Disk scanning method and device based on mimicry defense, electronic equipment and medium

Abstract

The application provides a quasimodo defense-based disk scanning method and device, electronic equipment and medium. The method selects multiple heterogeneous disk scanning code copies from a pre-generated heterogeneous executor pool in response to a scanning trigger event for a target disk; performs scanning operations on the target disk by the selected multiple disk scanning code copies respectively to obtain multiple initial scanning results; and performs a decision-making process on the multiple initial scanning results to determine a final disk scanning result. The method improves the endogenous security of the disk scanning process and the active defense capability against unknown attacks.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and more specifically, to a disk scanning method, apparatus, electronic device, and medium based on mimicry defense. Background Technology

[0002] In the digital and networked era, disk scanning is a core means of preventing viruses and malware, typically involving periodically scanning files or data blocks on the disk to detect security threats such as malicious code and vulnerabilities. Current technologies mainly rely on passive defense strategies such as encryption protection, access control, and malware protection. However, these traditional defense methods are usually static and fixed, for example, using a single scanning code to scan at fixed time intervals. This single, static characteristic makes the defense scheme vulnerable to targeted attacks by attackers through reverse engineering analysis, vulnerability exploitation, and other methods, and it is particularly difficult to effectively deal with advanced persistent threats such as backdoor attacks and code tampering. Once the scanning code itself is flawed or tampered with, the entire security defense becomes ineffective, and the reliability of disk scan results and the inherent security of the system cannot be guaranteed. Summary of the Invention

[0003] The purpose of this application is to provide a disk scanning method, apparatus, electronic device, and medium based on mimicry defense, which improves the intrinsic security of the disk scanning process and the proactive defense capability against unknown attacks by heterogeneously processing the disk scanning code and combining a dynamic mimicry disk mechanism with adaptive security posture adjustment.

[0004] Firstly, a disk scanning method based on mimicry defense is provided, which may include: In response to a scan-triggered event targeting the target disk, select multiple heterogeneous disk scan code copies from a pre-generated pool of heterogeneous execution bodies; The selected copies of the disk scan code are used to perform a scan operation on the target disk to obtain multiple initial scan results; The multiple initial scan results are processed to determine the final disk scan result.

[0005] In one possible implementation, the pre-generation process of heterogeneous code copies in the heterogeneous execution pool includes: Obtain the raw code for the disk scan; The original code is subjected to code heterogeneity processing to generate multiple heterogeneous code copies with the same scanning function but different internal implementation logic; Multiple heterogeneous code copies generated are stored in the heterogeneous execution pool.

[0006] In one possible implementation, the original code is subjected to code heterogeneity processing, which includes at least one of the following operations: The identifiers in the original code are randomly replaced; The control flow of the original code is rearranged or obfuscated; The first algorithm in the original code is replaced with a functionally equivalent second algorithm.

[0007] In one possible implementation, the method further includes, before selecting multiple heterogeneous disk scan code copies: Obtain a preset disk selection strategy, which is generated based on historical attack data and / or disk importance data of the disk; The target disk is determined from multiple candidate disks as the mimic disk according to the disk selection strategy.

[0008] In one possible implementation, the multiple initial scan results are adjudicated to determine the final disk scan result, including: The initial scan results are evaluated by a majority vote, and the scan result that appears most frequently is determined as the final disk scan result.

[0009] In one possible implementation, the method further includes: Obtain the number of attacks the system has suffered within a preset time period and the system's current defense strength value; The ratio of the number of attacks to the defense strength value is determined as the security situation value; The number of disks identified as mimic disks is dynamically adjusted based on the security status value.

[0010] In one possible implementation, the number of disks identified as mimic disks is dynamically adjusted based on the security posture value, including: Get the preset maximum number of mimicry disks; Based on the security situation value and the maximum number of mimicry disks, the target number of mimicry disks is calculated using a configured adjustment formula, wherein the target number of mimicry disks is positively correlated with the security situation value; The number of disks identified as mimic disks will be adjusted to the target number of mimic disks.

[0011] Secondly, a disk scanning device based on mimicry defense is provided, the device may include: The selection unit is used to select multiple heterogeneous disk scan code copies from a pre-generated pool of heterogeneous execution bodies in response to a scan trigger event targeting the target disk. The scanning unit is used to perform scanning operations on the target disk by selecting multiple copies of the disk scan code respectively, and obtain multiple initial scan results; The determining unit is used to process the multiple initial scan results and determine the final disk scan result.

[0012] Thirdly, an electronic device is provided, which includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in memory, it implements any of the steps described in the first aspect above.

[0013] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the steps of any of the methods described in the first aspect above.

[0014] The disk scanning method, apparatus, electronic device, and medium based on mimicry defense provided in this application involve the following steps: In response to a scan trigger event targeting a target disk, the method selects multiple heterogeneous disk scan code copies from a pre-generated pool of heterogeneous execution entities; performs scan operations on the target disk using the selected disk scan code copies respectively, obtaining multiple initial scan results; and performs adjudication processing on the multiple initial scan results to determine the final disk scan result. This method, by heterogenizing the disk scan code and combining it with a dynamic mimicry disk mechanism and adaptive security posture adjustment, enhances the inherent security of the disk scanning process and its proactive defense against unknown attacks. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A schematic flowchart illustrating a disk scanning method based on mimicry defense provided in this application embodiment; Figure 2 A schematic diagram of a disk scanning device based on mimicry defense provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application. Unless otherwise defined, the technical or scientific terms used in this application should have the ordinary meaning understood by those skilled in the art. The terms "first," "second," and similar terms used in this application do not indicate any order, quantity, or importance, but are only used to distinguish different components. The terms "comprising" or "including," etc., mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects. The terms "connection," "coupled," or "linked," etc., are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0018] Currently, existing security defense technologies for disk scanning are mainly based on the passive defense approach, which involves developing specific defense strategies by detecting and analyzing attack behavior. However, this method has significant weaknesses when facing unknown attack threats and is ineffective against new and complex attack methods. The shortcomings of security defense technologies based on the passive defense approach are mainly reflected in the following aspects: 1. Single code scanning: Existing disk scanning methods typically use fixed scanning code, which makes it easy for attackers to carry out targeted attacks through reverse engineering and vulnerability exploitation.

[0019] 2. Lack of adaptability: The defense strategy is fixed during disk scanning and fails to adapt to the actual security situation of the system, thus affecting the flexibility and effectiveness of the defense.

[0020] 3. Backdoor attacks and code tampering: Current technology is insufficient to effectively prevent sophisticated attacks such as backdoor attacks and code tampering.

[0021] This application aims to address the aforementioned problems, particularly targeting backdoor attacks and code tampering exploitation attacks, by providing a disk scanning method based on mimicry defense. This method first ensures the reliability of disk scan results by providing multiple heterogeneous executables of the disk scanning code. Second, the scheme aggregates the processing results generated by the redundant heterogeneous executables and determines the final processing result using a large number decision-making technique. This process ensures the accuracy and consistency of the processing results. Finally, the decided result is returned as the final result of the disk scan. To balance the efficiency and security of disk scanning, selecting a subset of disks for mimicry disk scanning is a feasible solution. Specifically, based on historical data and the current threat landscape, intelligent algorithms using reinforcement learning can optimize the determination of mimicry disks. On the other hand, to cope with constantly changing attack behaviors, an adaptive security protection mechanism is proposed. That is, the number of mimicry disks performing mimicry disk scanning can be automatically adjusted according to the current security posture of the system. This scheme effectively transforms the characteristics of disk scanning from a single and static design to a heterogeneous and dynamic structure, enhancing the inherent security effect of disk scanning when facing internal code design flaws and vulnerabilities. In this way, the solution not only solves the backdoor attack problem that traditional defense methods have not considered, but also ensures a dynamic balance between disk scanning performance and security, thereby improving the overall security and robustness of disk scanning.

[0022] For ease of understanding, the terms used in the embodiments of this application are explained below: Code heterogeneity, by altering the organizational structure of disk scanning code, makes the code architecture different for each disk scan execution, thereby increasing the difficulty for attackers to crack the code. Through heterogeneity processing, the system generates multiple copies of code with the same functionality, but their execution flow and details differ. Code heterogeneity is a common code protection technique that aims to modify the control flow, data structures, and operators of the source code so that the code's functionality appears identical to the original code, but its implementation is actually different. This makes it difficult for attackers to understand the true execution logic of the code through reverse engineering or static analysis.

[0023] A heterogeneous execution pool is a collection of multiple disk scan code copies that have the same functionality but different internal implementation logic.

[0024] A mimic disk (MD) is a disk selected for a mimic scan, meaning that the scan operation on the disk is performed in parallel using multiple heterogeneous code copies and the results are then evaluated.

[0025] The mimicry disk mechanism enhances security by mimicking the disk. In multi-disk systems, we select a subset of disks for mimicry processing. This involves performing disk scans on the same disk using redundant heterogeneous code copies, and then using a large-number decision to determine the final scan result. This ensures the security of the scan results while also increasing the difficulty for attackers to crack the code due to the heterogeneous redundant code copies.

[0026] Security posture value is an indicator used to quantify the level of threats currently faced by the system. It is calculated by the ratio of the number of attacks to the strength of the defense.

[0027] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0028] Figure 1 This is a flowchart illustrating a disk scanning method based on mimicry defense, provided as an embodiment of this application. Figure 1 As shown, the method may include: Step S110: In response to a scan trigger event for the target disk, select multiple heterogeneous disk scan code copies from a pre-generated heterogeneous execution pool.

[0029] Before performing this step, during system initialization or runtime, a heterogeneous execution pool containing multiple copies of heterogeneous disk scan code needs to be built. The specific generation process is as follows: Step 1: Obtain the raw code for the disk scan. This raw code can be a general-purpose antivirus scanning engine, a malware detector, or any executable code used to check the security of disk files / blocks of data.

[0030] Step 2: Perform code heterogeneity processing on the original code to generate multiple heterogeneous code copies with the same scanning function but different internal implementation logic. The heterogeneity processing includes at least one of the following operations: (1) Randomization of identifiers: Replace the variable names, function names, class names and other identifiers in the source code with randomly generated new names to increase the difficulty for attackers to understand the code logic through static analysis.

[0031] (2) Control flow rearrangement or obfuscation: Change the control flow structure of the program, such as adjusting the order of condition judgments, inserting useless code blocks that do not affect the final execution result, converting loop structures into equivalent recursion, etc., making the execution path of the code difficult to predict.

[0032] (3) Algorithm replacement: Replace the first algorithm (such as quick sort, hash calculation) that implements a specific function in the original code with a second algorithm with equivalent function (such as merge sort, different hash algorithms), thereby changing the underlying implementation of the code.

[0033] Step 3: Store the generated multiple heterogeneous code copies in a heterogeneous execution pool, and record information such as the identifier, version, and generation time of each copy for subsequent management and dynamic updates.

[0034] Through the above heterogeneous processing, even if an attacker obtains a copy of the code, it will be difficult to reverse engineer the implementation details of other copies, thus laying the foundation for subsequent mimicry defense.

[0035] In the specific implementation of step S110, when a scan of the target disk is detected (e.g., triggered by a scheduled scan, manually triggered by the user, or triggered after the system detects an anomaly), in response to the scan trigger event, multiple heterogeneous disk scan code copies are selected from a pre-generated heterogeneous execution body pool. The selection method can be to randomly select a preset number of copies. To ensure the reliability of subsequent decisions, an odd number of copies (e.g., 3 or 5) are typically selected, with a minimum of 3. These selected copies will serve as the "execution body" for this scan.

[0036] Step S120: Perform scanning operations on the target disk using the selected multiple disk scan code copies to obtain multiple initial scan results.

[0037] Multiple copies of the selected disk scanning code are used to scan the target disk. Each copy runs independently, scanning files, directories, or data blocks on the disk and outputting its own scan results. Due to differences in the code implementation of each copy, their detection results for the same disk may be completely identical, or they may differ due to different implementation logic (for example, some copies are more sensitive to the detection of specific malware).

[0038] In some embodiments, not all disks must be scanned using the aforementioned mimicry method; instead, some disks can be selected as "mimicry disks," while the remaining disks can still be scanned using the conventional single-scan method to save resources. Therefore, before step S120, this application can first determine whether the target disk is a mimicry disk. Specifically, the process of determining the target disk as a mimicry disk includes: Step 11: Obtain the preset disk selection strategy: The disk selection strategy is generated based on the disk's historical attack data and / or disk importance data. Historical attack data refers to the number and type of attacks the disk has suffered over a period of time; disk importance can be classified according to the criticality of the data stored on the disk (such as system disk, database disk, user data disk).

[0039] Step 12: Determine the target disk as a mimic disk: Based on the disk selection strategy, determine the target disk as a mimic disk from multiple candidate disks. For example, the system can periodically run a selection algorithm (such as weighted random selection or a greedy algorithm) to select the set of disks that need to be scanned using mimicry in the current time period. If the target disk is in this set, the subsequent scan will use the mimicry method.

[0040] The aforementioned mimicry disk mechanism allows for the allocation of more defense resources to critical or high-risk disks, achieving a balance between security and performance.

[0041] Step S130: Perform a decision-making process on multiple initial scan results to determine the final disk scan result.

[0042] The multiple initial scan results are aggregated, and a decision algorithm is used to determine the final scan result. In this embodiment, a large-number decision mechanism is preferably used: the multiple initial scan results are statistically analyzed, and the scan result that appears most frequently is determined as the final disk scan result and output. For example, if the output results of the three copies are "Safe," "Safe," and "Virus A Found," the final result is "Safe"; if the outputs are "Virus A Found," "Virus A Found," and "Virus B Found," the final result is "Virus A Found." This decision mechanism is based on the assumption that the probability of multiple executors simultaneously failing in a heterogeneous redundant architecture is extremely low, effectively ensuring the correctness and consistency of the output results.

[0043] Based on any of the above embodiments, this application introduces a security situation awareness mechanism to dynamically adjust the number of mimic disks according to the current threat level of the system, so as to adaptively balance security and performance.

[0044] Step 21: Obtain the number of attacks and defense strength values. The system needs to acquire the following two parameters in real time or periodically: Attack Count A: This refers to the number of attacks the system suffered within a preset time period. This data can be collected through intrusion detection systems (IDS), firewall logs, antivirus software alerts, etc., and is usually the total number of attack events within the most recent time window (e.g., the past 5 minutes).

[0045] Defense Strength D: Refers to the system's current defense capability level. The defense strength value is positively correlated with the number of disks currently identified as mimic disks and / or the degree of heterogeneity of the heterogeneous disk scan code copies. For example, the formula for calculating defense strength D can be defined as follows: ; Where n is the current number of mimic disks, h is the heterogeneity coefficient (which can be quantified based on the number of variants of the code copy, the obfuscation intensity, etc.), and α and β are preset weighting factors.

[0046] Step 22: Calculate the security situation value The ratio of the number of attacks (A) to the defense strength value (D) is defined as the security posture value (S), i.e.: ; It is evident that the higher the security posture value S, the more severe the threat faced by the system, and the stronger the defense capabilities required; the lower the S, the lighter the threat, and the defense intensity can be appropriately reduced to save resources.

[0047] Step 23: Dynamically adjust the number of mimic discs The number of disks identified as mimic disks is dynamically adjusted based on the security posture value S. Specifically, this includes: Get the preset maximum number of mimicry disks n max The system administrator pre-sets the number of dummy disks based on the total number of disks and performance budget to ensure that the number of dummy disks does not exceed the system's maximum capacity.

[0048] Calculate the target mimicry disk number n: based on the security situation value S and the maximum number of mimicry disks n max The target number of mimicry discs, n, is calculated using a configured adjustment formula, where n is positively correlated with S. The adjustment formula is: ; Here, `round()` represents rounding to the nearest integer. This formula ensures that n is between 1 and n... max It is between, and increases with the increase of S.

[0049] Adjust the number of mimic disks: Adjust the number of disks identified as mimic disks in the system to the target number of mimic disks n. If the current number of mimic disks is less than n, add disks as mimic disks according to the strategy in step 105; if the current number is greater than n, release some mimic disks (i.e., subsequent scans will no longer use the mimicry method), prioritizing disks with lower importance or fewer historical attacks when releasing them.

[0050] Through the above dynamic adjustments, the system can automatically enhance defense during peak attack periods (increasing the number of mimic disks) and automatically save resources during peacetime (reducing the number of mimic disks), thus achieving adaptive security protection.

[0051] Furthermore, this application introduces the Q-learning reinforcement learning algorithm to intelligently optimize the dynamic adjustment process of the number of mimic disks, enabling the system to learn the optimal adjustment strategy in a complex and ever-changing attack environment.

[0052] Step 31: Construct the Q-learning model The core elements defining a Q-learning model are as follows: State Space: The system's state is composed of key features at the current moment, including at least the current number of attacks (A), defense strength value (D), and the number of spoofed disks (n). More features can be added as needed, such as average disk load and network traffic.

[0053] Action Space: The system can execute the following actions: increase the number of mimic disks (+1), decrease the number of mimic disks (-1), and keep the number of mimic disks unchanged (0). The selection of actions must ensure that the adjusted number of mimic disks always remains within [1, n]. max Within the range.

[0054] Reward Function: After performing an action, the system provides an immediate reward based on the effectiveness of the defense. The reward function is set based on the adjusted defense effect: if the action successfully defends against subsequent attacks (e.g., no security incidents occur within a certain period), a positive reward (e.g., +1) is given; if an attack occurs or the defense fails, a negative reward (e.g., -1) is given. It can also be designed in conjunction with scanning performance overhead; for example, if the number of simulated disks is small (low performance overhead) while successfully defending, the reward will be higher.

[0055] Step 32: Train the Q-learning model The Q-learning model is iteratively trained using the following steps to optimize the decision-making strategy: Initialization: Initialize the Q-table (or neural network) by setting the Q-value of all state-action pairs to 0.

[0056] Obtain the current state: At each decision moment (e.g., every 5 minutes), the current state s of the system is input into the Q-learning model. The state s includes the current number of attacks A, defense strength D, number of mimic disks n, etc.

[0057] Action selection: Select action a according to the ε-greedy policy: explore randomly with probability ε (randomly select an action), otherwise select the action with the largest current Q value.

[0058] Action to be performed: Execute the action 'a' output by the Q-learning model to adjust the number of mimic disks, i.e., increase, decrease, or maintain the number of mimic disks.

[0059] Reward Feedback: After performing the action, a corresponding reward feedback r is obtained based on whether the system defense is successful. For example, observe whether an attack event occurs within the next time window; if no attack occurs, the reward r = +1; otherwise, r = -1.

[0060] Update Q-value: Update the Q-value of the Q-learning model using reward feedback, using the following formula:

[0061] Where α is the learning rate (0 < α ≤ 1), γ is the discount factor (0 ≤ γ ≤ 1), and s' is the next state reached after the action is performed.

[0062] Repeat the iterations until the Q-value converges or the preset number of training iterations is reached.

[0063] After sufficient training, the Q-learning model can autonomously make decisions on the optimal mimicry disk adjustment actions based on real-time status, enabling the system to maintain a high level of defense in dynamic threat environments.

[0064] In another preferred embodiment, this is used to prevent attackers from gradually understanding the patterns of heterogeneous code copies through long-term analysis, thereby further enhancing the system's persistent defense capabilities.

[0065] Step 41: Trigger update conditions The heterogeneous disk scan code copies in the heterogeneous execution pool need to be dynamically updated. Updates can be triggered by the following conditions: Regular updates: Set an update cycle (e.g., once a week), which will be triggered automatically when the cycle is reached.

[0066] Preset conditions trigger: When an update is triggered when it is detected that a certain code copy has been exploited by an attacker (for example, the scan results generated by this copy are inconsistent with other copies for a long time and are confirmed to be malicious tampering), or when the system security posture remains high.

[0067] Step 42: Perform the update operation Dynamic updates include the following steps: Select the copy to be updated: Determine whether some or all of the heterogeneous disk scan code copies in the heterogeneous execution pool need to be updated.

[0068] Re-heterogeneization: Re-perform code heterogeneity processing on the selected copy (such as replacing with a new random identifier, re-obfuscating the control flow, replacing the algorithm, etc.) to generate a new heterogeneous code copy.

[0069] Replace existing copy: Replace the corresponding existing code copy in the pool with the newly generated heterogeneous code copy and update the relevant records.

[0070] By dynamically updating, attackers find it difficult to accumulate enough knowledge to crack the system, further enhancing the durability and reliability of the defense.

[0071] This application, by combining code heterogeneity, a mimicry disk mechanism, and adaptive security posture analysis, can effectively improve the security and intelligence level of disk scanning. It includes the following advantages: 1. Dynamic Adaptation: Through real-time assessment of security posture and dynamic adjustment of the number of mimic disks, the system can flexibly respond to various attacks.

[0072] 2. Enhanced security: Through heterogeneity and mimicry disk mechanisms, the unpredictability of the disk scanning process is improved, preventing backdoor and code tampering attacks.

[0073] 3. Intelligent optimization: The defense strategy is optimized through the Q-learning algorithm, enabling the system to automatically learn and adjust the optimal defense strategy in different attack environments.

[0074] 4. Effective protection against backdoor attacks and code tampering: This solution can effectively resist backdoor attacks and code tampering, improving the overall security of the system.

[0075] Corresponding to the above method, embodiments of this application also provide a disk scanning device based on mimicry defense, such as... Figure 2 As shown, the device includes: Selection unit 210 is used to select multiple heterogeneous disk scan code copies from a pre-generated heterogeneous execution pool in response to a scan trigger event for the target disk. The scanning unit 220 is used to perform scanning operations on the target disk by selecting multiple copies of the disk scan code respectively, and obtain multiple initial scan results; The determining unit 230 is used to perform adjudication processing on the multiple initial scan results to determine the final disk scan result.

[0076] The functions of each functional unit in the disk scanning device based on mimicry defense provided in the above embodiments of this application can be implemented through the above method steps. Therefore, the specific working process and beneficial effects of each unit in the disk scanning device based on mimicry defense provided in the embodiments of this application will not be repeated here.

[0077] This application also provides an electronic device, such as... Figure 3 As shown, it includes a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340.

[0078] Memory 330 is used to store computer programs; When the processor 310 executes the program stored in the memory 330, it performs the following steps: In response to a scan-triggered event targeting the target disk, select multiple heterogeneous disk scan code copies from a pre-generated pool of heterogeneous execution bodies; The selected copies of the disk scan code are used to perform a scan operation on the target disk to obtain multiple initial scan results; The multiple initial scan results are processed to determine the final disk scan result.

[0079] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0080] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0081] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0082] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0083] The implementation methods and beneficial effects of the various components of the electronic device in the above embodiments for solving the problem can be found in [reference needed]. Figure 1 The steps in the illustrated embodiments are used to implement the electronic device. Therefore, the specific working process and beneficial effects of the electronic device provided in this application will not be repeated here.

[0084] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform any of the disk scanning methods based on mimicry defense described in the above embodiments.

[0085] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the disk scanning methods based on mimicry defense described in the above embodiments.

[0086] Those skilled in the art will understand that the embodiments in this application can be provided as methods, systems, or computer program products. Therefore, the embodiments in this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments in this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0090] Although preferred embodiments have been described in this application, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of this application.

[0091] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims in this application and their equivalents, then this application also intends to include these modifications and variations.

Claims

1. A disk scanning method based on mimicry defense, characterized in that, The method includes: In response to a scan-triggered event targeting the target disk, select multiple heterogeneous disk scan code copies from a pre-generated pool of heterogeneous execution bodies; The selected copies of the disk scan code are used to perform a scan operation on the target disk to obtain multiple initial scan results; The multiple initial scan results are processed to determine the final disk scan result.

2. The method as described in claim 1, characterized in that, The pre-generation process of heterogeneous code copies in the heterogeneous execution pool includes: Obtain the raw code for the disk scan; The original code is subjected to code heterogeneity processing to generate multiple heterogeneous code copies with the same scanning function but different internal implementation logic; Multiple heterogeneous code copies generated are stored in the heterogeneous execution pool.

3. The method as described in claim 2, characterized in that, The original code is subjected to code heterogeneity processing, including at least one of the following operations: The identifiers in the original code are randomly replaced; The control flow of the original code is rearranged or obfuscated; The first algorithm in the original code is replaced with a functionally equivalent second algorithm.

4. The method as described in claim 1, characterized in that, Before selecting multiple heterogeneous disk scan code copies, the method further includes: Obtain a preset disk selection strategy, which is generated based on historical attack data and / or disk importance data of the disk; The target disk is determined from multiple candidate disks as the mimic disk according to the disk selection strategy.

5. The method as described in claim 1, characterized in that, The multiple initial scan results are processed to determine the final disk scan result, including: The initial scan results are evaluated by a majority vote, and the scan result that appears most frequently is determined as the final disk scan result.

6. The method as described in claim 1, characterized in that, The method further includes: Obtain the number of attacks the system has suffered within a preset time period and the system's current defense strength value; The ratio of the number of attacks to the defense strength value is determined as the security situation value; The number of disks identified as mimic disks is dynamically adjusted based on the security status value.

7. The method as described in claim 6, characterized in that, Based on the security status value, the number of disks identified as mimic disks is dynamically adjusted, including: Get the preset maximum number of mimicry disks; Based on the security situation value and the maximum number of mimicry disks, the target number of mimicry disks is calculated using a configured adjustment formula, wherein the target number of mimicry disks is positively correlated with the security situation value; The number of disks identified as mimic disks will be adjusted to the target number of mimic disks.

8. A disk scanning device based on mimicry defense, characterized in that, The device includes: The selection unit is used to select multiple heterogeneous disk scan code copies from a pre-generated pool of heterogeneous execution bodies in response to a scan trigger event targeting the target disk. The scanning unit is used to perform scanning operations on the target disk by selecting multiple copies of the disk scan code respectively, and obtain multiple initial scan results; The determining unit is used to process the multiple initial scan results and determine the final disk scan result.

9. An electronic device, characterized in that, The electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method of any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images