CN111431946B - Mimicry router execution body scheduling method and mimicry router - Google Patents
Mimicry router execution body scheduling method and mimicry router Download PDFInfo
- Publication number
- CN111431946B CN111431946B CN202010523054.1A CN202010523054A CN111431946B CN 111431946 B CN111431946 B CN 111431946B CN 202010523054 A CN202010523054 A CN 202010523054A CN 111431946 B CN111431946 B CN 111431946B
- Authority
- CN
- China
- Prior art keywords
- execution
- executive
- combination
- reliability
- scheduling
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
- H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a mimicry router executive body scheduling method and a mimicry router, and belongs to the technical field of network communication. Aiming at the problem that the scheduling strategy based on the execution body reliability only considers the reliability of a single execution body and does not consider the reliability of the whole system and the correlation between the execution bodies in the prior art, the invention increases two determining factors of the reliability of an execution body group and the correlation between the execution bodies on the basis of the prior scheduling strategy method, firstly obtains the state and the data information of the execution bodies, calculates the reliability of each execution body, calculates the reliability of the execution body group of random combination of all the execution bodies of which the reliability values are greater than a critical value according to the reliability of the execution bodies, simultaneously calculates the correlation between the execution bodies, synthesizes the above calculation method to generate the scheduling strategy method, finally decides the up-line and down-line conditions of the execution bodies, improves the accuracy of system monitoring abnormal information and improves the safety of the system.
Description
Technical Field
The present invention relates to the field of network communication technologies, and in particular, to a method for scheduling an execution entity of a mimic router and a mimic router.
Background
The cyberspace field includes known unknown risks and unknown threats as in nature, and commonly used cyberspace technologies include authentication technology, digital encryption technology, firewall technology, intrusion detection system, virtual private network technology, hacker trap technology, honeypots, etc. in the face of these cyberspace, loophole, backdoor, etc. However, with the advent of the world of 'everything interconnection', cloud computing and big data, the continuous progress of micro-electronics and virtualization technology, the continuous improvement of the security defense performance of the network space, and the mimicry defense theory comes up. The mimicry defense theory is a highly reliable, highly available and highly reliable information system, and is widely applied to network core equipment such as memories, DNS servers, switches, routers, WEB servers and the like at present. The three important characteristics of the mimicry defense structure are dynamic property, diversity and redundancy, namely, a plurality of multi-execution-body environments with equivalent functions and different structures are constructed, under the condition of ensuring that the system function is not changed, the dynamic property, the diversity and the randomness are fully utilized to hide various 'dark functions' existing in the execution body, the difficulty of scanning system bugs and backdoors by attackers is increased, and the attackers are difficult to establish continuous and reliable attack chains.
The router is an important device connected with the network, plays a role in forwarding network data messages, and once the router is attacked, the network data is possibly tampered or lost, thereby posing a great threat to the security of the network. In the face of the security problems of deep hidden back door, multiple available loopholes and the like of the router, a mimicry structure, namely a mimicry router, is added on the basis of the traditional router. The mimic router adopts a dynamic heterogeneous redundancy mechanism to inherit three characteristics of mimic dynamics, heterogeneity and redundancy, and the key point of the three characteristics is how to realize the dynamics in the face of attacks, namely, an execution body which is presented externally by changing in an irregular way.
The implementation of body dynamics and diversity in the mimicry router is performed in the scheduling unit. The dynamic scheduling unit has the main functions of managing the operation of the executors in the heterogeneous executors pool and the function sub-pool thereof, and scheduling a plurality of heterogeneous function executors according to the scheduling strategy specified by the decision unit, thereby realizing the dynamic property and diversity of the function executors, increasing the difficulty of scanning and finding by an attacker, and hiding the visibility degree of unknown bugs and backdoors.
The key link of the design of the dynamic scheduling unit is the scheduling strategy of the executive. The current scheduling policy is, for example, patent application CN201611010128.1 or CN201910148526.7, two random scheduling policies based on the execution body reliability and the execution body weight, and the scheduling policy based on the execution body reliability only considers the reliability of a single execution body at present, does not consider the reliability of the whole system and the correlation between the execution bodies, and is not sufficient in overall stability and security.
Disclosure of Invention
1. Technical problem to be solved
Aiming at the problem that the scheduling strategy based on the execution body reliability only considers the reliability of a single execution body and does not consider the reliability of the whole system and the correlation between the execution bodies in the prior art, the invention provides the execution body scheduling method of the mimicry router and the mimicry router, which can increase the reliability of an execution body group and the correlation between the execution bodies, improve the accuracy of monitoring abnormal information by a system and improve the safety of the system.
2. Technical scheme
The purpose of the invention is realized by the following technical scheme.
A mimicry router executive scheduling method comprises the following steps:
step 1: after the mimicry router is started, an executive body is online to acquire data information of the executive body, and the executive body is divided into a ready state, a working state and an abnormal state; switching among three states after the execution body is online according to the execution degree attacked condition or the working condition;
step 2: calculating the credibility of the executive body according to the number of times of attack on the executive body and the online time of the executive body;
and step 3: calculating a correlation coefficient between the executors according to the proportion of the executors which are attacked at the same time, and expressing the correlation between the executors;
and 4, step 4: the method comprises the steps that a plurality of executors with the credibility and the relevance meeting conditions form an executor combination, the credibility average value of the executor combination is calculated, the executor combination with the credibility average value meeting the conditions of the executor combination is subjected to calculation of the relevance coefficient of the executor combination, namely the relevance coefficient between each executor and other executors in the executor combination is calculated and represents the relevance between the executor combinations;
and 5: and (4) deciding whether the executive body is on line or off line according to the calculation results in the steps 2 to 4.
Further, the scheduling policy for executing on-line or off-line in step 5 is: and selecting the executives and/or the combinations of the executives with high reliability values and small correlation coefficients as the work executives. And selecting the executors in the working state through the reliability calculation, and considering the reliability of the whole scheduling system, wherein the executors with similar structures, strong correlation and low average reliability are not simultaneously used as the working executors as far as possible during scheduling. That is, when the executive is selected as the working state executive, the executive with high reliability is selected according to the calculation result, and the high reliability of the executive indicates that the executive is attacked less frequently and the state is stable and more reliable; the small correlation coefficient indicates that the structural similarity between the executors is low, and the system can simultaneously cope with various different kinds of attacks.
Furthermore, when calculating the correlation coefficient of the executable combination in step 4, the mean confidence value of the executable combination is calculated firstM，
Wherein 1 is less than or equal tok≤j，jTo specify the number of work executors,R i a confidence value for a single executable; if the reliability average value of the executive body combination is lower than the critical reliability average value, reselecting the executive body combination; calculating the correlation coefficients of all the execution body combinations meeting the reliability condition, namely, for all the execution body combinations meeting the reliability condition, respectively calculating the correlation coefficients between each execution body in each execution body combination and other execution bodies, selecting the maximum value of the correlation coefficient from the correlation coefficients to form the maximum value combination of the correlation coefficients, and selecting the execution body combination with the minimum correlation coefficient from the maximum value combination of the correlation coefficients as the work execution body combination.
And when the reliability average value of the executive body combination is lower than the critical reliability average value, the current scheduling system is considered to be unreliable, the working executive body is reselected, and otherwise, the current scheduling system is considered to be reliable. When the plurality of execution body combinations all meet the reliability condition and are judged to be reliable execution body combinations, calculating the correlation coefficient of each execution body combination, namely calculating the correlation coefficient between each execution body and other execution bodies in each execution body combination respectively, selecting the maximum value of the correlation coefficient among all the execution bodies in the execution body combinations, forming a maximum value combination of the correlation coefficient of each execution body combination, selecting the execution body combination with the minimum correlation coefficient from the maximum value combinations of the correlation coefficients as a work execution body combination, and judging the execution body combination to be the optimal execution body combination.
Further, the confidence level in step 2R i Is calculated by the formula
Wherein
Is an infinitely small value of the number of bits,t i the number of times the attack was made during the line-up,T i the total time length of the on-line is,iis the number id of the executable.R i The larger the value of (A), the greater the execution body confidence, and vice versaR i The smaller the value of (c), the smaller the execution body confidence.
Further, the correlation coefficient in step 3q ABIs calculated by the formula
WhereinT AB In order to have the execution body a and the execution body B in the working state time at the same time,t AB the time difference value of the executed body A and the executed body B under attack is smaller than the time critical difference value
The number of times. When calculating
As small as possible. If it is notT AB =0 ort AB =0 then executable a and executable B are considered irrelevant,q ABand = 0. Setting a correlation coefficient thresholdqIf, ifq AB≥qIf the correlation coefficient of the combination of the execution bodies is larger, A and B are not simultaneously used as the work execution bodies in the scheduling process, otherwise, A and B can be simultaneously used as the work execution bodiesAnd (4) a row body.
Furthermore, the executors with the execution reliability lower than the critical reliability value need offline cleaning and data rollback, and the executors are in an abnormal state. And the execution body in the abnormal state does not participate in the work any more, and a cleaning strategy is executed on the execution body in the abnormal state in order to improve the safety of the system. Setting a confidence threshold for performing an offline cleaning of an object toRWhen execution body confidence levelR i Is less than or equal toRIf so, the execution body is set to be in an abnormal state to wait for offline cleaning and data rollback operations; when in useR i Is greater thanRThe execution block is placed in a ready state during or after cleaning.
Further, when an executable is selected as a work executable, the ready state of the executable is preferably selected. If there is no ready-state executable in the state system, a selection is made among the executors in the operating state. The ready-state executors are generally on-line or cleaned just before, and have high reliability, and if there is no ready-state executer in the system during scheduling, or the reliability or correlation coefficient of the ready-state executors does not satisfy the condition, the ready-state executors are selected from the working-state executors, and at this time, the reliability and correlation coefficient of the executors need to be calculated.
Furthermore, after the mimicry router is started, the executive bodies are selected as the executive bodies in the working state according to the on-line sequence of the executive bodies, and the rest executive bodies are in the ready state. After the execution bodies are on line, all the execution bodies are not necessarily set to be in a working state according to working requirements, and the execution bodies which are successfully on line and are not set to be in the working state are set to be in a ready state at the moment.
Further, during the scheduling period: if the work executive body is attacked, selecting the work executive body by calculating the credibility and the correlation coefficient; and if the work executive body is not attacked, selecting the executive body as the work executive body by calculating the reliability and the correlation coefficient after the scheduling period is ended. In a scheduling period, if the executive is not attacked or the credibility and the correlation coefficient of the executive after the attack still meet the conditions, the current scheduling period is finished and then scheduling is carried out; if the executive body is attacked, scheduling is carried out through calculation of credibility and correlation coefficients, and the work executive body is reselected.
The scheduling method of the invention modifies the status of the executive into an abnormal status when the credibility value of the executive reaches a credibility critical value, then carries out offline cleaning and data rollback on the abnormal status executive, sets the executive after cleaning into a ready status, adjusts the status of the executive according to a scheduling strategy and calculates the credibility of the executive after the executive in a working status is attacked or a cycle time arrives, increases the credibility of an executive group and the correlation coefficient among the executions, ensures the reliability of the executive group in a working status within a scheduling period, avoids the simultaneous work of the executions with large correlation coefficient by the correlation among the executions, thereby fully utilizing the heterogeneous characteristics of the executions to ensure the system safety and improving the accuracy of monitoring abnormal information by the system.
A mimicry router comprises a dynamic scheduling subsystem, a routing arbitration subsystem, a protocol agent subsystem and a configuration management protocol agent subsystem, wherein the dynamic scheduling subsystem uses the mimicry router execution body scheduling method in combination. And the scheduling subsystem dynamically adjusts the state of the executive body and sends the state of the executive body to each subsystem, each subsystem determines whether the executive body participates in the arbitration of the service according to the state information of the executive body, and after the arbitration, the executive body which generates an inconsistent result feeds related information back to the scheduling subsystem for the scheduling subsystem to judge the credibility of the executive body.
In the mimicry router, the possibility that one executive body is broken by an attacker is high, but the possibility that multiple executive bodies with the same functions and different structures are simultaneously broken by the same attack method is low, so that the active defense performance of the system is improved in the face of the attack of the attacker, and the organization form of a heterogeneous group is adopted. The heterogeneous group can be formed by combining a plurality of virtual machines, routing simulation software of a plurality of manufacturers or virtual and real devices. The scheduling method of the invention carries out the scheduling of the work executive by calculating the credibility of the executive, the credibility of the heterogeneous group and the correlation coefficient between the executors, thereby better reflecting the dynamic property of the heterogeneous group and improving the safety of the system.
3. Advantageous effects
Compared with the prior art, the invention has the advantages that:
on the basis of calculating the reliability of a single executive body by the conventional scheduling strategy, the invention increases the calculation and comprehensive consideration of two determining factors of the correlation between the executive bodies and the reliability of an executive body group, calculates the reliability value of the heterogeneous executive bodies, the reliability value of the heterogeneous group and the correlation between the heterogeneous executive bodies according to the attack risk condition of the heterogeneous executive bodies, and finally decides the scheduling strategy of the executive bodies under the condition of abnormal attack or periodic scheduling according to the calculated data.
On the premise of calculating the reliability of a single executive body, calculating the correlation of the executive bodies and avoiding the probability of putting the executive bodies with strong correlation together; the reliability calculation of the executive body group guarantees the reliability average value of the executive body set in a working state in a scheduling period, not only guarantees the safety of a single executive body, but also guarantees the reliability and the relevance of a combined executive body, namely the executive body group from the whole consideration. The scheduling strategy is decided by the scheduling method, and the accuracy of monitoring abnormal information by the mimicry router is improved and the safety of the system is also improved by calculating the correlation between the executors and the group of the executors.
Drawings
FIG. 1 is a block diagram of a scheduling strategy of the present invention;
FIG. 2 is a diagram illustrating the status switching of an executive according to the present invention;
FIG. 3 is a flow chart of scheduling according to the present invention.
Detailed Description
The invention is described in detail below with reference to the drawings and specific examples.
Example 1
The embodiment introduces a mimicry router, which includes a dynamic scheduling subsystem, a routing arbitration subsystem (ipv 4, ipv 6), a protocol proxy subsystem (protocols such as bgp and ospf), and a configuration management protocol proxy subsystem (protocols such as netconf, telnet, ssh, and snmp), where the dynamic scheduling subsystem dynamically adjusts the state of an executor, and sends the state of the executor to the routing arbitration subsystem, the protocol proxy subsystem, and the configuration management subsystem, and each subsystem determines whether the executor participates in the arbitration of a service according to the state information of the executor, and feeds back related information to the dynamic scheduling subsystem for the dynamic scheduling subsystem to perform the feasibility decision of the executor after the arbitration.
The following describes in detail the scheduling method used by the scheduling subsystem in the pseudo router of this embodiment.
The execution body has three states after being online, namely a ready state, a working state and an abnormal state.
Ready state: the executives which are successfully started after the mimicry defense system is started and do not participate in the scheduling of each module of the system, the executives which are offline cleaned from the abnormal state, and the executives with the credibility values larger than the credibility critical value are all set to be ready states.
The working state is as follows: and the executors participating in the arbitration scheduling of each subsystem of the system are all set to be in a working state.
Abnormal state: the execution body with the credibility value less than or equal to the credibility critical value and the execution body with the abnormity caused by external factors such as software and hardware are all set to be in an abnormal state.
After the mimicry defense system is started, the executive body also starts to be on line, and the executive body which is on line realizes the switching of three states under corresponding conditions. As shown in fig. 2, the executive body is in a working state during normal working, and when the reliability of the executive body is higher than a critical value after a scheduling period, the executive body is switched to a ready state, and waits for the scheduling policy of the next period to continue working; and when the reliability of the executive body reaches a critical value or the executive body is interfered by external factors to generate abnormity, the executive body is switched to an abnormal state, the executive body in the abnormal state performs offline cleaning and data rollback, the cleaned executive body is in a ready state, and the executive body in the ready state is converted to a working state after the executive body meets a scheduling strategy through calculation.
The dynamic scheduling policy is shown in fig. 1, and specifically includes the following steps:
step 1: acquiring execution volume data information sent by each subsystem;
after the system is initially started, the executive bodies are sequentially on line, and the scheduling system selects the executive bodies to be in a working state or a ready state according to task requirements. And if the execution body is attacked to generate an exception, collecting data information related to the exception state for calculating the reliability and the relevance of the later execution body.
Step 2: calculating the reliability of the abnormal execution body;
according to the number of times of attack on the work executive and the on-line duration, calculating the credibility of the attacked executive, setting a credibility critical value of off-line cleaning of the executive, and setting the executive as an abnormal state to perform off-line cleaning and data rollback when the credibility is less than or equal to the critical value; when the confidence level is greater than the threshold or after cleaning, the execution body is set to be in a ready state. When the execution body in the working state is abnormal, the execution body in the working state or the ready state is selected as the working execution body with high reliability.
And step 3: calculating the correlation between the executors;
each executive body is independent and heterogeneous, the executive bodies are not related, and the attack difficulty is different, so the reliability of the whole system is considered, the executive bodies with similar structures and strong correlation are simultaneously taken as the work executive bodies when dispatching. To find out the similarity that may exist between the executives, a plurality of scheduling experiments can be performed and the regular characteristics of each executor or the attacks between the executives can be summarized.
In multiple scheduling experiments, the executive body id in a working state and the attacked executive body id in each experimental process are recorded, the proportion of simultaneous attack on the executive body combination in the multiple scheduling experiments is calculated according to multiple groups of recorded data, the online time length of the executive body id in the working state and the online times of the executive body ids simultaneously attacked by the same kind are recorded, and therefore the possible similarity among the executive bodies is found out. If the proportion of the attack to the multiple executors at the same time is larger, the correlation coefficient of the combination of the executors is larger, and the multiple executors are taken as the work executors while avoiding correlation during scheduling.
And 4, step 4: calculating the credibility of the heterogeneous group;
the average credibility of all the work executors also influences the reliability of the scheduling system, the relevance of the executors is calculated through the step 3, which executors are not suitable to be the work executors at the same time are obtained, and the credibility and the relevance coefficient of the work executors are calculated on the premise.
And calculating the credibility of the work executive body group according to the credibility average value of each executive body in the work executive body group, and judging that the work executive body group is reliable when the calculated credibility of the work executive body group is greater than or equal to the credibility critical value, otherwise, judging that the work executive body group is unreliable. And when the group judgment of the working executive bodies is unreliable, reselecting the executive bodies in the working state and the ready state, calculating the credibility of the group, and finding out the executive body combination meeting the condition that the group credibility is greater than or equal to the credibility critical value.
And aiming at the executive body combination meeting the group credibility of the work executive bodies, calculating the maximum value of the correlation coefficient of the combination, and finding out the executive body combination meeting the group credibility critical value requirement and having the minimum correlation, namely the optimal executive body combination serving as the work executive body.
And 5: and (4) integrating the scheduling strategies from the step (2) to the step (4) and scheduling the online or the offline of the decision executive. And (4) integrating the reliability of the executive bodies calculated in the step (2), the relevance coefficient of the executive bodies calculated in the step (3) and the reliability and the relevance coefficient of the working executive body group calculated in the step (4), and selecting the optimal executive body to work in combination.
The following describes the scheduling method of this embodiment specifically:
the scheduling system acquires abnormal data information sent by other subsystems on the mimicry router, calculates the credibility of the executors, the credibility of heterogeneous groups and the correlation among the executors according to the abnormal data information of the executors, and generates a corresponding scheduling strategy by the scheduling system according to the calculated numerical value.
The executive body is divided into three data sets according to different states, wherein:
c 1 executing volume data set in ready statec 1 ={m 11 , m 12 , m 13 ,…, m 1n }Comprises thatnAn execution body in a ready state;
c 2 executing volume data set in working statec 2 ={m 21 , m 22 , m 23 ,…, m 2j }Comprises thatjAn execution body in an operating state;
c 3 executing volume data set in abnormal statec 3 ={m 31 , m 32 , m 33 ,…, m 3k }Comprises thatkAn execution body in an abnormal state;
Nthe executive bodies in all the online states and the offline states in the executive body pool,n+j+k≤N。
as shown in FIG. 3, in the scheduling method, after the pseudo router is initially started, a certain number of executors are taken out from the executor pool according to the following rules and put into the working state setc 2 In and (2) mixingc 2 The state of all executors in the system is set to the working state. The starting and ready state executors of the working state executors are set by the following rules:
(i) if all executives in the executives pool have been successfully on-line within a specified time, a specified number of executives are selected as executives in an operating state according to the time sequence of the sequential on-line of the executives, and the remaining executives are put in a ready statec 1 ；
(ii) If the number of successful online executors does not reach the specification within the specified time, the successful online executors in the execution entity pool are used as the executors in the working state, and the rest areIf the execution body is successfully on line, the execution body is set to be in a ready state and put inc 1 。
After the system runs, the system carries out periodic scheduling or scheduling under abnormal conditions according to the attack condition suffered by the executive body during the working period. The periodic scheduling is to set a scheduling periodTIf all the work executors are not attacked during the operation of the system, the scheduling time is passedTAfter that, the working executors are reselected. And the scheduling under the abnormal condition is to reselect the working executive body if the executive body under the current working state is attacked. The scheduling in the case of either periodic scheduling or abnormal conditions is performed according to the following scheduling policy.
The specific scheduling policy rules are as follows: if it is notc 2 The slave is prioritized if the middle executive body has an exception or needs to perform periodic schedulingc 1 The executive which has not worked is selected as the working executive. For the executives which have participated in the scheduling, whether to continue to be the work executives is determined by calculating the credibility of the executives, the correlation among the executives and the like. The calculation rules regarding execution entity confidence, correlation between execution entities, and system confidence are as follows:
(1) computing execution volume trustworthiness
Firstly, recording the times of attack on a work executive body and the online time length in the running process of a system, and calculating the credibility of the attacked executive bodyR i ：
Wherein
Is an infinitely small value of the number of bits,t i the number of times the attack was made during the line-up,T i the total time length of the on-line is,iis the number id of the executable.
R i The larger the value of (A), the more executable the executable mayThe greater the confidence, the oppositeR i The smaller the value of (c), the smaller the execution body confidence. Setting a confidence threshold for performing an offline cleaning of an object toRWhen is coming into contact withR i Is less than or equal toRIf so, the execution body is set to be in an abnormal state and put inc 3 During the process, offline cleaning and data rollback operations are to be performed; when in useR i Is greater thanRAt the time or after cleaning, the execution body is put into a ready statec 1 Performing the following steps; when in usec 2 When the middle work executive body is abnormal, the middle work executive body is selected according to the strategyc 1 、c 2 The executable in (2) is used as a work executable.
(2) And calculating correlation coefficients between the execution bodies.
The types of attacks that the executives may be subjected to are different while the executives work, so that the time difference of the executives subjected to the attacks is limited to ensure that the executives are subjected to the same attacks with high probability, namely the A executives are assumed to be int A The moment is attacked, and the B executive ist B The time is attacked, and a time critical difference value is added to ensure that A and B are attacked to be the same in a large probability
（ 
As small as possible), i.e., if
Then a and B are considered to be suffering from the same attack. In the next experiments, statistics A and B were both at the same timec 2 Time in the set (assumed to beT AB ) A and B are attacked and satisfy the condition
Number of times (assumed to bet AB ) To obtain that A and B are attacked when working simultaneouslyCorrelation coefficient after impactq AB，q ABThe calculation formula is as follows:
setting a correlation coefficient thresholdqIf, ifq AB≥qIf the correlation coefficient of the combination of the execution bodies is larger, A and B are not simultaneously used as the work execution bodies in the scheduling process, otherwise A and B can be simultaneously used as the work execution bodies.
(3) Calculating group credibility
The average trustworthiness of all work executors also affects the reliability of the dispatch system. First excluding abnormal state setc 3 And (3) calculating the correlation between the executives through the step (2) for the executives to be subjected to offline cleaning to obtain which executives are not suitable for being simultaneously the work executives, and calculating the credibility and correlation coefficient of the work executives on the premise.
The specific algorithm is as follows: calculating the average credibility according to the credibility value of each executive bodyM，
Wherein 1 is less than or equal tok≤j，jThe number of work executors is specified. Is provided withWIs a reliability threshold of the overall scheduling systemM≥WConsidering the scheduling system as reliable, and considering the scheduling system as unreliable, thenc 1 Andc 2 re-selecting the executors and calculating the average confidence level to find out all the satisfied onesM≥WThe execution of the conditions is combined.
Respectively calculating the combination of the executors meeting the above-mentioned reliability conditionM 1,M 2,M 3…. Obtaining the maximum value of the correlation coefficient of each executive body combination
,i，jFor the intra-combination execution entity id: (i≠j），nFor the number of executors in a group, the correlation calculation of the combination of executors is to calculate the correlation between each executor in each group and other executors, i.e. the correlation between each executor and other executors in each group is calculatediWhen not changed, change in sequencejCalculatingQ i Then change againiSequentially calculateQ i The value of (c). The maximum value of the correlation coefficient for each execution volume combination forms a maximum value combination of correlation coefficients. Selecting the smallest corresponding execution body combination in the correlation coefficient maximum value combination as the work execution body combination, namely calculating min (max:)Q i )1, max(Q i )2, max(Q i )3… …) which is the optimal combination of execution bodies with the highest reliability and stability.
According to the method and the device, on the basis of the existing scheduling strategy, the reliability of the executors, the correlation coefficient between the executors and the reliability average value between the execution body combinations are comprehensively calculated, the correlation coefficient between the executors avoids putting the executors with strong correlation together for working, the reliability average value between the execution body combinations guarantees the reliability average value of the execution body set in a working state in a scheduling period, and the accuracy of monitoring abnormal information and the safety of the system are improved.
The invention and its embodiments have been described above schematically, without limitation, and the invention can be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The representation in the drawings is only one of the embodiments of the invention, the actual construction is not limited thereto, and any reference signs in the claims shall not limit the claims concerned. Therefore, if a person skilled in the art receives the teachings of the present invention, without inventive design, a similar structure and an embodiment to the above technical solution should be covered by the protection scope of the present patent. Furthermore, the word "comprising" does not exclude other elements or steps, and the word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Several of the elements recited in the product claims may also be implemented by one element in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.
Claims (10)
1. A mimicry router executive body scheduling method is characterized by comprising the following steps:
step 1: after the mimicry router is started, an executive body is online to acquire data information of the executive body, and the executive body is divided into a ready state, a working state and an abnormal state;
step 2: calculating the credibility of the executive body according to the number of times of attack on the executive body and the online time of the executive body;
and step 3: calculating a correlation coefficient between the executors according to the proportion of the executors which are attacked at the same time, and expressing the correlation between the executors;
and 4, step 4: the method comprises the steps that a plurality of executors with the credibility and the relevance meeting conditions form an executor combination, the credibility average value of the executor combination is calculated, the executor combination with the credibility average value meeting the conditions of the executor combination is subjected to calculation of the relevance coefficient of the executor combination, namely the relevance coefficient between each executor and other executors in the executor combination is calculated and represents the relevance between the executor combinations;
and 5: and (4) deciding whether the executive body is on line or off line according to the calculation results in the steps 2 to 4.
2. The method as claimed in claim 1, wherein the scheduling policy for on-line or off-line of the execution entity in step 5 is: and selecting the executives and/or the combinations of the executives with high reliability values and small correlation coefficients as the work executives.
3. The method as claimed in claim 2, wherein the correlation coefficient of the combination of the plurality of routers to be executed is calculated in step 4 by first calculatingMean confidence of execution block combinationM，
Wherein 1 is less than or equal tok≤j，jTo specify the number of work executors,R i a confidence value for a single executable; if the reliability average value of the executive body combination is lower than the critical reliability average value, reselecting the executive body combination; calculating the correlation coefficients of all the execution body combinations meeting the reliability condition, namely, for all the execution body combinations meeting the reliability condition, respectively calculating the correlation coefficients between each execution body in each execution body combination and other execution bodies, selecting the maximum value of the correlation coefficient from the correlation coefficients to form the maximum value combination of the correlation coefficients, and selecting the execution body combination with the minimum correlation coefficient from the maximum value combination of the correlation coefficients as the work execution body combination.
4. The method as claimed in claim 1, wherein the confidence level in step 2 isR i Is calculated by the formula
Wherein
Is an infinitely small value of the number of bits,t i the number of times the attack was made during the line-up,T i the total time length of the on-line is,iis the number id of the executable.
5. The method as claimed in claim 1, wherein the correlation coefficient in step 3 is a correlation coefficientq ABIs calculated by the formula
WhereinT AB For the execution body A and the execution body B to be in the working state at the same timeThe time of the state is as follows,t AB the time difference value of the executed body A and the executed body B under attack is smaller than the time critical difference value
The number of times.
6. The method as claimed in claim 1, wherein the executing entity with the executing entity confidence level lower than the threshold confidence level needs offline cleaning and data rollback, and the executing entity is in an abnormal state.
7. The method as claimed in claim 2, wherein the ready state is selected preferentially when the task executor is selected as the pseudo-router executor.
8. The method as claimed in claim 7, wherein the quasi-router is configured to select the execution entities as working states according to the order of the execution entities, and the rest of the execution entities are in ready states.
9. The method of claim 2, wherein in the scheduling period: if the work executive body is attacked, selecting the work executive body by calculating the credibility and the correlation coefficient; and if the work executive body is not attacked, selecting the executive body as the work executive body by calculating the reliability and the correlation coefficient after the scheduling period is ended.
10. A mimicry router comprising a dynamic scheduling subsystem, a routing arbitration subsystem, a protocol agent subsystem and a configuration management protocol agent subsystem, wherein the dynamic scheduling subsystem uses in combination a mimicry router executive scheduling method according to any one of claims 1-9.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010523054.1A CN111431946B (en) | 2020-06-10 | 2020-06-10 | Mimicry router execution body scheduling method and mimicry router |
| PCT/CN2020/117989 WO2021248740A1 (en) | 2020-06-10 | 2020-09-27 | Mimic router execution entity scheduling method, and mimic router |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010523054.1A CN111431946B (en) | 2020-06-10 | 2020-06-10 | Mimicry router execution body scheduling method and mimicry router |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111431946A CN111431946A (en) | 2020-07-17 |
| CN111431946B true CN111431946B (en) | 2020-09-04 |
Family
ID=71551345
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010523054.1A Active CN111431946B (en) | 2020-06-10 | 2020-06-10 | Mimicry router execution body scheduling method and mimicry router |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN111431946B (en) |
| WO (1) | WO2021248740A1 (en) |
Families Citing this family (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111431946B (en) * | 2020-06-10 | 2020-09-04 | 网络通信与安全紫金山实验室 | Mimicry router execution body scheduling method and mimicry router |
| CN112118064B (en) * | 2020-08-18 | 2022-10-21 | 河南信大网御科技有限公司 | Time synchronization method for mimicry heterogeneous equipment |
| CN111988312A (en) * | 2020-08-19 | 2020-11-24 | 中国人民解放军战略支援部队信息工程大学 | Mimicry construction web cloud service method and system |
| CN112187865B (en) * | 2020-09-02 | 2022-11-01 | 中国人民解放军战略支援部队信息工程大学 | Open shortest path priority message processing method and mimicry equipment |
| CN112491905B (en) * | 2020-12-01 | 2023-05-05 | 郑州昂视信息科技有限公司 | Performance test method, device and system of network equipment |
| CN112615880B (en) * | 2020-12-27 | 2022-11-08 | 郑州昂视信息科技有限公司 | Negative feedback scheduling method and scheduling system for executive |
| CN114301650B (en) * | 2021-12-21 | 2022-08-30 | 浙江大学 | Mimicry WAF (wide area filter) judging method based on credibility |
| CN114363037B (en) * | 2021-12-30 | 2023-09-29 | 河南信大网御科技有限公司 | Strong arbitration method, system, architecture and medium based on mimicry specific scene |
| CN114363047B (en) * | 2021-12-31 | 2023-09-08 | 河南信大网御科技有限公司 | Transparent proxy-based postterm arbitration mimetic construction system |
| CN114363048B (en) * | 2021-12-31 | 2023-07-07 | 河南信大网御科技有限公司 | Mimicry unknown threat discovery system |
| CN114531269B (en) * | 2021-12-31 | 2023-11-14 | 网络通信与安全紫金山实验室 | Tbox judging method and device |
| CN114793248B (en) * | 2022-03-02 | 2024-02-23 | 上海图灵智算量子科技有限公司 | Mimicry-based encryption communication method |
| CN115225311B (en) * | 2022-05-20 | 2023-07-21 | 中国人民解放军战略支援部队信息工程大学 | Pseudo bracket ciphertext proxy method and system based on openSSL transformation |
| CN115296839A (en) * | 2022-06-24 | 2022-11-04 | 网络通信与安全紫金山实验室 | Mimic routing method, device and storage medium based on BGP-LS arbitration |
| CN115941559B (en) * | 2023-03-14 | 2023-06-06 | 之江实验室 | Method and device for dynamically managing mimicry executor based on FPGA |
| CN116455627B (en) * | 2023-04-12 | 2023-10-27 | 乾讯信息技术(无锡)有限公司 | Network cipher machine with mimicry structure and its implementation method |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106411937A (en) * | 2016-11-15 | 2017-02-15 | 中国人民解放军信息工程大学 | Mimicry defense architecture based zero-day attack detection, analysis and response system and method thereof |
| US10440048B1 (en) * | 2018-11-05 | 2019-10-08 | Peking University Shenzhen Graduate School | Anti-attacking modelling for CMD systems based on GSPN and Martingale theory |
| CN110647918A (en) * | 2019-08-26 | 2020-01-03 | 浙江工业大学 | Mimicry defense method for resisting attack by deep learning model |
| CN110673951A (en) * | 2019-08-30 | 2020-01-10 | 华东计算技术研究所（中国电子科技集团公司第三十二研究所） | Mimicry scheduling method, system and medium for general operation environment |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106874755B (en) * | 2017-01-22 | 2019-07-12 | 中国人民解放军信息工程大学 | Most consistent escape error processing apparatus and method |
| CN109525418B (en) * | 2018-10-11 | 2021-10-08 | 浙江工商大学 | Scheduling method for guaranteeing service deployment executor set heterogeneity under mimicry defense |
| CN110011965B (en) * | 2019-02-28 | 2021-09-24 | 中国人民解放军战略支援部队信息工程大学 | Execution body complete non-uniform output arbitration method and device based on credibility |
| CN111431946B (en) * | 2020-06-10 | 2020-09-04 | 网络通信与安全紫金山实验室 | Mimicry router execution body scheduling method and mimicry router |
-
2020
- 2020-06-10 CN CN202010523054.1A patent/CN111431946B/en active Active
- 2020-09-27 WO PCT/CN2020/117989 patent/WO2021248740A1/en active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106411937A (en) * | 2016-11-15 | 2017-02-15 | 中国人民解放军信息工程大学 | Mimicry defense architecture based zero-day attack detection, analysis and response system and method thereof |
| US10440048B1 (en) * | 2018-11-05 | 2019-10-08 | Peking University Shenzhen Graduate School | Anti-attacking modelling for CMD systems based on GSPN and Martingale theory |
| CN110647918A (en) * | 2019-08-26 | 2020-01-03 | 浙江工业大学 | Mimicry defense method for resisting attack by deep learning model |
| CN110673951A (en) * | 2019-08-30 | 2020-01-10 | 华东计算技术研究所（中国电子科技集团公司第三十二研究所） | Mimicry scheduling method, system and medium for general operation environment |
Non-Patent Citations (1)
| Title |
|---|
| 基于动态异构冗余机制的路由器拟态防御体系结构;马海龙，等;《信息安全学报》;20170115;第2卷(第1期);第29-41页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2021248740A1 (en) | 2021-12-16 |
| CN111431946A (en) | 2020-07-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111431946B (en) | Mimicry router execution body scheduling method and mimicry router | |
| Kumari et al. | A comprehensive study of DDoS attacks over IoT network and their countermeasures | |
| Bhushan et al. | Security challenges in cloud computing: state-of-art | |
| Peng et al. | Survey of network-based defense mechanisms countering the DoS and DDoS problems | |
| Beitollahi et al. | Analyzing well-known countermeasures against distributed denial of service attacks | |
| Wang et al. | An advanced hybrid peer-to-peer botnet | |
| US8881259B2 (en) | Network security system with customizable rule-based analytics engine for identifying application layer violations | |
| US8561188B1 (en) | Command and control channel detection with query string signature | |
| Shen et al. | Adaptive Markov game theoretic data fusion approach for cyber network defense | |
| Ankali et al. | Detection architecture of application layer DDoS attack for internet | |
| Shen et al. | A markov game theoretic data fusion approach for cyber situational awareness | |
| Thakur et al. | Detection and Prevention of Botnets and malware in an enterprise network | |
| WO2023193513A1 (en) | Honeypot network operation method and apparatus, device, and storage medium | |
| Nagarathna et al. | SLAMHHA: A supervised learning approach to mitigate host location hijacking attack on SDN controllers | |
| Kaur et al. | Security in IoT network based on stochastic game net model | |
| CN114726557A (en) | Network security protection method and device | |
| Park et al. | Dynamic virtual network honeypot | |
| CN106357661B (en) | A kind of distributed refusal service attack defending method based on interchanger rotation | |
| Yu et al. | Peer-to-peer system-based active worm attacks: Modeling, analysis and defense | |
| Meier et al. | Towards an AI-powered Player in Cyber Defence Exercises | |
| Khosravifar et al. | An experience improving intrusion detection systems false alarm ratio by using honeypot | |
| Wang et al. | A multi-layer framework for puzzle-based denial-of-service defense | |
| Wang et al. | On the effectiveness of secure overlay forwarding systems under intelligent distributed DoS attacks | |
| Hwa et al. | Review of peer-to-peer botnets and detection mechanisms | |
| Pigaglio et al. | RAPTEE: Leveraging trusted execution environments for Byzantine-tolerant peer sampling services |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |