Method and system for scheduling security state convergence of a mimic system based on data characteristics

Abstract

The present application relates to the technical field of mimicry defense, and particularly relates to a mimicry system security state convergence scheduling method and system based on data features, which extracts full mimicry decision message multi-dimensional state data and stores persistently by structuring feature identification of service traffic; candidate scheduling schemes are obtained by multi-modal historical data matching and searching based on multi-dimensional features, and the system disturbance intensity corresponding to each candidate scheduling scheme is calculated quantitatively to select the optimal scheduling strategy with the minimum disturbance and issue it to the scheduling controller, and the parameter is iterated automatically through the feedback of scheduling execution results. The present application outputs the optimal scheduling strategy with the minimum global disturbance by service data feature identification, decision message multi-dimensional extraction, weighted historical data structured storage, multi-modal feature matching and searching and system disturbance quantitative calculation, which can accelerate the security state convergence of the mimicry system, reduce the attack escape probability, improve the overall security of the system and improve the mimicry defense effect of the business system.

Description

Technical Field

[0001] This invention relates to the field of mimicry defense technology, and in particular to a method and system for scheduling the security state convergence of mimicry systems based on data characteristics. Background Technology

[0002] The mimicry defense relies on a Dynamic Heterogeneous Redundancy (DHR) architecture to build a negative feedback closed-loop control system. Its core components include an input agent, a heterogeneous reconfigurable executor cluster, an output adjudication agent, and a feedback scheduling controller. The scheduling strategy module, as the core unit of the closed-loop control, is responsible for distributing external business requests to designated heterogeneous executors. It also supports dynamic adjustment operations such as executor replacement, shutdown, business load migration, and dynamic switching of operating scenarios. The scheduling logic directly determines the mimicry system's ability to resist persistent differential attacks.

[0003] Current mainstream mimicry scheduling strategies mostly employ single scheduling logics such as random polling, fixed weights, and static polling, failing to integrate multi-dimensional security posture data such as business data characteristics, real-time execution status, historical adjudication anomaly records, and business load. Attackers can exploit long-term traffic observation to uncover fixed patterns in scheduling cycles and execution allocation, constructing persistent differential attacks to escape, significantly weakening the heterogeneous redundancy fault tolerance capability of mimicry defenses. Furthermore, the security convergence speed of mimicry systems is strongly coupled with the accuracy of scheduling strategies; accurate scheduling can quickly eliminate attack disturbances and reduce the number of adjudication inconsistencies; inefficient scheduling will continuously trigger execution anomalies and repeatedly generate adjudication conflicts, prolonging the system's steady-state recovery period. Existing algorithms do not perform feature fusion and quantitative analysis on multi-dimensional adjudication data, making it impossible to quantitatively assess the impact of different scheduling schemes on system stability. Poor convergence speed and continuous system disturbances lead to an expanded attack observation window, thereby affecting the mimicry defense effectiveness of business systems. Summary of the Invention

[0004] To address the problems of existing mimicry systems, such as single scheduling dimension, susceptibility to attackers capturing scheduling patterns, low security state convergence speed, and frequent disturbances, this invention provides a mimicry system security state convergence scheduling method and system based on data features. By identifying business data features, extracting adjudication messages from multiple dimensions, storing weighted historical data in a structured manner, performing multimodal feature matching and retrieval, and quantifying system disturbances, the optimal scheduling strategy with the minimum global disturbance is output. This can significantly reduce the probability of attack escape, improve the overall security of the system, accelerate the convergence of the system's security state, and shorten the duration of system disturbances.

[0005] According to the design scheme provided by this invention, on the one hand, a method for a mimicry system security state convergence scheduling system based on data features is provided, comprising:

[0006] Multidimensional feature data of the current mimicry adjudication message is extracted, and multimodal feature matching query is performed in the scheduling strategy database using the multidimensional feature data as the retrieval index to obtain candidate scheduling schemes. The scheduling strategy database stores mimicry adjudication message feature data and corresponding scheduling strategy scheme records. The multidimensional feature data includes: global state set of the execution entity, online heterogeneous execution entity number set, business load set, multimodal adjudication result classification identifier, and adjudication timestamp.

[0007] Based on the characteristic data of the mimicry decision message and using adaptive parameters to quantify the system disturbance intensity corresponding to each candidate scheduling scheme, the candidate scheduling scheme with the smallest disturbance intensity is selected as the optimal scheduling strategy and sent to the scheduling controller. At the same time, the adaptive parameters are optimized by feedback based on the optimal scheduling strategy.

[0008] As a data feature-based mimicry system security state convergence scheduling method of the present invention, further, multi-dimensional feature data of the current mimicry decision message is extracted, including:

[0009] Based on the type of business carried by the mimicry system, the structured features of the business traffic are extracted in segments to obtain a set of business features that characterize the business attributes or attack attributes of the current business traffic. Among them, the segmented features of a single business traffic segment include request address, message length, operation command, business interface and data payload type.

[0010] Based on the comparison results of the outputs of multiple executors, a standardized message for the current mimicry decision is generated, and multidimensional feature data is extracted from the message.

[0011] As a data feature-based mimicry system safety state convergence scheduling method of the present invention, the scheduling strategy database further stores mimicry decision message feature data and corresponding scheduling strategy scheme records, and the process includes:

[0012] Based on the service type carried by the mimicry system, the historical service traffic is structured and characterized, and multi-dimensional feature data of the corresponding mimicry adjudication message is extracted;

[0013] The structured characteristics of business traffic, the multi-dimensional characteristic data of corresponding mimicry decision messages, and the scheduling decision set are weighted and aggregated to form a scheduling policy record, which is then persistently stored in the scheduling policy database.

[0014] As a data feature-based mimicry system safety state convergence scheduling method of the present invention, further, using multi-dimensional feature data as a retrieval index, a multi-modal feature matching query is performed in the scheduling strategy database, including:

[0015] Map the multidimensional data features of the current mimicry adjudication message and the multidimensional features in the scheduling strategy record to the [0,1] interval;

[0016] The similarity of features is calculated using weighted Euclidean distance. The set of scheduling strategy schemes with a distance less than the similarity threshold is selected. If there are multiple records with the same distance in the set, the record with the largest decision timestamp is retained. If the set is empty, the executor with the highest heterogeneity and the best running state is selected as the scheduling decision, forming the current scheduling strategy record and storing it in the scheduling strategy database.

[0017] As a data feature-based mimicry system safety state convergence scheduling method of the present invention, further comprising performing multimodal feature matching query in the scheduling policy database, and including:

[0018] A sliding window is used to retain a specified number of valid matching records. Records exceeding the specified number are automatically archived to disk for cold storage. When the similarity threshold is adjusted, the data is retrieved from the disk cold storage and the feature similarity is recalculated.

[0019] When calculating similarity, irrelevant records are first filtered out by the hash value of the structured features of business traffic, and then the weighted Euclidean distance is calculated for the remaining records.

[0020] A memory index is built based on the weighted Euclidean distance of the records, and the top K records are scanned for matching based on the memory index.

[0021] As a data feature-based method for convergent scheduling of mimicry systems, the present invention further utilizes adaptive parameters to quantify the system disturbance intensity corresponding to each candidate scheduling scheme. The quantization process is expressed as follows: ,in, These are, respectively, disturbances to the global state set of the execution entity, disturbances to the online heterogeneous execution entity number set, disturbances to the business load set, disturbances to the multi-mode adjudication result classification identifier, and disturbances to the scheduling decision set. , , , , , To map feature vectors to scalar aggregation functions, This is the current timestamp of the ruling. The timestamp corresponding to the historical record with the smallest weighted Euclidean distance value in the matched candidate scheduling scheme set. , , , , These are the weights of the corresponding items. This is the penalty coefficient for abnormal rulings.

[0022] As a data feature-based mimicry system safety state convergence scheduling method of the present invention, further, the candidate scheduling scheme with the minimum disturbance intensity is selected as the optimal scheduling strategy, including:

[0023] Calculate the minimum system disturbance intensity in the candidate scheduling scheme set, and obtain the scheduling decision set corresponding to the minimum system disturbance intensity;

[0024] The obtained scheduling decision set is taken as the optimal scheduling scheme. If there are multiple candidate scheduling schemes corresponding to the minimum system disturbance intensity, the scheduling decision set corresponding to the candidate scheduling scheme with the closest timestamp is taken as the optimal scheduling scheme.

[0025] Furthermore, this invention also provides a mimicry system safety state convergence scheduling system based on data features, comprising: a matching query module and an optimal output module, wherein,

[0026] The matching query module is used to extract multi-dimensional feature data of the current mimicry adjudication message and use the multi-dimensional feature data as a retrieval index to perform multi-modal feature matching query in the scheduling strategy database to obtain candidate scheduling schemes. The scheduling strategy database stores mimicry adjudication message feature data and corresponding scheduling strategy scheme records. The multi-dimensional feature data includes: a global state set of the execution entity, a set of online heterogeneous execution entity numbers, a set of business loads, a multi-modal adjudication result classification identifier, and an adjudication timestamp.

[0027] The optimal output module is used to quantify the system disturbance intensity corresponding to each candidate scheduling scheme based on the mimicry decision message feature data and adaptive parameters, select the candidate scheduling scheme with the smallest disturbance intensity as the optimal scheduling strategy and send it to the scheduling controller, and at the same time perform feedback optimization of adaptive parameters according to the optimal scheduling strategy.

[0028] The beneficial effects of this invention are:

[0029] 1. This invention extracts and persistently stores multi-dimensional state data of all mimicry adjudication messages by performing structured feature identification on business traffic; it obtains candidate scheduling schemes by performing multi-modal historical data matching and retrieval based on multi-dimensional features; it selects the optimal scheduling strategy with the least disturbance by quantitatively calculating the system disturbance intensity corresponding to each candidate scheduling scheme and sends it to the scheduling controller; at the same time, it realizes parameter self-iteration through the feedback of scheduling execution results, accelerates the convergence of the mimicry system's security state, and improves the mimicry defense effect of the business system.

[0030] 2. This invention transforms the mimicry defense security countermeasure problem into a quantitative solution problem for the equilibrium point stability of a nonlinear control system. Through weighted modeling using multi-dimensional historical decision data, it quantitatively assesses the degree of system disturbance caused by different scheduling schemes, avoiding attackers' detection of fixed scheduling patterns, significantly reducing the number of inconsistent decision disturbances, and blocking differential attack escape paths from the scheduling level. Simultaneously, it incorporates a penalty coefficient... Embedded system disturbance Quantitative calculations reveal that in high-intensity scenarios with inconsistencies among multiple execution entities, the disturbance value is significantly amplified, and the scheduling algorithm prioritizes avoiding high-risk allocation schemes.

[0031] 3. This invention integrates multi-dimensional data such as business characteristics, execution entity status, heterogeneous combinations, and adjudication results for joint matching analysis, significantly improving the accuracy of scheduling strategy matching. It prioritizes the scheduling scheme with the least disturbance, allowing the system to quickly return to a steady-state equilibrium point after an attack, shortening the duration of disturbances and narrowing the attack observation window. By introducing normalized multi-dimensional feature weights, the influence ratio of each dimension can be dynamically adjusted according to business security level, execution entity heterogeneity, and load pressure. A new adaptive parameter update closed-loop process is also added, allowing the system to automatically iterate and optimize based on long-term disturbance intensity. Matching threshold It eliminates the need for frequent manual modifications to scheduling rules and adaptively responds to dynamic scenarios such as traffic fluctuations, execution failures, and persistent network attacks.

[0032] 4. This invention only modifies the scheduling control module and the adjudication data storage module, without requiring changes to the input agent, heterogeneous executor, or output adjudication core components. The calculation formula eliminates meaningless static indices and uniform-speed timestamp differential terms, reducing real-time scheduling computational power consumption. It can be directly deployed on various distributed heterogeneous redundant security devices such as existing Web mimicry gateways, industrial control mimicry devices, and database mimicry protection systems, making it widely applicable. It integrates business attack fingerprint features for similarity retrieval, improving historical matching accuracy, and combines multi-dimensional system state quantification to calculate disturbance values. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the convergence scheduling process of the safety state of the mimicry system based on data features in the embodiment. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0035] To address the technical shortcomings of existing mimicry scheduling algorithms, such as limited dimensionality and slow convergence speed, this embodiment addresses these shortcomings. Figure 1 As shown, a method for a convergent scheduling system for the safe state of a mimicry system based on data features is provided, comprising:

[0036] S101. Extract the multi-dimensional feature data of the current mimicry adjudication message, and use the multi-dimensional feature data as a retrieval index to perform multi-modal feature matching query in the scheduling strategy database to obtain candidate scheduling schemes. The scheduling strategy database stores mimicry adjudication message feature data and corresponding scheduling strategy scheme records. The multi-dimensional feature data includes: global state set of the execution body, online heterogeneous execution body number set, business load set, multi-modal adjudication result classification identifier, and adjudication timestamp.

[0037] Specifically, based on the type of business carried by the mimicry system, the structured features of the business traffic are extracted in segments to obtain a set of business features that characterize the business attributes or attack attributes of the current business traffic. The segmented features of a single business traffic segment include the request address, message length, operation instruction, business interface, and data payload type. Based on the comparison results of the outputs of multiple execution entities, a standardized message for the current mimicry ruling is generated, and multi-dimensional feature data in the message is extracted.

[0038] Based on the type of business carried by the mimicry system (Web services, industrial control, database gateways, etc.), segmented structured feature extraction is performed on the input business traffic to construct a set of business features with attack fingerprint attributes: In the formula This section defines the segmented characteristics of individual business traffic, including dimensions such as request source address, packet length, operation command, business interface, and data payload type. These characteristics serve as an index for retrieving similar historical events using attack fingerprints. This set C represents the business attributes or attack characteristics of the current traffic, serving as the sole index for subsequent retrieval of similar historical disturbance events. During system operation, if unknown attack characteristics are detected (such as unrecorded packet payloads or abnormal operation commands), these characteristics are automatically expanded to... This set enables dynamic updating of attack fingerprints.

[0039] After the output adjudication agent completes the comparison of outputs from multiple executors, it generates a standardized adjudication message. The message contains five core feature dimensions: the global state set of the executor S, the set of currently online heterogeneous executor numbers H, the set of currently pending business loads P, the multi-mode adjudication result classification identifier J, and the adjudication timestamp T.

[0040] in, Execution state set The quantized values ​​of CPU, memory, and number of failures for the i-th execution unit (normalized to [0,1], the larger the value, the worse the state). The current set of objective states of online executors, i.e., the heterogeneous executor numbers that the input agent has actually selected and are currently receiving full copies of business traffic; (The higher the heterogeneity, the higher the score, and the higher the basic security), dynamically reflecting the real-time topology of the system. The business load set includes quantitative metrics such as request concurrency, average processing latency, and traffic size (normalized to [0,1]). The scheduling decision target set is the optimal combination of execution body numbers output by this algorithm after matching and analyzing historical data.

[0041] To eliminate differences in multidimensional dimensions and achieve quantitative comparison of states, an aggregation function F(X) is defined to map multidimensional feature vectors to one-dimensional scalars:

[0042]

[0043] In the formula This is the set of features to be processed. This operator transforms complex data structures such as execution state and load into a comprehensive score that can participate in algebraic operations by taking the arithmetic mean of each normalized element in the set. This is an important foundation for subsequent calculations of state difference and perturbation quantization.

[0044] To quantify the dynamic change trend of the system, continuous differential operations, which are unsuitable for discrete storage systems, are abandoned. Instead, discrete difference approximation is used to characterize the rate of state change, eliminating the problem of mutual cancellation of positive and negative fluctuations.

[0045]

[0046] in, The timestamps of two adjacent historical records. This represents the change in characteristic values ​​within the corresponding time period. Rule explanation: When... When timestamps are repeated, the difference value is set to 0 to avoid division by zero errors. This specification transforms static state monitoring into dynamic trend analysis, which is the core basis for assessing the intensity of system disturbances.

[0047] The classification identifier for multi-mode adjudication results (non-set) is quantified and scored as follows according to the following rules:

[0048] Assume the output values ​​of the three online heterogeneous execution units are , , The discrete set of adjudication results:

[0049] : Steady-state scenario with no disturbances; : The single executor outputs an error; : The single executor outputs an error; : The single executor outputs an error; : All three executors output abnormalities, indicating a strong attack and disturbance scenario. The corresponding quantitative scoring rules are as follows:

[0050] .

[0051] Specifically, the historical service traffic is structured and characterized based on the type of service carried by the mimicry system, and multi-dimensional feature data of the corresponding mimicry decision messages are extracted. The structured features of the service traffic, the multi-dimensional feature data of the corresponding mimicry decision messages, and the scheduling decision set are weighted and aggregated to form a scheduling policy record, and the scheduling policy record is persistently stored in the scheduling policy database.

[0052] All failed and abnormal decision messages are stored in the scheduling strategy database, and a weighted aggregation calculation is first performed on each dimension of features:

[0053]

[0054] A single storage record is defined using a normalized tuple D:

[0055]

[0056] Where N is the globally unique serial number of the database record, which is only used for indexing and deduplication and does not participate in the perturbation quantization calculation; T is the adjudication timestamp, a monotonic time series variable. Weighted execution state item; Weighted online execution heterogeneity term; Weighted business load items; The weighted decision result item with a penalty coefficient; Weighted historical scheduling allocation scheme items; Business characteristics that possess attack fingerprint attributes; , Random scheduling flag, with values ​​of 0 / 1, where 0 indicates random scheduling is not enabled and 1 indicates random scheduling is enabled. It records random behavior for subsequent feature matching and tracing. G, the overall system disturbance quantification index (stability index) corresponding to this record. The larger the G value, the stronger the system disturbance and the worse the convergence performance.

[0057] When the system initializes the first timestamp record, it sets G=0 and directly stores it in the database, completing the writing of the first record during cold start; if the database contains only one historical record, that record is used directly as the database entry. ;like If the difference term is 0, then the G value corresponding to the newly added record is calculated. During the calculation, the historical timestamp with the smallest Dist value in set Q is taken as the value. .

[0058] Specifically, using multidimensional feature data as the retrieval index, multimodal feature matching queries are performed in the scheduling strategy database, which can be designed to include:

[0059] Map the multidimensional data features of the current mimicry adjudication message and the multidimensional features in the scheduling strategy record to the [0,1] interval;

[0060] The similarity of features is calculated using weighted Euclidean distance. The set of scheduling strategy schemes with a distance less than the similarity threshold is selected. If there are multiple records with the same distance in the set, the record with the largest decision timestamp is retained. If the set is empty, the executor with the highest heterogeneity and the best running state is selected as the scheduling decision, forming the current scheduling strategy record and storing it in the scheduling strategy database.

[0061] The mimicry DHR architecture is a typical multi-input multi-output nonlinear control system, where the system's safe steady state is equivalent to the equilibrium point of the nonlinear system. Based on the currently acquired real-time data... Multidimensional features serve as the retrieval index, performing multimodal feature matching queries in the scheduling strategy database. The specific rules can be summarized as follows:

[0062] First, eigenvector normalization

[0063] Map the current features and historical features across all dimensions to the [0,1] interval to eliminate dimensional differences:

[0064]

[0065] in , These are the historical minimum and maximum values ​​of this feature in the database, respectively. For the execution state set S and the business load set P, normalization operations need to be performed on each of their internal sub-items (such as CPU, memory, etc.) before aggregation calculation; for the heterogeneity set H, since its score is preset in the [0,1] interval, it can be considered as having completed normalization. If Then let =0.5.

[0066] Secondly, similarity calculation

[0067] The similarity matching threshold is set and can be dynamically adjusted; the default initial value is 0.1. A weighted Euclidean distance is used to measure feature similarity; the smaller the distance, the higher the similarity. Not included in this similarity calculation, but only used for subsequent perturbation quantization:

[0068]

[0069] Furthermore, matching record filtering

[0070] Set similarity threshold =0.1 (can be dynamically adjusted according to business accuracy requirements), filter distance Dist≤ Historical matching record set: Elements within a set For triples: For historical scheduling and allocation schemes, This represents the historical disturbance value corresponding to this scheme. This corresponds to the timestamp.

[0071] The timestamp corresponding to the historical record with the smallest Dist value in set Q is selected. If multiple historical records have the same Dist value (equal similarity), the timestamp is chosen. The largest (latest) record is used as the difference benchmark to avoid ambiguity due to multiple records; if the matching record set Q is empty, then G = +∞, and the default scheduling strategy is directly adopted. That is, select the three executors with the highest heterogeneity and the best running state to form a set A, perform full copying and distribution of input traffic, and then jump to the record storage step to complete the storage of the default scheduling record, skipping the subsequent perturbation calculation step.

[0072] To ensure long-term computational efficiency and memory controllability, the following rules can be used for optimization in this embodiment:

[0073] Sliding window storage: Only the most recent 100,000 valid matching records are retained, and the excess are automatically archived to cold storage on disk. Data is only recalled from cold storage and features are recalculated when the matching threshold θ is adjusted.

[0074] Feature cache cleanup: After feature space alignment is completed, redundant feature caches under old weights are automatically cleaned up to avoid memory leaks;

[0075] Matching pruning strategy: Before similarity calculation, filter more than 90% of irrelevant records by the hash value of business feature C, and then calculate Dist for the remaining records, which greatly reduces the amount of computation.

[0076] Indexing acceleration: Build an in-memory index by sorting by Dist value. When matching, only the top K similar records need to be scanned, without having to traverse the entire history database.

[0077] S102. Based on the characteristic data of the mimicry decision message and using adaptive parameters to quantify the system disturbance intensity corresponding to each candidate scheduling scheme, select the candidate scheduling scheme with the smallest disturbance intensity as the optimal scheduling strategy and send it to the scheduling controller. At the same time, the adaptive parameters are optimized by feedback based on the optimal scheduling strategy.

[0078] The system disturbance intensity corresponding to each candidate scheduling scheme is quantified using adaptive parameters. The quantization process can be expressed as follows: ,in, These are, respectively, disturbances to the global state set of the execution entity, disturbances to the online heterogeneous execution entity number set, disturbances to the business load set, disturbances to the multi-mode adjudication result classification identifier, and disturbances to the scheduling decision set. , , , , , To map feature vectors to scalar aggregation functions, This is the current timestamp of the ruling. The timestamp corresponding to the historical record with the smallest weighted Euclidean distance value in the matched candidate scheduling scheme set. , , , , These are the weights of the corresponding items. The penalty coefficient for abnormal rulings. ≥1, representing the percentage of calculations used to amplify high-intensity attack disturbances. This is the current timestamp of the ruling. Let Q be the timestamp corresponding to the historical record with the smallest Dist value. If multiple historical records have the same Dist value (equal similarity), then the record with the largest timestamp is selected as the final record. When calculating the current value of G, it is based only on... and The state difference between these two points in time is obtained, and compared with the historical record itself. The calculation process is irrelevant.

[0079] in, The weight of the execution entity's operating state dimension represents the degree of influence of the execution entity's load and fault state on system disturbances. Online heterogeneous execution dimension weights characterize the degree of influence of differences in execution heterogeneity on system disturbances. The business load dimension weight represents the degree of impact of business traffic and concurrency pressure on system disturbances. The weight of the adjudication result dimension represents the degree of fundamental impact of inconsistent outputs of multiple executors on system disturbances. The business feature dimension weight represents the degree of influence of historical attack fingerprints or business flow similarity on historical feature matching retrieval, and does not directly participate in the calculation of system perturbation quantification (G). Furthermore, there exists a value of 0 < 1. <1、 + + + + = 1 weight normalization constraint. The weights of historical scheduling and allocation schemes characterize the degree of influence of the traffic allocation strategy itself on system disturbances; Independent of the retrieval weight set, it is a single independent adjustment coefficient used only to calculate the internal disturbances caused by switching the execution body, and does not participate in historical retrieval.

[0080] G represents the overall dynamic disturbance intensity of the mimicry system; G→0 means that the rate of change of all dimensions approaches 0, the system reaches the nonlinear equilibrium point, and the safe state is fully converged; the smaller the G value corresponding to the same candidate scheduling scheme, the lower the system fluctuation, the faster the convergence speed, and the smaller the attack observation escape window under the traffic allocation strategy. Set as the global perturbation threshold to trigger adaptive weight updates. The default value is 30% above the mean of G under steady-state conditions.

[0081] Specifically, selecting the candidate scheduling scheme with the minimum disturbance intensity as the optimal scheduling strategy can be designed to include:

[0082] Calculate the minimum system disturbance intensity in the candidate scheduling scheme set, and obtain the scheduling decision set corresponding to the minimum system disturbance intensity;

[0083] The obtained scheduling decision set is taken as the optimal scheduling scheme. If there are multiple candidate scheduling schemes corresponding to the minimum system disturbance intensity, the scheduling decision set corresponding to the candidate scheduling scheme with the closest timestamp is taken as the optimal scheduling scheme.

[0084] Calculate the minimum perturbation value corresponding to all candidate schedules within the matching set, denoted as: Select a subset of schedules whose perturbations equal the minimum value, and represent it as: The optimal scheduling output piecewise function can be expressed as follows:

[0085]

[0086] Rule description: Prioritize the scheduling scheme with the smallest disturbance value G; if multiple scheduling schemes have the same disturbance value, select the historical scheduling scheme with the latest timestamp T (most recent in time sequence) as the output strategy.

[0087] To further prevent the scheduling patterns from being captured by attackers, when And the timestamp difference of multiple schemes When introducing a random factor that follows a uniform distribution. :like (5% probability), then from Randomly select a non-latest solution as R, and simultaneously mark the tuples. =1; other scenarios =0. The data is persistently stored with the tuples and then incorporated as a binary auxiliary feature into the similarity calculation during subsequent multimodal matching, ensuring that random scheduling behavior is traceable.

[0088] The optimal allocation scheme R is pushed to the mimicry scheduling controller to complete the business traffic replication and distribution and the dynamic adjustment of the execution body.

[0089] Based on the optimal scheduling strategy, feedback optimization of adaptive parameters is performed to achieve autonomous iteration. This process can be summarized as including the following:

[0090] (1) Parameter update triggering condition: After the current round of scheduling is completed, a new round of decision messages is collected and the current total disturbance G is calculated;

[0091] (2) Adaptive weight adjustment: Set global perturbation threshold If 10 consecutive records are judged The system is under intense attack and disturbance, increasing the weight of the adjudication dimension. The remaining weights are normalized and allocated according to their original values ​​as a proportion of the total remaining weights, ensuring... + + + + = 1; simultaneously, the independent scheduling weight is adjusted independently based on the execution unit switching frequency. (0) <1) If frequent switching causes increased system jitter, then appropriately increase the power level. To suppress unnecessary switching;

[0092] (3) Similarity threshold Dynamic adjustment: The Dist value is calculated based on the average of the last 100 historical matching records. If the average Dist value remains consistently high, it will be slightly increased. If the number of matching samples is too small, the reduction will be slight. Each adjustment should not exceed 10% of the initial value to avoid excessive jumps that could affect matching stability.

[0093] (4) Attack fingerprint expansion: If a payload or instruction feature that has never been matched before appears in the business feature set C, a new feature is added. Stored in the feature database to continuously enrich the dimensions of attack fingerprint retrieval;

[0094] (5) Feature space alignment (resolving circular dependencies): when weights or threshold After the adjustment, all records in the historical database need to be recalculated. In addition, the Dist value is used to ensure the consistency of the feature space measurement standard and eliminate the problem of historical data incomparability caused by weight changes.

[0095] (6) Loop jump: After the parameter update is completed, return and process the next business traffic, thus forming a complete closed loop of feature extraction-storage-matching-disturbance calculation-scheduling and distribution-parameter self-update.

[0096] Furthermore, based on the above method, embodiments of the present invention also provide a data feature-based mimicry system security state convergence scheduling system, comprising: a matching query module and an optimal output module, wherein,

[0097] The matching query module is used to extract multi-dimensional feature data of the current mimicry adjudication message and use the multi-dimensional feature data as a retrieval index to perform multi-modal feature matching query in the scheduling strategy database to obtain candidate scheduling schemes. The scheduling strategy database stores mimicry adjudication message feature data and corresponding scheduling strategy scheme records. The multi-dimensional feature data includes: a global state set of the execution entity, a set of online heterogeneous execution entity numbers, a set of business loads, a multi-modal adjudication result classification identifier, and an adjudication timestamp.

[0098] The optimal output module is used to quantify the system disturbance intensity corresponding to each candidate scheduling scheme based on the mimicry decision message feature data and adaptive parameters, select the candidate scheduling scheme with the smallest disturbance intensity as the optimal scheduling strategy and send it to the scheduling controller, and at the same time perform feedback optimization of adaptive parameters according to the optimal scheduling strategy.

[0099] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0101] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0102] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0103] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for scheduling the safe state convergence of a mimicry system based on data features, characterized in that, Include: Multidimensional feature data of the current mimicry adjudication message is extracted, and multimodal feature matching query is performed in the scheduling strategy database using the multidimensional feature data as the retrieval index to obtain candidate scheduling schemes. The scheduling strategy database stores mimicry adjudication message feature data and corresponding scheduling strategy scheme records. The multidimensional feature data includes: global state set of the execution entity, online heterogeneous execution entity number set, business load set, multimodal adjudication result classification identifier, and adjudication timestamp. Based on the characteristic data of the mimicry decision message and using adaptive parameters to quantify the system disturbance intensity corresponding to each candidate scheduling scheme, the candidate scheduling scheme with the smallest disturbance intensity is selected as the optimal scheduling strategy and sent to the scheduling controller. At the same time, the adaptive parameters are optimized by feedback based on the optimal scheduling strategy.

2. The method for convergence scheduling of safe states in a mimicry system based on data features according to claim 1, characterized in that, Extract the multidimensional feature data of the current mimicry adjudication message, including: Based on the type of business carried by the mimicry system, the structured features of the business traffic are extracted in segments to obtain a set of business features that characterize the business attributes or attack attributes of the current business traffic. Among them, the segmented features of a single business traffic segment include request address, message length, operation command, business interface and data payload type. Based on the comparison results of the outputs of multiple executors, a standardized message for the current mimicry decision is generated, and multidimensional feature data is extracted from the message.

3. The method for convergence scheduling of safe states in a mimicry system based on data features according to claim 1, characterized in that, The scheduling policy database stores mimicry decision message characteristic data and corresponding scheduling policy scheme records. The process includes: Based on the service type carried by the mimicry system, the historical service traffic is structured and characterized, and multi-dimensional feature data of the corresponding mimicry adjudication message is extracted; The structured characteristics of business traffic, the multi-dimensional characteristic data of corresponding mimicry decision messages, and the scheduling decision set are weighted and aggregated to form a scheduling policy record, which is then persistently stored in the scheduling policy database.

4. The method for convergence scheduling of safe states in a mimicry system based on data features according to claim 1, characterized in that, Using multidimensional feature data as the retrieval index, multimodal feature matching queries are performed in the scheduling strategy database, including: Map the multidimensional data features of the current mimicry adjudication message and the multidimensional features in the scheduling strategy record to the [0,1] interval; The similarity of features is calculated using weighted Euclidean distance. The set of scheduling strategy schemes with a distance less than the similarity threshold is selected. If there are multiple records with the same distance in the set, the record with the largest decision timestamp is retained. If the set is empty, the executor with the highest heterogeneity and the best running state is selected as the scheduling decision, forming the current scheduling strategy record and storing it in the scheduling strategy database.

5. The method for convergence scheduling of safe states in a mimicry system based on data features according to claim 4, characterized in that, Multimodal feature matching queries in the scheduling policy database also include: A sliding window is used to retain a specified number of valid matching records. Records exceeding the specified number are automatically archived to disk for cold storage. When the similarity threshold is adjusted, the data is retrieved from the disk cold storage and the feature similarity is recalculated. When calculating similarity, irrelevant records are first filtered out by the hash value of the structured features of business traffic, and then the weighted Euclidean distance is calculated for the remaining records. A memory index is built based on the weighted Euclidean distance of the records, and the top K records are scanned for matching based on the memory index.

6. The method for convergence scheduling of safe states in a mimicry system based on data features according to claim 1, characterized in that, The system disturbance intensity corresponding to each candidate scheduling scheme is quantified using adaptive parameters. The quantization process is expressed as follows: ,in, These are, respectively, disturbances to the global state set of the execution entity, disturbances to the online heterogeneous execution entity number set, disturbances to the business load set, disturbances to the multi-mode adjudication result classification identifier, and disturbances to the scheduling decision set. , , , , , To map feature vectors to scalar aggregation functions, This is the current timestamp of the ruling. The timestamp corresponding to the historical record with the smallest weighted Euclidean distance value in the matched candidate scheduling scheme set. , , , , These are the weights of the corresponding items. This is the penalty coefficient for abnormal rulings.

7. The method for convergence scheduling of safe states in a mimicry system based on data features according to claim 1, characterized in that, The candidate scheduling scheme with the minimum disturbance intensity is selected as the optimal scheduling strategy, including: Calculate the minimum system disturbance intensity in the candidate scheduling scheme set, and obtain the scheduling decision set corresponding to the minimum system disturbance intensity; The obtained scheduling decision set is taken as the optimal scheduling scheme. If there are multiple candidate scheduling schemes corresponding to the minimum system disturbance intensity, the scheduling decision set corresponding to the candidate scheduling scheme with the closest timestamp is taken as the optimal scheduling scheme.

8. A mimicry system safety state convergence scheduling system based on data features, characterized in that, It includes: a matching query module and an optimal output module, wherein, The matching query module is used to extract multi-dimensional feature data of the current mimicry adjudication message and use the multi-dimensional feature data as a retrieval index to perform multi-modal feature matching query in the scheduling strategy database to obtain candidate scheduling schemes. The scheduling strategy database stores mimicry adjudication message feature data and corresponding scheduling strategy scheme records. The multi-dimensional feature data includes: a global state set of the execution entity, a set of online heterogeneous execution entity numbers, a set of business loads, a multi-modal adjudication result classification identifier, and an adjudication timestamp. The optimal output module is used to quantify the system disturbance intensity corresponding to each candidate scheduling scheme based on the mimicry decision message feature data and adaptive parameters, select the candidate scheduling scheme with the smallest disturbance intensity as the optimal scheduling strategy and send it to the scheduling controller, and at the same time perform feedback optimization of adaptive parameters according to the optimal scheduling strategy.

9. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 7.

Images