CN110581845A - A Quantitative Characterization Method of the Potential Threat Level of Mimic Controller Executive - Google Patents

Abstract

The invention discloses a quantitative characterization method of the potential threat degree of a mimic controller executive body. The method uses the mimic controller to record the difference between each processing input of the executive body and the multi-mode voter, and calculates the confidence degree of the executive body. The confidence level is updated and sorted at time, the execution body with the lowest confidence level is offline, and the execution body is selected from the offline candidate execution body to go online. The method of the present invention comprehensively considers further improving the reliability of the mimic controller, quantifies and characterizes the potential threat degree of the actuator of the mimic controller, introduces the concept of confidence, and reliably adjusts the operation of the actuator according to the confidence; In the case of an effective quantitative representation method, the present invention greatly improves the robustness of the mimic defense system without substantially changing the software and hardware overhead.

Description

A Quantitative Characterization Method of the Potential Threat Level of Mimic Controller Executive

technical field

The invention belongs to the technical field of network security, in particular to the technical field of network security mimic defense, and particularly relates to a quantitative characterization method of the potential threat degree of a mimic controller executive body.

Background technique

With the continuous evolution of the Internet and the continuous evolution of attack technologies, network attacks present the characteristics of "concealment, coordination, and precision", and network security is in a situation of "easy to attack but difficult to defend". In order to completely change the traditional protection mode of passive response such as "blocking and killing", and form an active defense capability, mimic defense technology came into being. Mimic defense technology refers to an active defense technology based on the internal dynamic heterogeneous redundant structure of the system, which can deal with various unknown threats in cyberspace. Due to the adoption of comprehensive defense methods, mimic defense technology has good reliability and universality, and has become a research hotspot in academia and industry in recent years.

The mimic controller has multiple functional equivalent redundant executives online at the same time. When the server of the mimic defense technology receives an access request, it will first input it to the mimic controller, and the mimic controller is simultaneously assigned to multiple functional equivalent redundant execution bodies. For other executives, if multiple functionally equivalent redundant executives output normally, they will output the same result to the multi-mode voter, and the multi-mode voter will output the correct result according to the principle of majority decision. When one or some functionally equivalent redundant execution bodies are attacked and a vulnerability occurs, it will output wrong results. Although the majority result cannot be guaranteed to be always correct in theory, it can be proved that the probability of majority error increases with the DRS surplus. The increase of the degree decreases non-linearly, but in a certain period of time, multiple functionally equivalent redundant execution bodies with loopholes are running at the same time, and error output is very likely to occur, which will threaten the security of the mimic defense technology server. Therefore, a quantitative characterization method applicable to the potential threat level of the mimic controller executive can greatly reduce the possible error rate of the majority decision, and will further enhance the robustness of the entire mimic defense system.

In the existing mimic defense system, there is no suitable quantitative characterization method for the potential threat level of the mimic controller executive body. At present, the main way to strengthen the correctness of the mimic controller is to manually judge the functionally equivalent redundant executive body , and then manually go online and offline the corresponding executives to improve the security of the entire mimic controller and ensure the robustness of the entire mimic defense system. However, this method has three shortcomings: first, it is difficult to accurately judge the potential threat level of functionally equivalent redundant execution bodies that have not been marked; second, it is labor-intensive and the detection cycle cannot be guaranteed; finally, manual judgment and manual online and offline Line executives are extremely biased.

Therefore, in view of the lack of quantitative characterization methods for the potential threat level of the mimic controller executive, in order to ensure the high reliability and high availability of the actual mimic defense technology, an efficient and accurate potential threat of the mimic controller executive is urgently needed. Quantitative characterization method of threat level, maximizing the robustness and reliability of the mimic defense system.

Contents of the invention

The purpose of the present invention is to provide a quantitative characterization method of the potential threat level of a mimic controller executive body in view of the deficiencies in the prior art. The method of the present invention performs round-robin execution on the execution body set according to the cumulative confidence of the execution body in different periods through continuous input, which has the advantage of being safer and more reliable.

The purpose of the present invention is achieved through the following technical solutions: a quantitative characterization method of the potential threat level of a mimic controller executive body, comprising the following steps:

(1) For the user access request, judge whether the IP address belongs to the honeypot blacklist; if yes, introduce the attack into the honeypot for execution, and end all steps; if not, proceed to subsequent steps;

(2) The mimicry controller records the difference between the execution body's processing input and the multi-mode voter each time, and calculates the confidence degree of each execution body, and updates the confidence degree every time a fixed period of time passes, and reorders, including the following sub-steps :

(2.1) Use M to represent the total number of isomers to provide services; when the input is received, select N isomers to go online as the execution body set of the mimic controller, and the mimic controller will deliver the input to the online execution body, collect the output results of each executive body to the voter for majority decision;

(2.2) Mimetic controller updates the confidence of the execution body: after a fixed time period t, use _Q to represent the number of inputs accepted by an execution body in the current time period; After the first error, update the execution body's V _i =V _i +1; after the end of the current time period, use Q to update the total number of inputs accepted by all current execution bodies P _i =P _i+ Q, and record the total input received by the i-th execution body The number P _i ; C _i represents the confidence degree of the i-th executive, which is calculated by the following formula:

Among them, i=1,2,...,N;

(2.3) Sorting the execution body according to the value of confidence C _i obtained in step (2.1);

(3) Go offline with the lowest confidence execution body in the execution body sorting obtained in step (2.3), and rank it at the end of the offline candidate execution body ranking; and sequentially extract the execution bodies from the offline candidate execution bodies to go online; then jump Go to step (2.2) to enter the next time period t.

Further, the isomers in the step (2.1) include executors and offline candidate executors.

Further, the error handling in the step (2.2) means that the decision of the voter is unanimous, and if the output of the executive body is inconsistent with the decision result, it is considered as an error output.

The beneficial effects of the present invention are: the method of the present invention comprehensively considers further improving the reliability of the mimic controller, and the optimization goal is to quantitatively characterize the potential threats of all functionally equivalent redundant executive bodies in the mimic controller, and introduce the concept of confidence According to the confidence level, the operation of the executive body can be reliably adjusted to further strengthen the security and reliability of the mimic defense system. In the absence of a quantitative characterization method for the potential threat level of the mimic controller executive body, the present invention greatly improves the robustness of the mimic defense system without substantially changing the hardware and software overhead.

Description of drawings

Fig. 1 is the schematic diagram of controller receiving input model in the embodiment of the present invention;

Fig. 2 is a flow chart of the method of the present invention.

Detailed ways

The present invention will be described in further detail below with reference to the accompanying drawings and examples.

A quantitative characterization method of the potential threat degree of a mimic controller executive body of the present invention, comprising the following steps:

(1) Determine whether the user's IP address belongs to the blacklist: the honeypot mechanism can be used to detect and withstand detected attacks; the server uses the existing honeypot mechanism to collect attack traffic information in real time and dynamically update the IP blacklist list; For user access requests, determine whether the IP address belongs to the honeypot blacklist; if so, introduce the attack into the honeypot for execution, and end all steps; if not, proceed to subsequent steps;

(2) The mimicry controller records the difference between the execution body's processing input and the multi-mode voter each time, and calculates the confidence degree of each execution body, and updates the confidence degree every time a fixed period of time passes, and reorders, including the following sub-steps :

(2.1) Use M to represent the total number of isomers to provide services, isomers include executives and offline candidate executives; when receiving input, select N isomers to go online as the mimic controller Executive body set, the mimic controller delivers the input to the online executive body, and collects the output result of each executive body to the voter for majority decision;

(2.2) Mimetic controller updates the confidence of the execution body: after a fixed time period t, use Q to represent the number of inputs accepted by an execution body in the current time period; use V _i to represent the error processing times of the i-th execution body, the error Processing refers to the consistent output of the decision of the voter. If the output of the executive body is inconsistent with the judgment result, it is considered to be an error output; every time the executive body makes an error, V _i =V _i +1 of the executive body is updated; after the end of the current time period, use Q updates the total number of inputs P _i =P _i+ Q currently accepted by all executives, and records the total number of inputs P _i accepted by the i-th executive; C _i represents the confidence of the i-th executive, which is calculated by the following formula:

Among them, i=1,2,...,N;

(2.3) Sorting the execution body from high to low according to the value of confidence C _i obtained in step (2.1);

(3) Go offline with the lowest confidence execution body in the execution body sorting obtained in step (2.3), and rank it at the end of the offline candidate execution body ranking; and sequentially extract the execution bodies from the offline candidate execution bodies to go online; then jump Go to step (2.2) to enter the next time period t.

Example

This example works on the mimic controller in the mimic defense server. As shown in Figure 1, there are 6 executives A ₁ to A ₆ running in the mimic controller, and 6 offline backup executives E ₁ to E ₆ . After the input enters the controller, it is delivered to the 6 online executives; the method of the present invention replaces the online and offline executives at every same time period t according to the following specific steps, so as to ensure that the final result of the final voter outputting according to the algorithm is true and reliable, and completes Handling of access requests.

As shown in Figure 2, this example is implemented through the following steps:

Step 1. Receive a user access request, input the agent to determine whether the user IP is in the blacklist of the honeypot server, if yes, then import the request into the honeypot server for execution; if not, then enter step 2;

Step 2: input to the mimic controller, deliver to the online execution body, collect the results of each execution body for each output and input to the voter, and finally collect the error output V _i (i=1) of the execution body i in a period t ~6) and always accept the input P _i and calculate the confidence degree C _i (i=1~6) according to the formula, C _i is equal to 1 minus the difference between the ratio of V _i and P _i of executive i, for example, the first time After segment t, a total of 100 inputs are received, and the input error results of the 6 executive bodies are 0, 0, _{1, 2, 0, 0 respectively; update Pi and V i according} to the data, then calculate the confidence and follow put in order;

Step 3: Go offline according to the selection of the lowest C _i execution body A ₄ , and go online sequentially from the candidate execution body E _i (i=1～6) to the execution body E ₁ ;

Step 4: Continue to update the error output V _i (i=1~6) of the current executive i (i=1~6) and the total accepted input P _i after the same time interval t, and calculate the confidence degree C _i (i=1~6) according to the formula 6), then follow Sorting, and then continue to perform on-line and off-line processing of the execution body through the quantitative representation replacement algorithm.

The above is an embodiment of the present invention, and the present invention is not limited by the above embodiment, and a specific implementation method can be determined by combining the technical solutions of the present invention with actual application scenarios.

Claims (3)

1. A method for quantitatively characterizing the potential threat level of a mimicry controller executive is characterized by comprising the following steps:

(1) For a user access request, judging whether the IP address belongs to a honeypot blacklist list or not; if yes, the attack is introduced into the honeypot to be executed, and all the steps are ended; if not, the subsequent steps are performed.

(2) The mimicry controller records the difference between each processing input of the executive and the multi-mode voter, calculates the confidence of each executive, updates the confidence every time a fixed time period passes, and reorders the confidence, and comprises the following sub-steps:

(2.1) using M to represent the total number of isomeric structures to be provided with service; and when receiving input, selecting the on-line of N isomorphs as an executive body set of the mimicry controller, delivering the input to the on-line executive body by the mimicry controller, and collecting the output result of each executive body to a voter for carrying out multi-choice judgment.

(2.2) the mimicry controller updates the confidence of the executant: after a fixed time period t, representing the input number accepted by an executive in the current time period by Q; by V_iIndicating the number of times of error handling of the ith executable, and updating V of the executable after each error of the executable_i＝V_i+ 1; after the current time period is over, updating the total input number P accepted by all the current executors by Q_i＝P_i+Q, recording the total input number P accepted by the ith executive_i；C_iThe confidence coefficient of the ith executive body is represented and calculated by the following formula:

wherein i is 1,2, …, N.

(2.3) obtaining the confidence C of the executive body according to the step (2.1)_iThe values of (a) are sorted;

(3) The executive body with the lowest confidence level in the executive body sequencing obtained in the step (2.3) is offline, and the last bit of the offline candidate executive body sequencing is arranged; sequentially extracting the upper lines of the execution bodies from the lower line candidate execution bodies; then jump to step (2.2) and enter the next time period t.

2. The method for quantitatively characterizing the potential threat level of a mimicry controller executor according to claim 1, wherein the isomorphs in step (2.1) comprise an executor and a candidate offline executor.

3. the method for quantitatively characterizing the potential threat level of an executor of a mimicry controller as claimed in claim 1, wherein the error processing in step (2.2) is that a voter decides a consistent output and if the executor output is inconsistent with the decision result, the output is regarded as an error output.