity identifier; collecting consensus information of each heterogeneous execution entity for a network node in the sequence of heterogeneous execution entities for a consensus information set; in response to determining that there is consensus information in the consensus information set that meets the target conditions, sending the consensus information to each heterogeneous execution entity for a network node; for each consensus information in the consensus information set that meets the abnormal conditions, performing the following feedback steps: determining the heterogeneous execution entity for a network node corresponding to the consensus information; calculating the health of the heterogeneous execution entity for a health score; in response to determining that the health score is less than or equal to a preset health score, taking the heterogeneous execution entity offline for cleaning and resetting the health of the heterogeneous execution entity for a network node.
[0070] This disclosure also provides a computer-readable storage medium storing a computer program, which includes program instructions. When the program instructions are executed, the method implemented can be referred to various embodiments of the mimicry modification method for communication network nodes disclosed herein.
[0071] The aforementioned computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard disk or memory of the computer device. Alternatively, the aforementioned computer-readable storage medium may be an external storage device of the computer device, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device.
[0072] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.
[0073] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.
Claims
1. A method for mimicking the behavior of a communication network node, characterized in that, include: Construct a sequence of heterogeneous execution entities for network nodes, where each heterogeneous execution entity corresponds to an execution entity identifier; Collect consensus information of each heterogeneous execution entity in the heterogeneous execution entity sequence of network nodes to obtain a consensus information set; In response to determining that consensus information satisfying the target conditions exists in the consensus information set, the consensus information is sent to the heterogeneous execution entities of each network node; For each consensus message in the consensus information set that satisfies the abnormal condition, the following feedback steps are performed: Determine the heterogeneous execution entities of the network nodes corresponding to the consensus information; The health status of the heterogeneous execution entities of the network nodes is calculated to obtain a health score; In response to determining that the health score is less than or equal to a preset health score, the heterogeneous execution entity of the network node is taken offline for cleaning, and the health score of the heterogeneous execution entity of the network node is reset.
2. The method according to claim 1, characterized in that, The method further includes: The reset heterogeneous execution entities of each network node are added back to the heterogeneous execution entity sequence of the network node in order to update the heterogeneous execution entity sequence of the network node.
3. The method according to claim 2, characterized in that, The health calculation of the heterogeneous execution entities of the network nodes to obtain a health score includes: The system resource occupancy rate, abnormal link request frequency, signature failure count, and vote rejection rate corresponding to the heterogeneous execution entities of the network nodes are normalized to obtain normalized system resource occupancy rate, normalized abnormal link request frequency, normalized signature failure count, and normalized vote rejection rate. The normalized system resource occupancy rate, normalized abnormal link request frequency, normalized signature failure number, and normalized vote rejection rate are scored separately to obtain the system resource occupancy rate score, abnormal link request frequency score, signature failure number score, and vote rejection rate score. A health score is generated based on the system resource occupancy score, abnormal link request frequency score, signature failure count score, and vote rejection rate score.
4. A device for mimicking the appearance of a communication network node, characterized in that, include: The building unit is configured to build a sequence of heterogeneous execution entities for network nodes, wherein one heterogeneous execution entity for a network node corresponds to one execution entity identifier; The acquisition unit is configured to acquire consensus information of each heterogeneous execution entity in the sequence of heterogeneous execution entities of network nodes, and obtain a consensus information set. The sending unit is configured to send the consensus information to the heterogeneous execution entities of each network node in response to determining that consensus information that satisfies the target conditions exists in the consensus information set; The feedback unit is configured to perform the following feedback steps for each consensus message in the consensus information set that meets the abnormal conditions: determine the heterogeneous execution entity of the network node corresponding to the consensus information; calculate the health of the heterogeneous execution entity of the network node to obtain a health score; in response to determining that the health score is less than or equal to a preset health score, take the heterogeneous execution entity of the network node offline for cleaning, and reset the health of the heterogeneous execution entity of the network node.
5. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 3.
6. A computer-readable medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of claims 1 to 3.