Endogenous safety mimicry method and system based on non-invasive technology

Abstract

The invention relates to the technical field of cloud computing and network security, in particular to an endogenous security mimicry method and system based on a non-intrusive technology. Endogenous security mimicry of the cloud service system is realized through a non-intrusive service mimicry execution arrangement component, a dynamic heterogeneous executor pool, a mimicry scheduler, a multi-mode intelligent adjustor and a security management center. The method can endow the system with the endogenous security capability on the premise that the target system does not need to be transformed, effectively defend attacks based on unknown vulnerabilities and backdoors, remarkably improve the reliability and availability of the system, and is suitable for key information infrastructure scenes with high security requirements such as cloud computing, financial science and technology, government affair platforms and the like. And the toughness of the system to unknown threats is obviously improved.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing and network security technology, and in particular to an intrinsic security mimicry method and system based on non-intrusive technology. Background Technology

[0002] With the popularization of cloud computing technology, cloud-based business systems are facing increasingly severe cybersecurity threats. Traditional security measures are "plug-in" defenses, based on feature matching and prior knowledge, which are insufficient to deal with unknown vulnerabilities, backdoors, advanced persistent threats (APTs), and zero-day attacks.

[0003] Mimicry defense is an emerging intrinsic security technology. Its core principle is to construct a dynamic, heterogeneous, and redundant execution environment that prevents attackers from consistently exploiting system vulnerabilities, thereby fundamentally improving system security. However, mimicry defense requires modification of the target system's software, hardware, or kernel to ensure consistency between requests and responses. It suffers from poor compatibility, especially with existing systems. Existing intrinsic security solutions typically require deep modification or rewriting of system business functions, resulting in high invasiveness, high implementation costs, long development cycles, performance degradation, and stability risks, making rapid deployment and application difficult in existing complex business systems. Summary of the Invention

[0004] To address the security challenges of existing complex cloud-based business systems, this invention provides an intrinsic security mimicry method and system based on non-intrusive technology. It integrates mimicry defense with intrinsic security mechanisms, modifying the target system in a non-intrusive manner to achieve a security protection mechanism with dynamic heterogeneous redundancy characteristics. By "mimicking" existing cloud-based business systems, it endows them with intrinsic security capabilities. This allows for the empowerment of systems with intrinsic security capabilities without requiring modifications to the target system, effectively defending against attacks based on unknown vulnerabilities and backdoors. Simultaneously, it significantly improves system reliability and availability, making it suitable for critical information infrastructure scenarios with high security requirements, such as cloud computing, fintech, and government platforms, and enhancing the system's resilience against unknown threats.

[0005] According to the design scheme provided by this invention, on one hand, an intrinsically secure mimicry system based on non-intrusive technology is provided, comprising: an orchestration component, a dynamic heterogeneous execution pool, a mimicry scheduler, a multimodal intelligent adjudicator, and a security management center, wherein...

[0006] The orchestration component is deployed in a non-intrusive manner at the front end of the business system to receive and intercept all external input requests from the business system. It extracts API call parameters or transaction instructions by stripping the network protocol shell from the request and encapsulates them in a standardized way.

[0007] A dynamic heterogeneous execution pool, deployed in a cloud environment, consists of multiple execution instances with equivalent functions and heterogeneous runtime environments in at least one dimension, used to process standardized encapsulated requests in parallel and generate response results.

[0008] The mimic scheduler selects a group of functionally equivalent but heterogeneous execution instances from the dynamic heterogeneous execution pool according to the dynamic scheduling strategy, distributes standardized encapsulated requests to the selected heterogeneous execution instances, and synchronizes the information of the execution instances during execution to the orchestration component. The number of execution instances in the selected group is ≥3.

[0009] The multimodal intelligent adjudicator receives responses from each execution instance and compares and adjudicates them using a multimodal adjudication algorithm.

[0010] The security management center receives the adjudication results from the multimodal intelligent adjudicator, manages the dynamic adjustment of scheduling strategies and sends them to the mimic scheduler, and reconstructs abnormal execution entities through the mimic scheduler.

[0011] As an endogenous security mimicry system based on non-intrusive technology in this invention, the execution instance runtime environment is heterogeneous in at least one dimension, including but not limited to: heterogeneous operating system type and / or version, heterogeneous middleware and / or runtime environment version, heterogeneous dependency library version, heterogeneous underlying hardware instruction set architecture, heterogeneous code generated by diverse mutations, and heterogeneous software architecture implemented in different languages.

[0012] As an endogenous security mimicry system based on non-intrusive technology, the dynamic heterogeneous execution pool is further constructed based on containerization technology and a container orchestration platform to dynamically expand and shrink the execution instances in the dynamic heterogeneous execution pool according to the business load.

[0013] As an endogenous security mimicry system based on non-intrusive technology in this invention, the multimodal decision-making algorithm in the multimodal intelligent arbitrator is one or more combinations of majority voting, consistency checking, and semantic-based equivalence judgment algorithms.

[0014] As an endogenous security mimicry system based on non-intrusive technology, this invention further reconstructs abnormal execution entities through a mimicry scheduler, including:

[0015] The cloud platform's automated orchestration tool destroys abnormal execution instances and creates new execution instances based on pre-defined heterogeneous templates, then adds the newly created execution instances to the dynamic heterogeneous execution pool.

[0016] Furthermore, this invention also provides an intrinsic security mimicry method based on non-intrusive technology. Based on the aforementioned system implementation, the implementation process includes:

[0017] By intercepting external business requests from the business system through orchestration components, and after parsing and stripping the network protocol, the requests are encapsulated into standardized request data;

[0018] The standardized request data is distributed to the selected execution instances by selecting a group of execution instances from the dynamic heterogeneous execution pool through a mimic scheduler and according to the dynamic scheduling strategy.

[0019] The system utilizes a selected set of execution instances to process standardized request data in parallel and generate response results for each instance.

[0020] The multimodal intelligent arbitrator compares and adjudicates all response results, outputs consistent and reliable results based on the comparison and adjudication results, identifies and marks abnormal executors and synchronizes them to the security management center;

[0021] The orchestration component encapsulates the trusted results and returns them to the business system. The security management center uses a mimic scheduler to handle abnormal executors and maintain the health of the dynamic heterogeneous executor pool.

[0022] As an intrinsic security mimicry method based on non-intrusive technology in this invention, further, after parsing and stripping the network protocol, the request is encapsulated into standardized request data, including:

[0023] Parse and strip the original protocol header from the business request, extract the business logic data, and encapsulate the business logic data into a unified intermediate representation format.

[0024] As an intrinsically secure mimicry method based on non-intrusive technology, the present invention further includes handling abnormal executors and maintaining the health status of the dynamic heterogeneous executor pool, including:

[0025] The abnormal execution body is marked and isolated, and a new heterogeneous execution body is reconstructed to replace the abnormal execution body.

[0026] The dynamic scheduling strategy is adaptively adjusted based on historical ruling records.

[0027] The beneficial effects of this invention are:

[0028] This invention requires no modification to existing application code, significantly reducing the deployment threshold and cost of mimic defense. It is particularly suitable for protecting existing core business systems, achieving true non-intrusive protection. Based on the DHR architecture, it can effectively defend against attacks exploiting unknown vulnerabilities and backdoors, with security capabilities inherent in the system architecture. The multimodal intelligent adjudication mechanism can not only detect security attacks but also detect and tolerate system hardware and software failures, improving business continuity and high reliability. It fully utilizes the elastic scaling, containerization, and automated operation and maintenance capabilities of cloud computing, making the dynamic scheduling, reconstruction, and expansion of the execution pool efficient and cost-controllable. For attackers, the attack surface presented by the system is dynamically changing, with good concealment protection, greatly increasing the difficulty and cost of attacks. By integrating mimic defense with inherent security mechanisms, it endows existing business systems with mimicry capabilities in a non-intrusive manner, making it applicable to the complex heterogeneous environments of general business systems in cloud computing fields such as finance, e-commerce, and government. Attached image description:

[0029] Figure 1 This is a schematic diagram of the intrinsic security mimicry system architecture based on non-intrusive technology in the embodiment;

[0030] Figure 2 This is a schematic diagram of the non-intrusive mimicry processing flow in the embodiment. Detailed implementation method:

[0031] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0032] To address the security protection of cloud-based business systems, this invention provides an intrinsically secure mimicry system based on non-intrusive technology, comprising: an orchestration component, a dynamic heterogeneous execution pool, a mimicry scheduler, a multimodal intelligent adjudicator, and a security management center.

[0033] The orchestration component is deployed in a non-intrusive manner at the front end of the business system to receive and intercept all external input requests from the business system. It extracts API call parameters or transaction instructions by stripping the network protocol shell from the request and encapsulates them in a standardized way.

[0034] A dynamic heterogeneous execution pool, deployed in a cloud environment, consists of multiple execution instances with equivalent functions and heterogeneous runtime environments in at least one dimension, used to process standardized encapsulated requests in parallel and generate response results.

[0035] The mimic scheduler selects a group of functionally equivalent but heterogeneous execution instances from the dynamic heterogeneous execution pool according to the dynamic scheduling strategy, distributes standardized encapsulated requests to the selected heterogeneous execution instances, and synchronizes the information of the execution instances during execution to the orchestration component. The number of execution instances in the selected group is ≥3.

[0036] The multimodal intelligent adjudicator receives responses from each execution instance and compares and adjudicates them using a multimodal adjudication algorithm.

[0037] The security management center receives the adjudication results from the multimodal intelligent adjudicator, manages the dynamic adjustment of scheduling strategies and sends them to the mimic scheduler, and reconstructs abnormal execution entities through the mimic scheduler.

[0038] like Figure 1 As shown, the non-intrusive business mimicry execution orchestration component serves as the entry point and scheduling core for system business operations. It receives and intercepts all external input requests from the system's business processes, strips away network protocol shells (such as HTTP / HTTPS headers, TCP / IP headers, etc.), extracts pure, business logic-related data (such as API call parameters, transaction instructions, etc.), and encapsulates it into standardized business events or messages independent of specific technology stacks. Its "non-intrusiveness" is reflected in its transparency to the business; the business system does not need to be aware of its existence.

[0039] In a dynamic heterogeneous execution pool, the execution units are deployed in a cloud environment, which can be virtual machines, containers, or bare metal servers. Its heterogeneity extends beyond basic environments such as operating systems and middleware; the core heterogeneity lies in the heterogeneity of business logic implementation methods, which can be manifested in:

[0040] 1. Algorithm heterogeneity: For example, deploying execution entities that use different algorithms to implement the same computing task or module.

[0041] 2. Heterogeneous architecture: For example, a business function can be implemented in heterogeneous ways, such as monolithic architecture or microservice architecture.

[0042] 3. Code-level heterogeneity: Using diverse compilation techniques to generate functionally equivalent but heterogeneous executable files from the same business code, serving as different execution entities.

[0043] 4. Third-party heterogeneous: For standard business, such as ID card verification, API services from different vendors can be integrated as heterogeneous execution entities.

[0044] Multiple selected heterogeneous execution instances process the received standardized requests in parallel. Each execution instance independently completes business logic calculations and generates response results.

[0045] The mimicry scheduler is the "brain" of the system. It receives policy feedback from the security management and feedback loop, distributes requests to multiple heterogeneous execution entities in the execution entity pool according to dynamic scheduling strategies (such as random scheduling, weighted round-robin, or scheduling based on historical reputation), triggers the cleaning, resetting, or reconstruction of abnormal execution entities, and synchronizes the adjustment information of the execution entities to the non-intrusive business mimicry execution orchestration component.

[0046] The multimodal intelligent adjudicator receives the output results returned by each executor and performs multimodal detection and adjudication processing. To enhance the intelligence and proactivity of the adjudication mechanism, the adopted multimodal adjudication mechanism, based on majority voting, deeply integrates machine learning-based anomaly detection capabilities and semantic consistency checks, aggregating the analysis results into a global security situation awareness. This allows the adjudicator not only to output reliable results but also to dynamically observe the development trend of attack patterns and provide real-time feedback to security management and feedback loops accordingly. If all or a majority of the executors output consistent results, the result is determined to be reliable. If all or a majority of the executors output inconsistent results, feedback control and executor pool maintenance are performed.

[0047] Security management and feedback loop control the entire system's security policies, dynamic scheduling strategies, and log auditing. It receives results from the multi-mode arbitrator and dynamically adjusts the scheduling strategy. If the output of a particular executor is found to be inconsistent with the majority, it determines that the executor may have been attacked or is malfunctioning, and immediately isolates it offline, forming a continuously evolving security loop. This drives the entire system to evolve from a passive arbitrator to a proactive defense system with continuous evolution capabilities.

[0048] If, during the adjudication process, a particular executor is found to produce a few abnormal results, it is immediately marked as "untrusted" and isolated from the currently available pool. The security management center automatically triggers an executor reconstruction process. For example, leveraging the cloud platform's automated operation and maintenance capabilities, it destroys abnormal executor instances and, based on pre-defined heterogeneous templates, quickly launches a new, clean executor instance, adding it to the dynamic heterogeneous executor pool to maintain the pool's size and health. The system continuously records scheduling, adjudication, and abnormal events, and adaptively optimizes scheduling strategies and adjudication rules based on this historical data to continuously improve the overall security and reliability of the system.

[0049] Real-time monitoring of the performance metrics, resource usage, and security event logs of each executor provides data support for scheduling and adjudication strategies through quantitative metrics, enabling the system's operational status to be known and controlled.

[0050] The dynamic heterogeneous execution pool is built on containerization technology and a container orchestration platform to dynamically scale the execution instances in the pool according to the business load.

[0051] Furthermore, based on the above system, this embodiment of the invention also provides an endogenous security mimicry method based on non-intrusive technology, the implementation process of which includes:

[0052] By intercepting external business requests from the business system through orchestration components, and after parsing and stripping the network protocol, the requests are encapsulated into standardized request data. It can parse and strip the original protocol headers from business requests, extract business logic data, and encapsulate the business logic data into a unified intermediate representation format.

[0053] The standardized request data is distributed to the selected execution instances by selecting a group of execution instances from the dynamic heterogeneous execution pool through a mimic scheduler and according to the dynamic scheduling strategy.

[0054] The system utilizes a selected set of execution instances to process standardized request data in parallel and generate response results for each instance.

[0055] The multimodal intelligent arbitrator compares and adjudicates all response results, outputs consistent and reliable results based on the comparison and adjudication results, identifies and marks abnormal executors and synchronizes them to the security management center;

[0056] The orchestration component encapsulates the trusted results and returns them to the business system. The security management center uses a mimic scheduler to handle abnormal executors and maintain the health of the dynamic heterogeneous executor pool. By marking and isolating abnormal executors and reconstructing new heterogeneous executors, the abnormal executors can be replaced by the reconstructed heterogeneous executors to maintain the health of the dynamic heterogeneous executor pool; the dynamic scheduling strategy is adaptively adjusted based on historical decision records.

[0057] To verify the effectiveness of the proposed solution, we will take the protection of an online payment system developed based on Java Web (SpringBoot) as an example. Figure 2 As shown, the implementation process of the solution in this case can be summarized as follows:

[0058] S1. System Configuration and Deployment

[0059] First, we will build an intrinsically secure mimicry system based on non-intrusive technology.

[0060] 1. Deploy a non-intrusive business mimicry execution orchestration component: A mimicry execution orchestration component is built using secondary development based on the high-performance proxy software Envoy. This component is deployed behind the existing load balancer, serving as the unified entry point for all payment requests (such as user payments and order inquiries). Its configuration rules are to block all HTTP / HTTPS traffic pointing to the original payment system's IP address and port.

[0061] 2. Constructing a Dynamic Heterogeneous Execution Pool: In cloud computing platforms, a heterogeneous execution pool built based on containerization technology (Docker) and a container orchestration platform (Kubernetes) can dynamically scale execution instances in seconds according to business load. If an abnormal execution instance is detected, Kubernetes' automated operation and maintenance capabilities can be leveraged to achieve second-level destruction, reconstruction, and replacement, ensuring the health of the execution pool. Furthermore, the execution pool is deployed as a secure sidecar proxy within the service mesh. The following example illustrates three functionally equivalent (all deploying the same function, but with different compilations of the payment system) execution instances running in heterogeneous environments:

[0062] Executable A: The operating system is Ubuntu 20.04LTS, and the PHP runtime is PHP7.

[0063] Executable B: The operating system is CentOS 7.9, and the Java runtime is OpenJDK 17.

[0064] Executable C: The operating system is Alpine Linux 3.14, and the Go runtime is Go 1.22.

[0065] These three execution instances do not directly expose the network; they only accept internal requests from the mimic scheduler. They constitute the initial dynamic heterogeneous execution pool.

[0066] 3. Deploy the mimicry scheduler, multimodal intelligent arbiter, and security management center: Develop core management components using Python / Go and deploy them as independent microservices. The scheduler communicates with the non-intrusive business mimicry execution orchestration component and the execution pool; the multimodal intelligent arbiter communicates with the security management center; and the security management center communicates with the mimicry scheduler component.

[0067] S2. Request Processing and Mimicry Defense Process

[0068] Next, we will describe in detail the complete closed-loop process of a user payment request (such as POST / api / pay) being processed:

[0069] 1. Business request interception and logic extraction and encapsulation:

[0070] When a user initiates a payment request, the traffic arrives at a non-intrusive business-mimicking execution orchestration component.

[0071] The gateway performs a deep analysis of the HTTP / POST request, stripping away protocol-specific information such as HTTP headers and cookies, and extracting core business data (such as JSON formatted {"orderId":"12345","amount":99.99,"token":"xyz"}).

[0072] The gateway encapsulates business data into a standardized intermediate format defined internally by the system. For example, after adding a unified internal header, it serializes the data into Protocol Buffers format and sends this standardized request to the mimic scheduler. Thus, the original payment system is completely unaware of this process, achieving non-intrusive processing.

[0073] 2. Intelligent dynamic scheduling:

[0074] The mimic scheduler received a standardization request. The scheduling strategy for this instance is random scheduling, and the set of instances A, B, and C was randomly selected.

[0075] The scheduler copies the standardized request three times and sends them to executors A, B, and C respectively via the internal network.

[0076] 3. Heterogeneous parallel execution:

[0077] Executions A, B, and C simultaneously receive the same standardized request. Each of them contains identical business logic, fully compiled from the original Spring Boot application: verifying payment tokens, deducting inventory, and generating payment records.

[0078] Due to the heterogeneity of operating environments, languages, and architectures, if an unknown vulnerability or backdoor exists in a specific Java language, it may be triggered at this step, causing an executor to exhibit abnormal behavior.

[0079] 4. Multimodal intelligent decision-making (corresponding step S400):

[0080] After execution bodies A, B, and C complete their processing, they generate response results (such as {"code":0,"msg":"success","paymentId":"p789"}) and return them to the multi-mode arbitrator.

[0081] The multimodal intelligent arbiter uses a majority voting algorithm to compare the three results. Assume that in this process, executor B (Java) is attacked due to an unknown vulnerability and returns an abnormal result {"code":-1,"msg":"error"}. Executors A and C both return the correct result {"code":0,"msg":"success","paymentId":"p789"}.

[0082] The arbiter determines that the result of the majority (A and C) is the trusted output and sends this trusted result to the non-intrusive business mimicry execution orchestration component. At the same time, it marks execution B as abnormal and synchronizes it to the security management center.

[0083] 5. Result return and closed-loop control (corresponding to step S500):

[0084] After receiving the trusted result, the non-intrusive business mimicry execution orchestration component repackages it into a standard HTTP / 200 OK response and returns it to the user. The user receives a payment success notification without being aware of the entire defense process.

[0085] At the same time, the security management center received an alarm from the multimodal intelligent arbitrator regarding an anomaly in executor B.

[0086] Isolation: The management center immediately sends an instruction to the mimic scheduler, which then isolates and takes offline the container instance of Executor B from the service list.

[0087] Refactoring: The management center calls the cloud platform's container orchestration API (such as Kubernetes) through the mimic scheduler to immediately destroy the container of execution entity B and quickly start a new execution entity B' based on the template (CentOS + Java) pre-configured for execution entity B. After the new instance starts, it is automatically registered to the execution entity pool, and the pool's size and health status are restored. The mimic scheduler also synchronizes the new execution entity information to the non-intrusive business mimic execution orchestration component.

[0088] This closed-loop feedback mechanism ensures the continued effectiveness of the intrinsic security mimicry defense capability.

[0089] As demonstrated by the examples above, when facing attacks exploiting specific environmental dependencies (such as Java language vulnerabilities), even if a single executable is compromised, the system can ensure the correctness of the final output through heterogeneous redundancy and multi-modal adjudication mechanisms, and automatically isolate and repair damaged components at the architectural level. Throughout the entire process, the protected payment system requires no code modification or recompilation, fully demonstrating the core advantages of "non-intrusiveness" and "intrinsic security."

[0090] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0091] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0092] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0093] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0094] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An intrinsically secure mimicry system based on non-intrusive technology, characterized in that, It includes: orchestration components, a dynamic heterogeneous execution pool, a mimicry scheduler, a multimodal intelligent adjudicator, and a security management center. The orchestration component is deployed in a non-intrusive manner at the front end of the business system to receive and intercept all external input requests from the business system. It extracts API call parameters or transaction instructions by stripping the network protocol shell from the request and encapsulates them in a standardized way. A dynamic heterogeneous execution pool, deployed in a cloud environment, consists of multiple execution instances with equivalent functions and heterogeneous runtime environments in at least one dimension, used to process standardized encapsulated requests in parallel and generate response results. The mimic scheduler selects a group of functionally equivalent but heterogeneous execution instances from the dynamic heterogeneous execution pool according to the dynamic scheduling strategy, distributes standardized encapsulated requests to the selected heterogeneous execution instances, and synchronizes the information of the execution instances during execution to the orchestration component. The number of execution instances in the selected group is ≥3. The multimodal intelligent adjudicator receives responses from each execution instance and compares and adjudicates them using a multimodal adjudication algorithm. The security management center receives the adjudication results from the multimodal intelligent adjudicator, manages the dynamic adjustment of scheduling strategies and sends them to the mimic scheduler, and reconstructs abnormal execution entities through the mimic scheduler.

2. The intrinsic security mimicry system based on non-intrusive technology according to claim 1, characterized in that, The runtime environment of the execution instance is heterogeneous in at least one dimension, including but not limited to: heterogeneous operating system type and / or version, heterogeneous middleware and / or runtime environment version, heterogeneous dependency library version, heterogeneous underlying hardware instruction set architecture, heterogeneous code generated by diverse mutations, and heterogeneous software architecture implemented in different languages.

3. The intrinsic security mimicry system based on non-intrusive technology according to claim 1, characterized in that, The dynamic heterogeneous execution pool is built on containerization technology and a container orchestration platform to dynamically expand and shrink the execution instances in the pool according to the business load.

4. The intrinsic security mimicry system based on non-intrusive technology according to claim 1, characterized in that, The multimodal intelligent arbitrator's multimodal adjudication algorithm is one or more combinations of majority voting, consistency checking, and semantic-based equivalence judgment algorithms.

5. The intrinsic security mimicry system based on non-intrusive technology according to claim 1, characterized in that, Reconstructing abnormal execution bodies using a mimicry scheduler includes: The cloud platform's automated orchestration tool destroys abnormal execution instances and creates new execution instances based on pre-defined heterogeneous templates, then adds the newly created execution instances to the dynamic heterogeneous execution pool.

6. An endogenous security mimicry method based on non-intrusive technology, characterized in that, Based on the system implementation of claim 1, the implementation process includes: By intercepting external business requests from the business system through orchestration components, and after parsing and stripping the network protocol, the requests are encapsulated into standardized request data; The standardized request data is distributed to the selected execution instances by using a mimic scheduler and selecting a set of execution instances from a dynamic heterogeneous execution pool according to a dynamic scheduling strategy. The system utilizes a selected set of execution instances to process standardized request data in parallel and generate response results for each instance. The multimodal intelligent adjudicator compares and adjudicates all response results, outputs consistent and reliable results based on the comparison and adjudication results, identifies and marks abnormal executors and synchronizes them to the security management center; The orchestration component encapsulates the trusted results and returns them to the business system. The security management center uses the mimicry scheduler to handle abnormal executors and maintain the health status of the dynamic heterogeneous executor pool.

7. The intrinsic security mimicry method based on non-invasive technology according to claim 6, characterized in that, After parsing and stripping the network protocol, the request is encapsulated into standardized request data, including: Parse and strip the original protocol header from the business request, extract the business logic data, and encapsulate the business logic data into a unified intermediate representation format.

8. The intrinsic security mimicry method based on non-invasive technology according to claim 6, characterized in that, Handling abnormal executors and maintaining the health of the dynamic heterogeneous executor pool includes: The abnormal execution body is marked and isolated, and a new heterogeneous execution body is reconstructed to replace the abnormal execution body. The dynamic scheduling strategy is adaptively adjusted based on historical ruling records.

9. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 6 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 6 to 8.

Images