CN108400968B

CN108400968B - Method for realizing mimicry defense model distributor

Info

Publication number: CN108400968B
Application number: CN201810038734.7A
Authority: CN
Inventors: 张旻; 梁惠兵; 姜明; 胡恩超; 汤景凡
Original assignee: Hangzhou Dianzi University
Current assignee: Hangzhou Dianzi University
Priority date: 2018-01-16
Filing date: 2018-01-16
Publication date: 2019-12-24
Anticipated expiration: 2038-01-16
Also published as: CN108400968A

Abstract

The invention discloses a method for efficiently realizing a mimicry defense model distributor. The invention comprises the following steps: step (1), storing the data packet sent by each client in a distributor, maintaining a mapping table from a virtual SessionId to a real SessionId in the distributor, wherein the SessionId in the request sent by the client is the virtual SessionId and is replaced by the real SessionId in the mapping table; and (2) when the user request is too large, copying the HTTP request head only by adopting a head copying and body linking mode, and only needing to adopt a linking mode for the data of the request body. When the distributor copies and distributes the request to the N servers, the space occupied by the request can be recovered; after the two preprocessing steps in the step (3), the distributor can efficiently send the user request to the executive body at the rear end of the server, so that the function of the distributor is realized. The invention reduces time delay and improves efficiency as much as possible, and provides a more efficient solution for the whole set of system.

Description

Method for realizing mimicry defense model distributor

Technical Field

The invention belongs to the technical field of computer software, and particularly relates to a method for realizing a mimicry defense model distributor.

Background

The security problem faced by the Web server system is increasingly serious, and the traditional defense technology is in a passive defense position and is difficult to well deal with the problem of unknown attack threat. Therefore, the united states of america has proposed a Moving Target Defense (MTD), which is a network security development direction of "changing game rules" proposed by the united states of america for the current disadvantage of defenders, and it is expected to confuse attackers by implementing continuous and dynamic changes to increase the attack cost and complexity and reduce the attack success rate.

A mimicry defense model based on a dynamic heterogeneous redundancy structure is proposed, and various hardware variants and corresponding software variants are expected to be dynamically and pseudo-randomly selected and executed under active and passive triggering conditions, so that hardware execution environments and software working conditions observed by internal and external attackers are extremely uncertain, and an attack chain based on bugs (bugs) or backgates cannot be or is difficult to construct, and the purpose of reducing the security risk of the system is achieved. The dynamic heterogeneous redundancy structure uses a heterogeneous executive body set to process in a processing link, the same input is copied into N parts through an input proxy and is distributed to N heterogeneous executive bodies in the executive body set to process, and a processing result is collected to a voter to be voted to obtain unique relatively correct output. Thus, the safety of the Web server can be greatly improved.

Disclosure of Invention

The invention aims to provide a method for realizing a mimicry defense model distributor, aiming at the defects of the prior art.

The technical scheme adopted by the invention for solving the technical problem comprises the following steps:

step (1) for each data packet sent by the client, storing the data packet in a distributor, wherein a plurality of back-end servers store a plurality of different sessionids, so that a mapping table from a virtual SessionId to a real SessionId needs to be maintained in the distributor, the SessionId in the request sent by the client is the virtual SessionId, the virtual SessionId is replaced by the real SessionId in the mapping table, the key value of the mapping table is the virtual SessionId, the value of the key is the real sessionids of the N servers, the virtual SessionId is generated by the distributor, and the client only needs to use the virtual SessionId to interact with the server side in the HTTP return packet received by the client;

and (2) when the user request is too large, if the requested data is simply copied by N times, the distributor occupies N times of space, and a 'head copy and body link' mode is adopted, namely, only the HTTP request head is copied, the HTTP request head contains information such as Cookie and Sessinid, and the data of the request body does not need to be changed, so that only the link of the HTTP request body needs to be stored. When the distributor copies and distributes the request to the N servers, the space occupied by the request can be recovered;

and (3) after the two times of preprocessing in the steps (1) and (2), the distributor can send the user request to an executive body at the rear end of the server to realize the function of the distributor.

The invention has the beneficial effects that:

the invention maintains the mapping from the virtual sessionId to the real sessionId by adopting the mapping table and adopts the scheme of 'head copy and body link', thereby realizing the distributor module, reducing the time delay as much as possible, improving the efficiency and providing a more efficient solution for the whole system.

The invention realizes a high-efficiency distributor module of the mimicry defense model by means of the fine operation of the mapping table and the pointer.

Drawings

FIG. 1 is a schematic view of the present invention.

Detailed Description

The invention is further illustrated by the following figures and examples.

As shown in fig. 1, a method for implementing a mimicry defense model distributor includes the following steps:

after the two pre-treatments in the step (3), the distributor can send the user request to the executive body at the back end of the server, so as to realize the function of the distributor.

Claims

1. A method of implementing a mimicry defense model distributor, comprising the steps of:

step (1) for each data packet sent by the client, storing the data packet in a distributor, wherein a plurality of back-end servers store a plurality of different sessionids, so that a mapping table from a virtual SessionId to a real SessionId needs to be maintained in the distributor, the SessionId in the request sent by the client is the virtual SessionId, the virtual SessionId is replaced by the real SessionId in the mapping table, the key value of the mapping table is the virtual SessionId, the value of the key is the real sessionids of the N servers, the virtual SessionId is generated by the distributor, the HTTP return packet received by the client only has the virtual SessionId, and the client only needs to use the virtual SessionId to interact with the server;

and (2) when the user request is too large, adopting a 'head copying and body linking' mode: the HTTP request header only needs to be copied, the HTTP request header contains Cookie and SessioneId information, and the data of the request body does not need to be changed, so that the link of the HTTP request body only needs to be saved; when the distributor copies and distributes the request to the N servers, the space occupied by the request can be recovered;