Behavioral feature mimicking arbitration method and system with fault tolerance
By employing a collaborative mechanism of sliding window and set comparison method, the problem of false alarms and missed alarms caused by disordered and delayed behavior of heterogeneous executors in mimicry defense is solved, achieving efficient behavior feature adjudication and improving the reliability and efficiency of adjudication.
Patent Information
- Application Number
- CN202610910697.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-06-23
- Publication Date
- 2026-11-03
AI Technical Summary
In mimicry defense scenarios, the disordered and delayed behavior of heterogeneous executors leads to false alarms and missed alarms in traditional adjudication algorithms, resulting in insufficient adjudication accuracy.
A collaborative mechanism combining sliding window and set comparison is adopted. By initializing adjudication parameters, receiving multiple copies of behavioral data, calculating similarity and making adjudications, and combining eBPF technology, behavioral feature adjudication in the mimicry defense system is realized.
Significantly reduces false alarm rate, controls the risk of missed alarms, improves the reliability and efficiency of mimicry adjudication, and accurately distinguishes between normal deviations and malicious attacks.
Smart Images
Figure CN123034962A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a behavioral mimicry adjudication method and system with fault tolerance capabilities. The method is based on eBPF technology and is deployed in a mimicry defense system. Background Technology
[0002] Mimicry defense is a proactive defense technique that does not rely on prior knowledge such as attacker behavior or system vulnerabilities. It constructs a system with the "uncertainty principle" through characteristics such as dynamism, heterogeneity, and redundancy. Mimicry defense requires verifying and adjudicating the outputs of heterogeneous executors. However, in engineering implementation, subtle differences in the behavior of heterogeneous executors, out-of-order execution, and asynchrony pose challenges to the design of mimicry adjudication algorithms. Summary of the Invention
[0003] To address the issue that disordered and delayed behavior of heterogeneous executors in mimicry defense scenarios can easily lead to false alarms and missed alarms, resulting in insufficient adjudication accuracy in traditional adjudication algorithms, this invention proposes a fault-tolerant behavioral feature mimicry adjudication method and system. Through a collaborative mechanism of sliding window and set comparison method, it can effectively accommodate disordered and delayed behavior of heterogeneous executors while accurately distinguishing between normal deviations and malicious attacks, significantly reducing the false alarm rate and controlling the risk of missed alarms, thereby improving the reliability and efficiency of mimicry adjudication.
[0004] To achieve the above objectives, the technical solution adopted is:
[0005] This invention provides a behavioral feature mimicry adjudication method with fault tolerance capability, comprising the following steps:
[0006] S1: Initialize the decision parameters, which include window width, window length, and window timeout.
[0007] S2: Receive multi-replica behavior data, compare the behavior of each replica column by column, and when a column of behavior is found to be inconsistent, store the behavior of that column in a sliding window; if the window is not empty, then subsequent behavior columns are stored in the window regardless of whether they are consistent or not.
[0008] S3: Whenever new behavioral data is stored in the window, calculate the set similarity of each copy of the behavioral sequence in the window. If the similarity is greater than or equal to a preset threshold, clear the window; otherwise, retain the window data.
[0009] S4: When the window is full, determine that the first inconsistent behavior stored in the window is abnormal and perform window sliding;
[0010] S5: When the window remains unchanged for longer than the window timeout period, all inconsistent behaviors within the window are deemed abnormal, and the window is cleared.
[0011] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, the window width is used to determine the number of copies to be adjudicated, and the window length is used to determine the number of behaviors that can be stored in each copy within the window.
[0012] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, in step S2, when a certain column of behavior is consistent among all replicas and the current window is empty, the column of behavior is not stored in the window; when only a single replica's window adds behavior data, the windows of all other replicas simultaneously occupy a window position, which is only used to place the position to maintain the consistency of the length of each window and does not participate in the subsequent similarity calculation.
[0013] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, in step S3, the set similarity of each copy behavior sequence within the window is calculated using Jaccard similarity, the formula of which is: ,in, Let be the set of actions of the i-th replica within the window, n be the number of replicas, the numerator be the intersection of the action sets of all replicas within the window, and the denominator be the union of the action sets of all replicas within the window. This is a parameter for adjusting the similarity threshold.
[0014] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, when f≥1, it is determined that the behaviors within the window are similar and the window is cleared; when f<1, it is determined that the behaviors within the window are dissimilar and the window data is retained.
[0015] According to the fault-tolerant behavioral feature mimicry adjudication method of the present invention, the similarity threshold adjustment parameter is further... The theoretical optimal value is 1; in a real network environment, it is dynamically adjusted based on the similarity distribution between normal disordered behavior and abnormal attack behavior. The value of .
[0016] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, in step S4, when the window is full, the inconsistent behavior stored first in the window and the aligned behaviors stored subsequently for placeholder purposes are removed from the window together; the window slides to the next inconsistent behavior position, and if there is no inconsistent behavior in the window, the window is cleared and new data is awaited.
[0017] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, in step S5, the time during which the window remains unchanged refers to the duration of the window from the last update to the current time. When this time exceeds the window timeout time T, all inconsistent behaviors within the window are determined to be abnormal and the window is cleared.
[0018] According to the fault-tolerant behavior feature mimicry adjudication method of the present invention, the multi-copy behavior data originates from system call events of the host, container, or virtual machine, and is extracted and transformed into a behavior sequence represented by a single character by the behavior abstraction module of the behavior adjudication system; each behavior sequence is input into the adjudication method in chronological order.
[0019] Furthermore, the present invention also provides a behavioral feature mimicry adjudication system with fault tolerance capabilities, comprising:
[0020] The parameter initialization module is used to initialize the adjudication parameters, which include window width, window length, and window timeout.
[0021] The behavior data entry module is used to receive multiple copies of behavior data, compare the behavior of each copy column by column, and when a discrepancy is found in a certain column of behavior, the behavior of that column is stored in a sliding window; if the window is not empty, subsequent behavior columns are stored in the window regardless of whether they are consistent or not.
[0022] The similarity calculation module is used to calculate the set similarity of each copy of the behavior sequence in the window whenever new behavior data is stored in the window. If the similarity is greater than or equal to a preset threshold, the window is cleared; otherwise, the window data is retained.
[0023] The window full handling module is used to determine that the inconsistent behavior of the first item stored in the window is abnormal when the window is full, and to perform window sliding.
[0024] The timeout handling module is used to determine that all inconsistent behaviors within the window are abnormal and clear the window when the window remains unchanged for a longer period than the window timeout period.
[0025] The beneficial effects achieved by adopting the above technical solution are:
[0026] This invention combines a sliding window mechanism with the Jaccard similarity set comparison method, and relies on eBPF technology to complete behavioral data collection and processing. It can effectively accommodate the disorder and asynchrony of behavior caused by heterogeneous executors due to scheduling differences, system latency, and resource contention. By reasonably setting window parameters and similarity adjustment parameters, it can accurately distinguish between normal behavioral deviations and malicious attack behaviors, significantly reducing the false alarm rate while controlling the risk of missed alarms, and significantly improving the reliability and overall operational efficiency of behavioral feature adjudication in mimicry defense scenarios. Attached Figure Description
[0027] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.
[0028] Figure 1This is a flowchart illustrating the behavior feature mimicry adjudication method with fault tolerance according to an embodiment of the present invention.
[0029] Figure 2 This is a visual representation of the behavior adjudication window in an embodiment of the present invention;
[0030] Figure 3 This is Example 1 of the behavioral feature mimicry adjudication method according to an embodiment of the present invention;
[0031] Figure 4 This is Example 2 of the behavioral feature mimicry adjudication method according to an embodiment of the present invention. Detailed Implementation
[0032] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.
[0033] In mimicry defense applications, traditional methods cannot tolerate out-of-order and delayed behaviors, leading to false alarms and missed alarms in traditional adjudication algorithms; for example... Figure 1 As shown in the figure, this invention discloses a behavior feature mimicry adjudication method with fault tolerance capability. This method is implemented based on eBPF technology and deployed in a mimicry defense system. It is used to adjudicate the behavior features of multiple heterogeneous executors in real time, identify abnormal behaviors, and tolerate behavioral disorder and asynchrony caused by system latency or scheduling differences. The specific implementation steps are as follows:
[0034] Step S1: Initialize the adjudication parameters, which include window width N, window length M, window timeout T, and function adjustment parameters.
[0035] A window is used to temporarily store the sequence of actions occurring on objects such as hosts, containers, or virtual machines. The window width N is used to determine the number of copies (objects / executors) to be adjudicated. The window length M is used to determine the number of actions that can be stored within the window for each copy, i.e. .
[0036] Define the window as follows Figure 2 As shown, there are N objects that need to be adjudicated based on their behavioral characteristics. The storage window corresponding to each object to be adjudicated records... All object windows constitute a window collection. Each window The algorithm uses M locations to store actions, therefore the window length M limits the maximum range of actions that the algorithm can tolerate, including out-of-order actions and actions being delayed. The window for each object is full when the window is empty. .
[0037] Step S2: Receive multi-replica behavior data, compare the behavior of each replica column by column, and when a column of behavior is found to be inconsistent, store the behavior of that column in a sliding window; if the window is not empty, then subsequent behavior columns are stored in the window regardless of whether they are consistent or not.
[0038] The behavioral feature mimicry adjudication algorithm uses multi-copy behavioral data derived from system call events on the host, container, or virtual machine. This data is extracted and transformed into a sequence of behaviors represented by a single character by the behavioral abstraction module of the behavioral adjudication system. The algorithm is invoked at various times, including callbacks of key behaviors and calls at time intervals. Therefore, this algorithm relies on behavioral data, requiring the behavioral adjudication system to extract relatively accurate behavioral data from system call events. Furthermore, the input behavioral sequences must be arranged in chronological order.
[0039] When multiple replicas of behavioral data are input, a strict comparison is performed one by one. If an inconsistency is found in a single behavior among multiple replicas, the inconsistent behavior is placed in the window. Consistent behavior is handled in two cases: when the window is empty and when it is not empty. When the window is not empty, consistent behavior is ignored; however, when the window is not empty, consistent behavior is placed in the window regardless of whether it is consistent or not.
[0040] In addition, when only one copy of the window adds new data, the windows of other copies must also occupy a window position at the same time. This position is only used to maintain the consistency of the length of each window and does not participate in the subsequent similarity calculation. The purpose of this is to prevent overemphasizing the false alarm rate and reducing sensitivity.
[0041] Step S3: Whenever new behavioral data is stored in the window, calculate the set similarity of each copy of the behavioral sequence in the window. If the similarity is greater than or equal to a preset threshold, clear the window; otherwise, retain the window data.
[0042] When new data enters the window, a full-window behavior matching is immediately performed. The matching algorithm uses set comparison, which calculates the Jaccard similarity of multiple replica behavior sequences. The formula is:
[0043]
[0044] in, Let be the set of actions of the i-th replica within the window, n be the number of replicas, the numerator be the intersection of the action sets of all replicas within the window, and the denominator be the union of the action sets of all replicas within the window. This is the similarity threshold adjustment parameter. This similarity reflects the consistency of behavior within the window: if f≥1, the behavior within the window is determined to be similar (normal disorder, no attack), and the window is cleared; if f<1, the behavior within the window is determined to be dissimilar (possibly an attack), and the window data is retained.
[0045] Among them, the similarity threshold adjustment parameter The theoretical optimal value can be determined through logical derivation:
[0046] The set property under normal circumstances: In normal out-of-order scenarios, the order of actions of multiple replicas may be inconsistent due to non-malicious factors (such as system latency or scheduling differences), but the content of the actions is exactly the same (i.e., the set of actions of each replica). At this point, the intersection equals the union, and the Jaccard similarity is... Substituting into the formula, we get... To clear the window (normal), f≥1 must be satisfied, hence λ≥1.
[0047] Set properties of anomalous situations: In an attack scenario, at least one copy's set of behaviors differs from the others (e.g., malicious operations causing behavioral differences). In this case, the intersection is strictly smaller than the union, and the Jaccard similarity s < 1. Substituting into the formula yields... To preserve the window (abnormal), f < 1 must be satisfied, i.e. <1. Since s < 1, this inequality is equivalent to λ. .
[0048] Because the theoretical optimal value should be obtained under the constraints of both normal and abnormal cases, λ must simultaneously satisfy λ≥1 (clearing the window in normal cases) and λ (Window reserved for abnormal situations). When λ=1, f=1 (clear window) under normal circumstances, and f=s<1 (reserve window) under abnormal circumstances, perfectly balancing "no false positives" (normal out-of-order behavior is not mistaken for an attack) and "no false negatives" (attack behavior is not missed as normal). If λ>1, there may be λ in abnormal situations. (e.g., λ=2, s=0.5), in this case f=1, which will be misjudged as normal, resulting in a missed alarm; if λ<1, under normal circumstances f<1, it will be misjudged as abnormal, resulting in a false alarm.
[0049] In summary, The theoretical optimal value of λ is 1, satisfying the core requirement of clearing the window under normal circumstances and retaining the window under abnormal circumstances. It should be noted that in real network environments, normal out-of-order behavior may not be completely consistent due to system fluctuations (such as slight latency or resource contention) (i.e., s is slightly less than 1), while the s of attack behavior may also vary depending on the attack method (such as covert attacks resulting in smaller differences). Therefore, the actual value of λ needs to be dynamically adjusted according to the distribution of s of normal out-of-order behavior and abnormal attack behavior in real-world scenarios to adapt to actual differences. For example, if the mean s of normal out-of-order behavior is 0.9 and the mean s of attack behavior is 0.5, then λ needs to be between 1 / 0.9≈1.11 and 1 / 0.5=2. In this case, taking λ=1.2~1.5 can balance false alarms and missed alarms in real-world environments.
[0050] Step S4: When the window is full, determine that the first inconsistent behavior stored in the window is abnormal, and perform window sliding.
[0051] When the window is full, the first inconsistent action that enters the window is determined to be abnormal, and the window is slid. During the sliding, the abnormal action and all subsequent aligned actions that are only used as placeholders are removed from the window. The window is reserved starting from the next inconsistent action (if it exists); if there are no inconsistent actions, the window is cleared to wait for new data.
[0052] Step S5: When the window remains unchanged for longer than the window timeout, all inconsistent behaviors within the window are deemed abnormal, and the window is cleared. The window remains unchanged for longer than the window timeout.
[0053] Corresponding to the above method, embodiments of the present invention also disclose a behavioral feature mimicry adjudication system with fault tolerance capability, comprising:
[0054] The parameter initialization module is used to initialize the adjudication parameters, which include window width, window length, and window timeout.
[0055] The behavior data entry module is used to receive multiple copies of behavior data, compare the behavior of each copy column by column, and when a discrepancy is found in a certain column of behavior, the behavior of that column is stored in a sliding window; if the window is not empty, subsequent behavior columns are stored in the window regardless of whether they are consistent or not.
[0056] The similarity calculation module is used to calculate the set similarity of each copy of the behavior sequence in the window whenever new behavior data is stored in the window. If the similarity is greater than or equal to a preset threshold, the window is cleared; otherwise, the window data is retained.
[0057] The window full handling module is used to determine that the inconsistent behavior of the first item stored in the window is abnormal when the window is full, and to perform window sliding.
[0058] The timeout handling module is used to determine that all inconsistent behaviors within the window are abnormal and clear the window when the window remains unchanged for a longer period than the window timeout period.
[0059] like Figure 3 A specific example of a behavioral feature mimicry adjudication method is given, which adopts a sliding window mechanism and set comparison method, and has the ability to accommodate disorder and delay within a certain range.
[0060] Suppose there are three behavior sequences. One behavior is selected sequentially and compared. When comparing the fourth behavior, if a misalignment is found, it is added to the window, as shown in window 1. As long as the window is not empty, it occupies one space regardless of subsequent behavior misalignment. Each time a new behavior sequence is added, the entire window is compared as a whole. For example... Figure 3 As shown in the second window, windows are aligned when compared as a set, so clearing the window is necessary.
[0061] Behavioral sequence 1: xyzab
[0062] Behavioral sequence 2: xyzba
[0063] Behavioral sequence 3: xyzba
[0064] When comparing columns one by one, the first three columns, "xyz", are completely identical and are ignored. The fourth column shows inconsistencies between "a" and "b", so this column is added to the window. At this point, the window is not empty. The fifth column, "b" and "a", although inconsistent (actually "b" "a" "a"), is also added to the window. Now the window contains two columns of data, and the behavior set of each execution entity within the window is {a, b}. Using set comparison, the ratio of the intersection to the union is 1. Multiplying this by the adjustment parameter λ (λ≥1), f≥1, indicating that the behaviors within the window are similar, and the window is cleared. This process shows that the algorithm tolerates the out-of-order differences between the behaviors "a" and "b" and does not misjudge them as anomalies.
[0065] Let's look at another scenario, such as... Figure 4 As shown, there are three behavioral sequences:
[0066] Sequence 1: xyzacdefghk j...
[0067] Sequence 2: xyzbcdefghk m...
[0068] Sequence 3: xyzbcdefghk m...
[0069] When the algorithm compares columns one by one, the first three columns "xyz" are consistent. When the fourth column contains the first misaligned behavior "a", "b", "b", it is placed in the window. Every subsequent column (regardless of consistency) is placed in the window. Consistent behaviors only occupy a place and do not participate in subsequent set comparisons. Even if subsequent behaviors are identical, they still occupy a place. This is done to improve the accuracy of the decision. Although aligned behaviors are placed in the window, they are not recorded with specific data and do not participate in the subsequent alignment of the behavior set within the window, thus improving the efficiency of the decision. When the inconsistent behaviors "j", "m", "m" are placed in the window, and the window is full, the first inconsistent behavior to enter the window (i.e., the column "a", "b", "b") is determined to be abnormal. Based on the principle of majority selection, behaviors inconsistent with the majority in that column are determined to be abnormal (i.e., behavior "a" in execution body 1 is abnormal). The window then slides over the abnormal behavior and all subsequent placeholder behaviors, and the window is reserved starting from the next inconsistent behavior "j", "m", "m". Because many subsequent behaviors, although placeholders, are aligned, the window slides over them directly, and the window is updated. Figure 4 The third window is shown in the diagram. If the window is not updated within the window timeout period T, all inconsistencies within the window (i.e., the "j", "m", "m" column) are directly deemed anomalous and the window is cleared. This process demonstrates that this method accurately identifies genuine anomalous behavior while tolerating a certain range of alignment issues.
[0070] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A behavioral feature mimicry adjudication method with fault tolerance capability, characterized in that, Includes the following steps: S1: Initialize the decision parameters, which include window width, window length, and window timeout. S2: Receive multi-replica behavior data, compare the behavior of each replica column by column, and when a column of behavior is found to be inconsistent, store the behavior of that column in a sliding window; if the window is not empty, then subsequent behavior columns are stored in the window regardless of whether they are consistent or not. S3: Whenever new behavioral data is stored in the window, calculate the set similarity of each copy of the behavioral sequence in the window. If the similarity is greater than or equal to the preset threshold, clear the window. Otherwise, retain the window data; S4: When the window is full, determine that the first inconsistent behavior stored in the window is abnormal and perform window sliding; S5: When the window remains unchanged for longer than the window timeout period, all inconsistent behaviors within the window are deemed abnormal, and the window is cleared.
2. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 1, characterized in that, The window width is used to determine the number of copies to be adjudicated, and the window length is used to determine the number of actions that can be stored in each copy within the window.
3. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 1, characterized in that, In step S2, if a certain column of behavior is consistent across all replicas and the current window is empty, then that column of behavior will not be stored in the window; when only a single replica's window adds behavior data, all other replicas' windows simultaneously occupy a window position, which is only used to place the position to maintain the consistency of window lengths and does not participate in subsequent similarity calculations.
4. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 1, characterized in that, In step S3, the set similarity of each copy behavior sequence within the window is calculated using Jaccard similarity, the formula of which is: ,in, Let be the set of actions of the i-th replica within the window, n be the number of replicas, the numerator be the intersection of the action sets of all replicas within the window, and the denominator be the union of the action sets of all replicas within the window. This is a parameter for adjusting the similarity threshold.
5. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 4, characterized in that, When f≥1, the behaviors within the window are determined to be similar, and the window is cleared; when f<1, the behaviors within the window are determined to be dissimilar, and the window data is retained.
6. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 4, characterized in that, The similarity threshold adjustment parameter The theoretical optimal value is 1; in a real network environment, it is dynamically adjusted based on the similarity distribution between normal disordered behavior and abnormal attack behavior. The value of .
7. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 1, characterized in that, In step S4, when the window is full, the first inconsistent behavior stored in the window and the subsequent aligned behaviors stored only as placeholders are removed from the window; the window slides to the next inconsistent behavior position, and if there is no inconsistent behavior in the window, the window is cleared and new data is awaited.
8. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 1, characterized in that, In step S5, the window remains unchanged for the duration from the last update to the current time. When this time exceeds the window timeout T, all inconsistent behaviors within the window are determined to be abnormal and the window is cleared.
9. The behavioral feature mimicry adjudication method with fault tolerance capability according to claim 1, characterized in that, The multi-copy behavior data originates from system call events of the host, container, or virtual machine. It is extracted by the behavior abstraction module of the behavior adjudication system and transformed into a behavior sequence represented by a single character. Each behavior sequence is input into the adjudication method in chronological order.
10. A behavioral feature mimicry adjudication system with fault tolerance capability, characterized in that, include: The parameter initialization module is used to initialize the adjudication parameters, which include window width, window length, and window timeout. The behavior data input module is used to receive multiple copies of behavior data, compare the behavior of each copy column by column, and when a discrepancy is found in a certain column of behavior, the behavior of that column is stored in a sliding window. If the window is not empty, subsequent rows will be stored in the window regardless of whether they are identical. The similarity calculation module is used to calculate the set similarity of each copy of the behavior sequence in the window whenever new behavior data is stored in the window. If the similarity is greater than or equal to a preset threshold, the window is cleared. Otherwise, retain the window data; The window full handling module is used to determine that the inconsistent behavior of the first item stored in the window is abnormal when the window is full, and to perform window sliding. The timeout handling module is used to determine that all inconsistent behaviors within the window are abnormal and clear the window when the window remains unchanged for a longer period than the window timeout period.