The invention relates to the technical field of
network security protection, and discloses a
network security protection method and
system based on
mimicry defense, and the method comprises the steps: carrying out the clustering analysis of a plurality of executive bodies, dividing each executive body into a reference executive body and a non-reference executive body, carrying out the
buffer overflow attack test of the executive bodies through an
attack code, obtaining
attack behavior characteristics, calculating behavior similarity between the reference attack behavior characteristics and the non-reference attack behavior characteristics, and judging whether a non-reference executor has a potential
vulnerability utilization path or not; according to the attack success rate of the attack code variation, judging whether the potential
vulnerability utilization path is valid or not; and constructing a
mimicry defense strategy according to the path characteristics of the
vulnerability utilization path. According to the method, the influence of the difference of the micro-
system structures of different executors on the
buffer overflow attack is analyzed, the potential attack path is identified, and a more targeted
mimicry defense strategy is formulated, so that the defense effect of the executors on the
network attack is improved, and the security of
system operation is ensured.