WO2018171810A1 - 一种实现移动目标防御的方法、装置及存储介质 - Google Patents

一种实现移动目标防御的方法、装置及存储介质 Download PDF

Info

Publication number
WO2018171810A1
WO2018171810A1 PCT/CN2018/081967 CN2018081967W WO2018171810A1 WO 2018171810 A1 WO2018171810 A1 WO 2018171810A1 CN 2018081967 W CN2018081967 W CN 2018081967W WO 2018171810 A1 WO2018171810 A1 WO 2018171810A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
running environment
virtual running
system call
user service
Prior art date
Application number
PCT/CN2018/081967
Other languages
English (en)
French (fr)
Inventor
崔云峰
钟卫东
刘�东
王继刚
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018171810A1 publication Critical patent/WO2018171810A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis

Definitions

  • the present disclosure relates to information security technologies, and more particularly to a method, apparatus, and storage medium for implementing mobile target defense.
  • the main protection methods in the field of information security are based on known viruses, known vulnerabilities, and known attack methods.
  • Such prior knowledge-based defenses are costly and cannot protect against unknown security risks.
  • virus scanning it is necessary to establish a virus sample library for known virus knowledge, and use the characteristics in the sample library to perform matching check with the current operating state of the system. This method finds that the virus is inefficient and cannot protect against unknown security risks. .
  • Regularly updating the patch also requires the software publisher to fully protect the code in the system. If the vulnerability is discovered, the user needs to be notified in time to update the vulnerability. In recent years, the zero-day vulnerability has increased year by year, and the speed of defensive repair of software developers has lagged behind the speed of vulnerability discovery.
  • MTD Moving Target Defense
  • an attacker In an enormous software system, an attacker only needs to find a vulnerability, and can completely “champion” with a few lines of code; and the defender needs to fully protect millions of lines and 10 million lines of code to prevent loopholes from being use.
  • Mobile target defense advocates change over time, constantly transforming different mechanisms and strategies, so that the system reflects the characteristics of randomness, diversity and dynamics. Through the ever-changing surface of the attack, the difficulty of the attack is significantly increased, and the possibility of exploiting the vulnerability is also reduced.
  • the operating system is the underlying supporting foundation of the entire system and governs all the privileged operations of the system. Therefore, the security improvement program of the operating system has always been a hot spot in the industry.
  • there are some mobile target defense methods applied to the operating system which dynamically change the externally exposed attackable surface by dynamically changing the operating system.
  • the first level of virtual machines includes HyperShell, second-level target virtual machines, and multiple nested virtual machines that provide extended services. Dynamically move the second-level virtual machine and the nested virtual machines of various extended services dynamically through HyperShell to migrate on different physical machines and dynamically migrate at different virtual nesting levels.
  • the method utilizes virtualization technology to dynamically change the guest operating system, and dynamically migrates the extended service between multiple guest operating systems, changing the attackable surface exposed by the system, thus increasing the attacker's system detection.
  • the technical difficulty of exploiting vulnerabilities But when an attacker grasps a vulnerability, it can be successfully attacked at some point. The ever-changing attack surface does not fully guarantee the security of the system, and the attack may still succeed in the case of persistent threats.
  • the related art proposes a mobile target defense method based on multi-operating system operation.
  • the external user accesses the device corresponding to the method through the network, and the device is composed of a management device and a plurality of host systems running different operating systems, and provides services externally in multiple host systems through the synchronization state of the management device.
  • the method deploys different operating systems through multiple physical host systems, thereby dynamically changing the attackable surface exposed by the operating system, so that the attacker cannot predict the operating system of the current service.
  • This implementation requires multiple host systems to be set up at a higher cost.
  • there is a problem that the system is successfully attacked when an attacker hits a vulnerability in the current operating system or upper-layer service at a certain moment.
  • the solutions for implementing the mobile target defense in the related technologies are all external technical solutions of the operating system (such as creating multiple virtual operating systems by virtualization, or running multiple actual operating systems in multiple physical environments, etc.)
  • To dynamically change the operating system and upper-layer service services thereby dynamically changing the attackable surface exposed by the system, so that the attack reachable path and the attack time window are in a dynamic state, and finally achieve the purpose of defending against unknown security threats, and improve the system. safety.
  • the related technology has two problems: first, it cannot detect the security threat that has occurred or is occurring in time; secondly, it cannot defend against the threat of the hit, such as when the attacker hits the attacked object at a certain moment. When a security breach occurs, the security of the system is completely destroyed.
  • Embodiments of the present disclosure provide a method, apparatus, and storage medium for implementing mobile target defense.
  • An embodiment of the present disclosure provides an apparatus for implementing a mobile target defense, including: a virtual running environment management module, a system call management module, a virtual running environment module, and a user service module, which are disposed in a host operating system;
  • the virtual running environment module includes a mirror image of at least two heterogeneous virtual running environment modules, and is configured to provide a virtual running environment for the upper user service modules;
  • the user service module including the image of at least two heterogeneous user service modules, configured to be responsible for actual user service functions;
  • the virtual running environment management module is configured to create a target number of virtual running environments according to the target number of the generated virtual running environment, according to the mirror of the created virtual running environment module and the image of the user service module; Notify, manage a virtual operating environment that may have security issues;
  • the system call management module is configured with monitoring system call information for identifying a system call that needs to be monitored, and is configured to manage the system call in the created virtual running environment according to the monitoring system call information to determine a virtual operation that may have a security problem. Environment and notify the virtual running environment management module;
  • heterogeneity has the same function but different internal structures.
  • the image of the virtual running environment module is a lightweight virtualized infrastructure component.
  • the mirroring of the heterogeneous virtual running environment module includes: different configuration options of the infrastructure component, different source code versions of the infrastructure components, and different compilation options of the infrastructure components.
  • the mirroring of the heterogeneous service module includes: compiling optimization options are different, and compiler versions are different.
  • the virtual running environment management module creates a plurality of virtual running environments in the target:
  • the initializing the virtual running environment module and the user service module in the virtual running environment management module includes:
  • managing the system call in the created virtual running environment in the system call management module includes:
  • the decision is made based on the information of the controlled system calls of all the virtual operating environments, and the virtual operating environment management module that may have security problems is notified to the virtual operating environment management module.
  • the monitoring system call information includes: a key operating system call of the user service, a key output system call of the user service, and a device privileged system call managed by the operating system.
  • system call management module is configured to:
  • the other virtual running environment is not in the system call waiting decision state, set the current virtual running environment to wait for the decision state, set a timeout timer; until the timeout timer expires, check whether other virtual running environments are in the system call waiting decision state;
  • the virtual running environment that has not entered the system call waiting state for the timeout is regarded as an illegal virtual running environment and notifies the virtual running environment management module;
  • the virtual running environment management module is configured to:
  • the virtual running environment with the legal decision is marked as normal, and processed according to the original process of the system call; the virtual running environment determined to be illegal is set to an abnormal state, and the virtual running environment of the abnormal state is cleaned.
  • the virtual running environment management module is further configured to: start the abnormal state virtual running environment and user service after the cleaning, and reset to a normal state.
  • the decision includes: a majority decision; the majority decision includes: in all virtual operating environments, it is considered that most of the same system call conditions are legal access, and system calls different from most system calls are illegal. Access; or,
  • the decision includes: a consistency decision; the consistency decision includes: when all system calls in all virtual operating environments are completely consistent, the current access is considered to be legitimate, otherwise the access is illegal.
  • the virtual running environment management module is further configured to:
  • an external event When an external event occurs, an external event transmitted through the host operating system is received; the virtual running environment in a normal state is traversed and the received external event is sequentially forwarded.
  • the embodiment of the present disclosure further provides a method for implementing mobile target defense, including:
  • Set monitoring system call information to identify the system calls that need to be monitored, and the number of targets for the virtual running environment that needs to be created;
  • heterogeneity has the same function but different internal structures.
  • the image of the virtual running environment module is a lightweight virtualized infrastructure component
  • the mirroring of establishing at least two or more heterogeneous virtual running environments includes:
  • a mirror image of the at least two heterogeneous virtual runtime environment modules is generated by obtaining different infrastructure component versions with different functionality but different source versions, using different compilers and different compilation options for different infrastructure component versions.
  • the mirroring of establishing at least two heterogeneous user services includes:
  • a mirror of the at least two heterogeneous user service modules is generated by using different versions of the compiler, as well as different compilation options.
  • the monitoring system call information is set according to preset configuration information
  • the monitoring system call information includes: a key operating system call of the user service, a key output system call of the user service, and a device privileged system call managed by the operating system.
  • the creating a target number of virtual running environments includes:
  • the initializing the virtual running environment module and the user service module includes:
  • a mirror as a mirror of the virtual running environment module to be run; randomly selecting from the mirror of the at least two heterogeneous user service modules A mirror is used as a mirror image of the user service module to be run; a virtual running environment is created according to the selected image until the number of created virtual running environments reaches the target number.
  • the system call in the created virtual running environment is monitored according to the monitoring system call information to determine a virtual running that may have a security problem.
  • the environment includes:
  • the current system call situation in all virtual operating environments is determined, and the virtual operating environment that is legally determined is marked as normal, and processed according to the original process of the system call.
  • the virtual running environment that is determined to be illegal is set to an abnormal state, and the virtual running environment of the abnormal state is cleaned.
  • the method further includes: starting the cleaned abnormal state virtual running environment and user service and resetting to a normal state.
  • the judgment includes: a multiple decision
  • the multiple decision includes: in all virtual operating environments, it is considered that most of the same system call situations are legitimate access, and system calls different from most system calls are illegal access; or,
  • the decision includes: a consistency decision; the consistency decision includes: when all system calls in all virtual operating environments are completely consistent, the current access is considered to be legitimate, otherwise the access is illegal.
  • the method further includes:
  • an external event When an external event occurs, an external event transmitted through the host operating system is received; the virtual running environment in a normal state is traversed and the received external event is sequentially forwarded.
  • Embodiments of the present disclosure also provide a storage medium having stored thereon computer executable instructions for use in the steps of any of the above methods.
  • the technical solution of the embodiment of the present disclosure includes: establishing a mirror image of a plurality of heterogeneous virtual running environments, and mirroring a plurality of heterogeneous user services; setting monitoring system call information for identifying a system call to be monitored, and creating a system call The target number of the virtual running environment; the target virtual running environment is created according to the mirror of the created virtual running environment and the image of the user service, and the system call in the created virtual running environment is monitored according to the monitoring system calling information. Identify virtual operating environments where security issues may exist.
  • the device for implementing the mobile target defense creates a plurality of heterogeneous virtual running environments, and the mirroring of the virtual running environment module and the mirroring of the user service module form a random and diverse isomer in a plurality of manners.
  • the heterogeneous external attack surface also presents random and diverse features.
  • the mirror of the virtual running environment module and the mirror of the user service module are randomly and dynamically loaded at runtime, making the external attack surface at runtime unpredictable.
  • the technical solution provided by the embodiment of the present disclosure utilizes the idea of moving target defense from multiple angles such as user service and virtual running environment, thereby realizing the dynamic change of the attackable surface and the attack path exposed by the device for implementing the mobile target defense. It is convenient for timely detection of security threats and improves the security level of the entire system.
  • the technical solution provided by the embodiment of the present disclosure performs multi-mode decision through system calls of multiple virtual running environments, and can timely identify and block various types of illegal privileged operations and illegal business operations according to the judgment result, thereby realizing unknown Dealing with security threats.
  • the virtual running environment module or the user service module may be destroyed internally, but the external key operations cannot be destroyed. Therefore, the security of the entire device that implements the mobile target defense is not affected, and the problem that the security of the single execution body directly affects the security of the entire system is greatly reduced. Only when more than half of the virtual running environments have an identical illegal operation in an external behavior or privileged operation will affect the security of the entire device that implements the mobile target defense. However, since the virtual running environment module and the user service module in the embodiment of the present disclosure are different in structure, the causes of the vulnerability and the method of utilizing the same are different. Therefore, the probability that more than half of the completely identical illegal operations occur is extremely low.
  • FIG. 1 is a schematic structural diagram of a device for implementing a mobile target defense according to an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a method for implementing mobile target defense according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart of an embodiment of creating a virtual operating environment in a method for implementing mobile target defense according to the present disclosure
  • FIG. 4 is a schematic flowchart diagram of an embodiment of execution and determination of a system call in a method for implementing mobile target defense according to the present disclosure
  • FIG. 5 is a schematic flowchart of an embodiment of transmitting an external event in a method for implementing mobile target defense according to the present disclosure
  • FIG. 6 is a schematic diagram of an embodiment of outputting an error result after a user service is attacked in a method for implementing a mobile target defense according to the present disclosure
  • FIG. 7 is a schematic diagram of an embodiment of performing an illegal privileged operation after a user service is attacked in a method for implementing a mobile target defense according to the present disclosure
  • FIG. 8 is a schematic diagram of an embodiment of an abnormal situation after a user service is attacked in a method for implementing a mobile target defense according to the present disclosure
  • FIG. 9 is a schematic diagram of an embodiment in which multiple user services are simultaneously attacked in a method for implementing mobile target defense according to the present disclosure.
  • FIG. 1 is a schematic structural diagram of a device for implementing mobile target defense according to the present disclosure. As shown in FIG. 1 , the method includes at least: a virtual running environment management module, a system call management module, and a virtual running environment module and a user that are set in a host operating system. Business module.
  • the virtual running environment module includes a plurality of heterogeneous (same functions but different internal structures) virtual running environment modules, which are configured to provide a virtual running environment for the upper layer user service modules, and realize a user service perspective. Looking at running in a virtual running environment is equivalent to monopolizing the actual operating system.
  • the virtual runtime environment module exists in the form of lightweight virtualized infrastructure components such as LXC containers and related libraries, Docker, and the like. Each virtual runtime environment module has the same function but different structure.
  • the specific implementation manners include, but are not limited to, different configuration options of the infrastructure components, different source code versions of the infrastructure components, and different compilation options of the infrastructure components.
  • Different virtual running environment modules are created by obtaining several infrastructure component versions with the same function but different source versions, and different infrastructure component versions (such as V1.0, V1.2, etc. with the same function and different source code). , using different compilers (such as gcc3.1.4 or gcc4.1.2 and other compiler versions) and different compile options (such as O1, O2, O3 and other compiler optimization options) to produce several heterogeneous (the same function but different internal structure ) A mirror of the virtual runtime environment module.
  • compilers such as gcc3.1.4 or gcc4.1.2 and other compiler versions
  • different compile options such as O1, O2, O3 and other compiler optimization options
  • the user service module includes a number of heterogeneous (same functions but different internal structure) user service modules, which are configured to be responsible for actual user service functions.
  • each user service module runs on a virtual runtime environment module.
  • Each user service module has the same function but different internal structures.
  • the specific implementation includes but is not limited to: different compiler optimization options, different compiler versions, and the like.
  • Different user service modules are built by using different versions of compilers, such as gcc3.1.4 or gcc4.1.2 and other compiler versions, as well as different compilation options, such as O1, O2, O3, etc. Generates a mirror image of several heterogeneous (same functions but different internal structures) user service modules.
  • compilers such as gcc3.1.4 or gcc4.1.2 and other compiler versions, as well as different compilation options, such as O1, O2, O3, etc.
  • the virtual running environment management module is configured to create a plurality of target virtual running environments according to the mirror of the created virtual running environment module and the image of the user service module according to the target number of the generated virtual running environment; Invoke notifications from the management module to manage virtual runtime environments that may have security issues.
  • managing a number of virtual operating environments includes, but is not limited to, creation, cleaning, and management of operational status.
  • creating a target number of virtual running environments in the virtual running environment management module includes:
  • the virtual running environment module and the user service module are initialized to form an unpredictable attack surface, which includes: dynamically selecting a mirror from the mirrors of several heterogeneous virtual running environment modules as the virtual running environment to be run. Mirroring of the module; dynamically selecting a mirror as the image of the user service module to be run from the mirror of several heterogeneous user service modules; creating a virtual running environment according to the selected image; creating a virtual method by using the above method Run the environment until the number of virtual runtime environments created reaches the target number. Then, load and run several established virtual running environments, and set the state of the created virtual running environment to the normal available state.
  • a system call management module is provided with monitoring system call information for identifying a system call that needs to be monitored, and configured to manage system calls in the created virtual running environment according to monitoring system call information to determine that there may be security.
  • the virtual runtime environment of the problem and notify the virtual runtime environment management module.
  • the monitoring system call information includes, but is not limited to, a critical operating system call of the user service, a key output system call of the user service, and a device-privileged system call managed by the operating system.
  • the management of the system call in the created virtual running environment specifically includes:
  • a unified external operation through the system call of the operating system is required. That is to say, based on the system call execution and decision mode of the redundant virtual running environment in the device for implementing the mobile target defense shown in FIG. 1 of the present disclosure, the legality of key business operations, key service output, and operating system privileged operations can be performed. Discriminate, specifically,
  • system call management module When a user service version in a virtual running environment sends a system call, the system call management module is specifically configured as:
  • Obtain information about the currently controlled system call including the system call number, system call parameters, etc.; use the currently accessed system call situation to match the existing monitoring system call information, and if the match is unsuccessful, allow the current system call to be executed. , continue to execute the original system call and the user business process; if the matching is successful, check whether the other virtual running environment is in the state of waiting for the system call to be judged, if the other virtual running environment is not in the system call waiting for the decision state, then set The current virtual running environment waits for the decision state, sets the timeout timer; until the timeout timer expires, checks whether other virtual running environments are in the system call waiting decision state; the virtual running environment that has not entered the system call waiting state for the timeout is considered to be Illegal virtual running environment and notify the virtual running environment management module;
  • the judgment includes but is not limited to the following methods: multiple choice judgment and consistency judgment.
  • the multiple decision includes: in all virtual operating environments, it is considered that most of the same system call cases are legal access, and system calls different from most system calls are illegal access.
  • the consistency decision includes: the current access is considered legal only if all the system calls in all the virtual running environments are identical, otherwise they are all illegal access.
  • consistency decisions can be used; for scenarios where security requirements are not very high and response time requirements are relatively high, multiple decisions can be used.
  • the virtual running environment management module is specifically configured as:
  • the virtual running environment is set to an abnormal state, and the virtual running environment of the abnormal state is cleaned. Further, it is further configured to: start the abnormal state virtual running environment and user service after the cleaning, and reset to a normal state.
  • the virtual runtime environment management module is further configured to:
  • the virtual running environment management module can deliver external events through virtual devices such as virtual network cards to which the virtualized operating environment belongs.
  • the received external events are transmitted to the upper user service modules according to the original process, and the user service modules are The business process handles external events.
  • the virtual running environment management module and the system call management module may be implemented by a processor in a device that implements mobile target defense.
  • the device for implementing the mobile target defense creates a plurality of heterogeneous virtual running environments, and the mirroring of the virtual running environment module and the mirroring of the user service module form a random and diverse isomer in a plurality of manners.
  • the heterogeneous external attack surface also presents random and diverse features.
  • the mirror of the virtual running environment module and the mirror of the user service module are randomly and dynamically loaded at runtime, making the external attack surface at runtime unpredictable.
  • the technical solution provided by the embodiment of the present disclosure utilizes the idea of moving target defense from multiple angles such as user service and virtual running environment, thereby realizing the dynamic change of the attackable surface and the attack path exposed by the device for implementing the mobile target defense. It is convenient for timely detection of security threats and improves the security level of the entire system.
  • multi-mode decision is performed through system calls of multiple virtual running environments, and various types of illegal privileged operations and illegal business operations can be identified and blocked according to the judgment result, and the handling of unknown security threats is realized.
  • the virtual running environment module or the user service module may be destroyed internally, but the external key operations cannot be destroyed. Therefore, the security of the entire device that implements the mobile target defense is not affected, and the problem that the security of the single execution body directly affects the security of the entire system is greatly reduced. Only when more than half of the virtual running environments have an identical illegal operation in an external behavior or privileged operation will affect the security of the entire device that implements the mobile target defense. However, since the virtual running environment module and the user service module in the embodiment of the present disclosure are different in structure, the causes of the vulnerability and the method of utilizing the same are different. Therefore, the probability that more than half of the completely identical illegal operations occur is extremely low.
  • FIG. 2 is a flowchart of a method for implementing mobile target defense according to the present disclosure. As shown in FIG. 2, the method includes:
  • Step 200 Establish a mirror image of a plurality of heterogeneous virtual running environments, and mirror images of a plurality of heterogeneous user services.
  • the user service includes at least two user service modules that are responsible for the actual user service functions.
  • the virtual running environment includes at least two virtual running environment modules that are responsible for providing a virtual running environment to the upper user service modules.
  • Each user business module runs on top of a virtual runtime environment module.
  • Each service module has the same function but different internal structures.
  • the specific implementation methods include but are not limited to: different compiler optimization options, different compiler versions, and the like.
  • Different user service modules are built by using different versions of compilers, such as gcc3.1.4 or gcc4.1.2 and other compiler versions, as well as different compilation options, such as O1, O2, O3, etc. Generates a mirror image of several heterogeneous (same functions but different internal structures) user service modules.
  • compilers such as gcc3.1.4 or gcc4.1.2 and other compiler versions, as well as different compilation options, such as O1, O2, O3, etc.
  • the virtual running environment module is responsible for providing a virtual running environment for the upper layer user service module, and achieving the purpose of running the virtual running environment from the perspective of the user service is equivalent to exclusively using the actual operating system.
  • the virtual machine runtime environment module exists in the form of lightweight virtualized infrastructure components such as LXC containers and related libraries, Docker, and the like. Each virtual runtime environment module has the same function but different structure.
  • the specific implementation manners include, but are not limited to, different configuration options of the infrastructure components, different source code versions of the infrastructure components, and different compilation options of the infrastructure components.
  • Different virtual running environment modules are created by obtaining several infrastructure component versions with the same function but different source versions, and different infrastructure component versions (such as V1.0, V1.2, etc. with the same function and different source code).
  • Use different compilers such as different compiler versions such as gcc3.1.4 or gcc4.1.2 and different compilation options (such as O1, O2, O3, etc.) to generate several heterogeneous (same functions but different internal structures) )
  • Step 201 Set monitoring system call information for identifying system calls that need to be monitored, and the number of targets of the virtual running environment that needs to be created.
  • the monitoring system call information is set according to the security requirements of the user service, and the system calls that need to be monitored in the configuration information of the monitoring system call information include, but are not limited to, key operating system calls of the user service.
  • the monitoring system call information includes but is not limited to: a key operating system call of the user service, a key output system call of the user service, a device privileged system call managed by the operating system, and the like, and a security-sensitive system call.
  • the number of targets of the virtual running environment in this step may be a generated random number.
  • Step 202 Create a target virtual operating environment according to the image of the created virtual running environment and the image of the user service, and monitor the system call in the created virtual running environment according to the monitoring system call information to determine that there may be a security problem.
  • the virtual running environment is created by the user service.
  • the virtual running environment for creating targets in this step includes:
  • the virtual running environment module and the user service module are initialized to form an unpredictable attack surface, including:
  • Each user service module based on the virtual running environment can be executed independently, that is, there is no business coupling relationship between user service modules in different virtual running environments, and each user service can be executed independently of each other;
  • the user service function involves key operations, critical output, and operating system privileged operations, it needs to perform unified external operations through the system call of the operating system.
  • the system call is the interface for the key operations of the user service, such as operating system privileged operations and user services. External input and output operations, etc.
  • system call execution and decision method for the redundant virtual running environment in the device for implementing the mobile target defense shown in FIG. 1 of the present disclosure can perform key business operations, key service output, and operating system privileged operations.
  • Conduct legality discrimination including:
  • the system call in the created virtual running environment is monitored according to the monitoring system call information in step 202 to determine a virtual running environment in which a security problem may exist.
  • the judgment includes but is not limited to the following methods: multiple choice judgment and consistency judgment.
  • the multiple decision includes: in all virtual operating environments, it is considered that most of the same system call cases are legal access, and system calls different from most system calls are illegal access.
  • the consistency decision includes: the current access is considered legal only if all the system calls in all the virtual running environments are identical, otherwise they are all illegal access.
  • consistency decisions can be used; for scenarios where security requirements are not very high and response time requirements are relatively high, multiple decisions can be used.
  • the virtual running environment is set to an abnormal state, and the virtual running environment of the abnormal state is cleaned. Further, the method further includes: starting the abnormal state virtual running environment and the user service after the cleaning, and resetting to the normal state.
  • the method of the embodiment of the present disclosure further includes:
  • the virtual running environment management module can deliver external events through virtual devices such as virtual network cards to which the virtualized operating environment belongs.
  • the received external events are transmitted to the upper user service modules according to the original process, and the user service modules are The business process handles external events.
  • the method for implementing the mobile target defense provided by the present disclosure creates a plurality of heterogeneous virtual running environments, and the mirroring of the virtual running environment module and the mirroring of the user service module form a random and diverse isomer in a plurality of ways, and the heterogeneous The external attack surface also presents random and diverse features.
  • the runtime randomly and dynamically loads the image of the virtual running environment module and the image of the user service module, making the external attack surface of the runtime unpredictable. That is to say, the technical solution provided by the present disclosure utilizes the idea of moving target defense from multiple angles such as user service and virtual running environment, and realizes the dynamic change of the attackable surface and the attack path exposed by the device for realizing the moving target defense. Timely discovery of security threats increases the security level of the entire system.
  • multi-mode decision is performed through system calls of multiple virtual running environments, and various types of illegal privileged operations and illegal business operations can be identified and blocked according to the judgment result, and the handling of unknown security threats is realized.
  • the virtual running environment module or the user service module may be destroyed internally, but the external key operations cannot be destroyed. Therefore, the security of the entire device that implements the mobile target defense is not affected, and the problem that the security of the single execution body directly affects the security of the entire system is greatly reduced. Only when more than half of the virtual running environments have an identical illegal operation in an external behavior or privileged operation will affect the security of the entire device that implements the mobile target defense. However, since the virtual running environment module and the user service module in the embodiment of the present disclosure are different in structure, the causes of the vulnerability and the method of utilizing the same are different. Therefore, the probability that more than half of the completely identical illegal operations occur is extremely low.
  • FIG. 3 is a schematic flowchart of a method for creating a plurality of heterogeneous virtual running environments in a method for implementing a mobile target defense, and as shown in FIG. 3, specifically:
  • Step 300 Configure different extended function options for the infrastructure components of the virtual running environment of different source code versions, use different compiler versions and different compile optimization options to generate mirrors of several virtual running environment modules with the same basic functions but different structures. .
  • the virtual runtime environment module obtain the same version of the infrastructure component with the same function but different source versions, for different infrastructure component versions (such as V1.0, V1.2 and other functions with the same function and different source code).
  • different compilers such as different compiler versions such as gcc3.1.4 or gcc4.1.2
  • different compilation options such as O1, O2, O3, etc.
  • Step 301 Generate, for the user service module, a plurality of mirrors of user service modules with the same function but different structures, using different compiler versions and different compile optimization options.
  • the system call management module is initialized, and specifically includes step 302: reading and setting the monitoring system call information from the configuration information preset (such as pre-filled by the business personnel).
  • the monitoring system call information may exist in the form of a monitoring system call table for identifying system calls that need to be monitored.
  • the contents of the monitoring system call table include, but are not limited to, key operating system calls of the user service, key output system calls of the user service, and device-privileged system calls managed by the operating system, such as security-sensitive system calls.
  • Step 303 Generate a random number to identify the target number of the virtual running environment to be created;
  • the virtual runtime environment module and the user business module are initialized to create several virtual running environments, thereby forming an unpredictable attack surface. Specifically include:
  • Step 304 Determine whether the number of created virtual running environments is less than the target number. If not, proceed to step 305; if not, proceed to step 308.
  • Step 305 Dynamically randomly select an image from the mirrors of the plurality of heterogeneous virtual running environment modules as a mirror of the virtual running environment module to be run.
  • Step 306 Dynamically randomly select an image from the mirror of the plurality of heterogeneous user service modules as a mirror of the user service module to be run; and create a virtual running environment according to the selected image.
  • Step 307 The virtual running environment management module creates a virtual running environment by using the selected image of the virtual running environment module and the image of the user service module. Then return to step 304.
  • Step 308 The virtual running environment management module loads and runs a plurality of target virtual running environments, and sequentially sets the created virtual running environment state to a normal available state.
  • a plurality of heterogeneous virtual running environments are created by using the embodiments of the present disclosure to form random and diverse isomers for the mirroring of the virtual running environment module and the mirroring of the user service module, and the heterogeneous external attack surface is also random and diverse.
  • the runtime randomly and dynamically loads the image of the virtual running environment module and the image of the user service module, making the external attack surface of the runtime unpredictable. It realizes the dynamic change of the attackable surface and attack path exposed by the system, which facilitates timely detection of security threats and improves the security level of the entire system.
  • FIG. 4 is a schematic flowchart of an embodiment of performing and determining a system call in a method for implementing a mobile target defense according to the disclosure. As shown in FIG. 4, the method specifically includes:
  • Step 400 When a user service version of a virtual running system sends a system call, the system call management module acquires related information of the current system call, including a system call number, a system call parameter, and the like.
  • Step 401 The system call management module matches the currently accessed system call with the system call in the existing monitoring system call table. If the matching is unsuccessful, the current system call is allowed to execute, and the process returns to step 400 to continue executing the original system call. And the user business process; if the matching is successful, proceed to step 402.
  • Step 402 The operating system checks whether the other virtual running environments are in the state of waiting for the system to wait for the judgment. If the other virtual running environments are not in the state of waiting for the system to wait for the decision, the process proceeds to step 403; if other virtual operating environments have entered the system If the status of the waiting decision is called, the process proceeds to step 405.
  • Step 403 Set the current virtual running environment to wait for the decision state, set the timeout timer, and block the current virtual running environment, and proceed to step 404.
  • Step 404 After the timeout timer expires, check whether other virtual running environments are in a state in which the system call waits for a decision. For the virtual running environment that has entered the system call waiting state, step 405 is performed; if the virtual running environment that has not entered the system call waiting state for the timeout is regarded as an illegal virtual running environment, the cleaning process of step 407 is performed.
  • Step 405 to step 406 Determine the current system call situation in all the virtual running environments, and obtain the legality of the virtual running environment according to the judgment result. If the judgment result is a legal virtual running environment, go to step 411; if the judgment result is illegal The virtual running environment proceeds to step 407.
  • the judgment includes but is not limited to the following methods: multiple decision and consistency decision.
  • the multiple decision includes: in all virtual operating environments, it is considered that most of the same system call cases are legal access, and system calls different from most system calls are illegal access.
  • the consistency decision includes: the current access is considered legal only if all the system calls in all the virtual running environments are identical, otherwise they are all illegal access.
  • consistency decisions can be used; for scenarios where security requirements are not very high and response time requirements are relatively high, multiple decisions can be used.
  • Step 407 The virtual running environment management module sets the virtual running environment to an abnormal state for the virtual running environment that is determined to be illegal, and cleans the virtual running environment of the abnormal state, and stops and destroys the abnormal virtual running environment.
  • Step 408 Re-randomly select a mirror image of the heterogeneous virtual running environment module and a mirror image of the user service module from the plurality of virtual running environment modules and the plurality of user service modules.
  • Step 409 Combine the randomly selected images to create and run a new virtual running environment.
  • Step 410 Initialize a new virtual running environment, and set the virtual running environment to a normal state. End this process.
  • Step 411 The virtual running environment management module marks the virtual running environment that is determined to be legal as a normal state, and processes according to the original process of the system call: executing the system call, returning the execution result, returning to the user state, and continuing to execute the original business process. User business process.
  • multi-mode decision is performed by a system call of multiple virtual running environments, and various types of illegal privileged operations and illegal business operations can be identified and blocked according to the judgment result, and the handling of unknown security threats is realized.
  • FIG. 5 is a schematic flowchart of an embodiment of the method for implementing an external event in a method for implementing a mobile target defense. As shown in FIG. 5, the method specifically includes:
  • step 500 After the external event occurs, it is first transferred to the virtual running environment management module through the host operating system.
  • the virtual running environment management module traverses the virtual running environment in a normal state, and sequentially injects the received external events. Specifically include:
  • Step 501 The virtual running environment management module selects a virtualized running environment that is not injected with an external event.
  • Step 502 The virtual running environment management module delivers an external event through a virtual device to which the virtual running environment belongs, such as a virtual network card.
  • Step 503 After receiving the external event, the virtual running environment module transmits the user service module to the upper layer according to the original process, and the user service module processes the external event according to the existing business process.
  • Step 504 Determine whether all virtual operating environments have forwarded external events, and if so, end the process; if not, return to step 501.
  • FIG. 6 is a schematic diagram of an embodiment of outputting an erroneous result after a user service is attacked in a method for implementing mobile target defense according to the present disclosure. It is assumed that in the embodiment, the heterogeneous redundant system of five virtual running environments as shown in FIG. 6 is created according to the method for creating the heterogeneous virtual running environment shown in FIG. 3, and the initialization process of the corresponding module is completed.
  • the method includes:
  • the virtual running environment management module of the host operating system first receives the externally sent network packet, and the virtual running environment management module forwards the externally sent network packet to the five virtual running environments through the virtual network card device of each virtual running environment.
  • the five virtual running environments and the user service modules sequentially perceive the network packets to be received by the virtual network card through the system call, and the virtual running environment sequentially executes the system call for receiving the network packets;
  • the system call management module collects the current system call status and matches the monitoring system call table. Because the received message does not belong to the monitoring system call, the system call management module allows five virtual operating environments to read the network packet data.
  • FIG. 6 in this embodiment, it is assumed that when five virtual running environments and user service modules read and process network data packets, there is one user service module or virtual running environment module, as shown in FIG.
  • the operating environment 3 has a vulnerability and was successfully attacked by this data packet (as shown by the hexagonal star symbol in Figure 6), and it is assumed that the execution result of the user service control command is also falsified; and because of other user service modules Or the virtual running environment module is different from the module being attacked. Therefore, there is no similar vulnerability or vulnerability, but the usage is different, and the performance is different under the attack of the current data packet, and the control command of the user service is not falsified. Results of the.
  • the execution result is submitted to the system call control module, as shown in FIG. 6, and the dotted line indicates that the virtual running environment 3 submits the execution result.
  • the system call control module performs a majority decision on the execution results of the five virtual operating environments: since the output results of the four virtual operating environments are consistent, only one virtual operating environment, that is, the output of the virtual operating environment 3 The results are inconsistent. Therefore, it is determined that the virtual running environment 3 is an illegal virtual running environment, and the other virtual running environments are legal virtual running environments;
  • the system call is executed according to the legal output result, and the correct result is uniformly outputted.
  • the cleaning process is executed, and the virtual running environment module and the user service module are re-selected and loaded.
  • FIG. 7 is a schematic diagram of an embodiment of performing a privileged privilege operation after a user service is attacked in the method for implementing a mobile target defense according to the present disclosure. It is assumed that the heterogeneous virtual operating environment is created according to the method in FIG. As shown in Figure 7, the heterogeneous redundant systems of the five virtual operating environments complete the initialization process of the corresponding modules. As shown in Figure 7, it includes:
  • a user service module or a virtual running environment module such as the virtual operating environment 4 in this embodiment, has a security vulnerability (as shown by the hexagonal star symbol in FIG. 7), and is injected into the attack under legitimate input conditions.
  • the code for example, the user network service shown in FIG. 6 is outputted, and the process of receiving the network message of the error result embodiment is performed. If the injection code is triggered to perform the illegal privilege operation when a user service execution flow is preset, then, as shown in FIG. 7 It is shown that when the five virtual running environments execute to trigger the attack code, the virtual running environment 4 injected with the attack code will attempt to perform an illegal privileged operation, and the other virtual running environments perform normal system calls according to the original business process. process.
  • system call control module makes a majority decision on the execution results of the five virtual operating environments.
  • the system call requests of the four virtual running environments are consistent, only one virtual running environment, that is, the system call request of the virtual running environment 4 is inconsistent. Therefore, it is determined that the virtual running environment 4 is an illegal virtual running environment, and the other virtual running environments are legal virtual running environments;
  • the legal system call request is allowed to be processed normally according to the original business process; for the illegal system call request, the virtual running environment 4 performs the cleaning process, and the virtual running environment module and the user service module are re-selected and loaded.
  • FIG. 8 is a schematic diagram of an embodiment of an abnormal situation in which a user service is attacked in a method for implementing a mobile target defense according to the present disclosure. It is assumed that, in this embodiment, a method for creating a heterogeneous virtual running environment as shown in FIG. 3 is created.
  • the heterogeneous redundant system of the five virtual operating environments shown in Figure 8 completes the initialization process of the corresponding module.
  • the system waits for the decision phase and sets the timeout timer; however, the virtual running environment 5 in the abnormal state is always in a suspended or infinite loop state;
  • the virtual operating environment that has entered the system call waiting decision phase is processed: since all virtual operating environments output a consistent structure at this time, the decision is legal; and the timeout fails to pass the system call.
  • the virtual running environment 5 of the feedback output is marked as illegal to find your operating environment;
  • a legal virtual running environment For a legal virtual running environment, it is allowed to execute system calls and output the results, and is processed normally according to the original business process; for the illegal virtual running environment 5, the cleaning process is executed, and the virtual running environment module and the user service module are re-selected and loaded. .
  • FIG. 9 is a schematic diagram of an embodiment in which multiple user services are simultaneously attacked in the method for implementing mobile target defense. It is assumed that the present embodiment has been created according to the method for creating a heterogeneous virtual running environment shown in FIG. 3 .
  • the heterogeneous redundant system of the five virtual operating environments shown in Figure 9 completes the initialization process of the corresponding module.
  • external events are sequentially transferred to the five virtual operating environments as shown in FIG. 9 when external network data occurs.
  • Figure 9
  • the structure is different.
  • the same attack packets can only produce the same attack effect for a specific structure. Therefore, different structural vulnerabilities produce different attack results under the same attack mode, such as the octagonal flag and hexagonal star in Figure 9. The type signs are shown separately. In the case where the other three virtual running environments do not have this vulnerability, the normal processing result is fed back.
  • the five virtual running environments all feedback the results through the system call.
  • the system call management module determines the results of the five heterogeneous virtual operating environments, because the output of the three virtual operating environments is consistent, and 2 A virtual runtime environment outputs different results. Therefore, the three virtual running environments that determine the result of the feedback consistency are the legal running environment, and the two virtual running environments that feed back the different results are the virtual virtual running environment, that is, the virtual running environment 1 and the virtual running environment 5.
  • a legal virtual running environment For a legal virtual running environment, it is allowed to execute system calls and output the results, and is processed normally according to the original business process; for the illegal virtual running environment 1 and the illegal virtual running environment 5, the cleaning process is executed, and the virtual process is reselected and loaded. Run environment module and user business module.
  • the technical solution provided by the embodiment of the present disclosure timely discovers an unknown security threat by making a decision on a key system call. Moreover, when a single or a few virtual operating environments have security problems, the security of the entire system is not affected, and the virtual operating environment in which security problems occur is cleaned in time, ensuring the continuous security and robustness of the system.
  • the embodiment of the present disclosure further provides a computer readable storage medium storing computer executable instructions for performing the steps of any of the foregoing methods for implementing mobile target defense in the embodiments of the present disclosure.
  • the solution provided by the embodiment of the present disclosure establishes a mirror image of a plurality of heterogeneous virtual running environments, and mirrors of a plurality of heterogeneous user services; sets monitoring system call information for identifying system calls to be monitored, and needs to be created.
  • the number of targets in the virtual running environment; the target virtual running environment is created according to the mirror of the created virtual running environment and the image of the user service, and the system calls in the created virtual running environment are monitored according to the monitoring system call information, Identify virtual runtime environments where security issues may exist.
  • the mirroring of the virtual running environment module and the mirroring of the user service module use a variety of methods to form random and diverse isomers, and the heterogeneous external attack surface also presents random and diverse features.
  • the runtime randomly and dynamically loads the image of the virtual running environment module and the image of the user service module, making the external attack surface of the runtime unpredictable. That is to say, the technical solution provided by the embodiment of the present disclosure utilizes the idea of moving target defense from multiple angles such as user service and virtual running environment, thereby realizing the dynamic change of the attackable surface and the attack path exposed by the device for implementing the mobile target defense. It is convenient for timely detection of security threats and improves the security level of the entire system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种实现移动目标防御的方法、装置及存储介质。其中，方法包括：建立若干个异构的虚拟运行环境的镜像，以及若干个异构的用户业务的镜像；设置用于标识需要监控的系统调用的监控系统调用信息，以及需要创建的虚拟运行环境的目标个数；根据建立的虚拟运行环境的镜像和用户业务的镜像创建目标个数个虚拟运行环境，并按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境。

Description

一种实现移动目标防御的方法、装置及存储介质
相关申请的交叉引用
本申请基于申请号为201710166174.9、申请日为2017年03月20日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本公开涉及信息安全技术，尤指一种实现移动目标防御的方法、装置及存储介质。
背景技术
目前，信息安全领域主要的防护方法都是建立在已知病毒、已知漏洞、已知攻击方式之上，这种基于先验知识的防御手段投入成本较高且无法防御未知的安全隐患。以病毒扫描为例，需要针对已知的病毒知识建立病毒样本库，在利用样本库中的特征与系统当前操作状态进行匹配检查，这种方式发现病毒的效率低，且无法防御未知的安全风险。定期更新补丁也需要软件发布商对系统中代码进行充分的保护，发现漏洞需要及时通知用户更新漏洞；而近年来零日漏洞逐年上升，软件开发商的防守修复速度已滞后于漏洞发现的速度。
2010年5月美国总统网络空间政策规划回顾会(President’s Cyber Policy Review)宣布了一个“改变游戏规则”的网络安全防御思路：移动目标防御(MTD，Moving Target Defense)。攻击者在庞大的软件系统中仅仅需要找到一个漏洞，就能够通过很少几行代码完全“攻陷”；而防御者需要对百万行、千万行的代码进行充分的保护，才能防止漏洞被利用。移动目标防御倡导随时间变化，不断地转换不同的机制和策略，使系统体现出随机性、多样性和动态性的特征。通过不断变化的攻击表面，显著地增加了攻 击的难度，同时也降低了漏洞被利用的可能性。
操作系统是整个系统的底层支撑基础，并掌管了系统所有的特权操作。因此，操作系统的安全改进方案一直是业界的热点。目前已有一些应用于操作系统的移动目标防御方法，通过动态改变操作系统，从而动态变化其对外暴露的可攻击表面。
相关技术中，针对云计算中安全威胁在多个虚拟机之间传播的问题，提出一种基于嵌套虚拟化的移动目标技术方案。第一级虚拟机包括HyperShell、第二级目标虚拟机以及多个提供扩展服务的嵌套虚拟机。通过HyperShell动态的将第二级虚拟机和各种扩展服务的嵌套虚拟机，动态地在不同的物理机上迁移以及动态的在不同的虚拟嵌套层级上迁移。该方法利用虚拟化的技术动态改变客户机操作系统，并将扩展服务在多个客户机操作系统之间进行动态迁移，变化系统对外暴露的可攻击表面，这样，加大了攻击者在系统探测、漏洞挖掘的技术难度。但当攻击者掌握存在的某个漏洞，在某个时刻是可以攻击成功的。不断变化的攻击表面无法充分保障系统的安全性，在持续威胁情况下仍然可能攻击成功。
相关技术提出了一种基于多操作系统运转的移动目标防御方法。外部用户通过网络，访问采用该方法对应的装置，该装置由一个管理设备和多个运行不同操作系统主机系统组成，通过管理设备同步状态在多个主机系统轮流对外提供服务。该方法通过多个物理主机系统部署不同的操作系统，从而实现动态改变操作系统对外暴露的可攻击表面，使得攻击者无法预测当前服务的操作系统情况。这种实现方式需要设置多个主机系统，成本较高；而且，也存在当某个时刻攻击者命中当前操作系统或上层服务的漏洞时，系统被成功攻击的问题。
通过上述分析可以看出，相关技术中实现移动目标防御的方案，均是通过操作系统的外部技术方案(如虚拟化创建多个虚拟操作系统，或者多个物理环境运行多个实际操作系统等)来动态变化操作系统以及上层业务服务，从而动态变化系统对外暴露的可攻击表面，进而使得攻击可达路径和攻击时间窗都处于动态变化的状态，最终实现防御未知安全威胁的目的，提高系统的安全性。
但是，相关技术存在两个问题：第一，不能及时发现已发生或正在发生的安全威胁；第二、不能对命中的威胁进行防御，如当某个特定的时刻下攻击者命中被攻击对象的安全漏洞时，系统的安全性会被完全破坏。
发明内容
本公开实施例提供一种实现移动目标防御的方法、装置及存储介质。
本公开实施例提供了一种实现移动目标防御的装置，包括：设置在主机操作系统内的虚拟运行环境管理模块、系统调用管理模块，以及虚拟运行环境模块、用户业务模块；其中，
虚拟运行环境模块，包括至少两个异构的虚拟运行环境模块的镜像，配置为负责对上层的用户业务模块提供虚拟的运行环境；
用户业务模块，包括至少两个异构的用户业务模块的镜像，配置为负责实际的用户业务功能；
虚拟运行环境管理模块，配置为按照生成的虚拟运行环境的目标个数，根据建立的虚拟运行环境模块的镜像和用户业务模块的镜像创建目标个数个虚拟运行环境；按照来自系统调用管理模块的通知，管理可能存在安全问题的虚拟运行环境；
系统调用管理模块，其中设置有用于标识需要监控的系统调用的监控系统调用信息，配置为按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行管理，以确定可能存在安全问题的虚拟运行环境并通知虚拟运行环境管理模块；
其中，异构为功能相同但内部结构不同。
上述方案中，所述虚拟运行环境模块的镜像为轻量级虚拟化的基础设施组件。
上述方案中，所述异构的虚拟运行环境模块的镜像包括：基础设施组件的配置选项不同、基础设施组件的源代码版本不同、基础设施组件的编译选项不同。
上述方案中，所述异构的业务模块的镜像包括：编译优化选项不同、 编译器版本不同。
上述方案中，所述虚拟运行环境管理模块中的创建目标个数个虚拟运行环境包括：
初始化所述虚拟运行环境模块以及所述用户业务模块，以形成不可预测的攻击面；
加载和运行建立的若干个所述虚拟运行环境，依次设置创建的虚拟运行环境的状态为正常可用状态。
上述方案中，所述虚拟运行环境管理模块中的初始化所述虚拟运行环境模块以及所述用户业务模块包括：
从所述至少两个异构的虚拟运行环境模块的镜像中，随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像；从所述至少两个以上异构的用户业务模块的镜像中，随机选择一个镜像作为即将运行的用户业务模块的镜像；根据选择出的镜像创建一个虚拟运行环境，直到创建的虚拟运行环境的个数达到所述目标个数个。
上述方案中，所述系统调用管理模块中的对创建的虚拟运行环境中的系统调用进行管理包括：
基于所述监控系统调用信息识别虚拟运行环境运行中发生的受控的系统调用；收集受控的系统调用的信息；
基于所有虚拟运行环境的受控的系统调用的信息进行判决，将可能存在安全问题的虚拟运行环境通知给所述虚拟运行环境管理模块。
上述方案中，所述监控系统调用信息包括：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用。
上述方案中，所述系统调用管理模块配置为：
当相应虚拟运行环境中的用户业务版本发送系统调用时，获取当前受控的系统调用的相关信息；使用当前访问的系统调用情况与已有的监控系统调用信息中进行匹配，如果匹配不成功，则允许执行当前系统调用，继续执行原有的系统调用以及用户业务流程；如果匹配成功，则，
检查除所述相应虚拟运行环境外的其他虚拟运行环境是否已处于系统 调用等待判决的状态，
如果其他虚拟运行环境并未处于系统调用等待判决状态，则设置当前虚拟运行环境为等待判决状态，设置超时定时器；直到超时定时器到期，检查其他虚拟运行环境是否处于系统调用等待判决状态；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境并通知所述虚拟运行环境管理模块；
如果其他虚拟运行环境均已进入系统调用等待判决状态，对所有虚拟运行环境下的当前系统调用情况进行判决，并将判决结果通知给所述虚拟运行环境管理模块；
相应地，所述虚拟运行环境管理模块配置为：
对判决为合法的虚拟运行环境标记为正常状态，按照系统调用的原有流程进行处理；将判决为非法的虚拟运行环境设置为异常状态，对异常状态的虚拟运行环境的进行清洗。
上述方案中，所述虚拟运行环境管理模块还配置为：启动清洗后的异常状态虚拟运行环境和用户业务并重新设置为正常状态。
上述方案中，所述判决包括：择多判决；所述择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问；或者，
所述判决包括：一致性判决；所述一致性判决包括：当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。
上述方案中，所述虚拟运行环境管理模块还配置为：
当发生外部事件时，接收通过主机操作系统传递的外部事件；遍历处于正常状态的虚拟运行环境并依次转发接收到的外部事件。
本公开实施例还提供了一种实现移动目标防御的方法，包括：
建立至少两个异构的虚拟运行环境的镜像，以及至少两个异构的用户业务的镜像；
设置用于标识需要监控的系统调用的监控系统调用信息，以及需要创 建的虚拟运行环境的目标个数；
根据建立的虚拟运行环境的镜像和用户业务的镜像创建目标个数个虚拟运行环境，并按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境；
其中，异构为功能相同但内部结构不同。
上述方案中，所述虚拟运行环境模块的镜像为轻量级虚拟化的基础设施组件；
所述建立至少两个以上异构的虚拟运行环境的镜像包括：
通过获取功能相同但源码版本不同的基础设施组件版本，对不同的基础设施组件版本使用不同的编译器以及不同的编译选项，生成所述至少两个异构的虚拟运行环境模块的镜像。
上述方案中，所述建立至少两个异构的用户业务的镜像包括：
通过使用不同版本的编译器，以及不同的编译选项，生成所述至少两个异构的用户业务模块的镜像。
上述方案中，根据预先设置的配置信息设置所述监控系统调用信息；
所述监控系统调用信息包括：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用。
上述方案中，所述创建目标个数个虚拟运行环境包括：
初始化所述虚拟运行环境模块以及所述用户业务模块，以形成不可预测的攻击面；
加载和运行建立的若干个所述虚拟运行环境，依次设置创建的虚拟运行环境的状态为正常可用状态。
上述方案中，所述初始化所述虚拟运行环境模块以及所述用户业务模块包括：
从所述至少两个异构的虚拟运行环境模块的镜像中，随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像；从所述至少两个异构的用户业务模块的镜像中，随机选择一个镜像作为即将运行的用户业务模块的镜 像；根据选择出的镜像创建一个虚拟运行环境，直到创建的虚拟运行环境的个数达到所述目标个数个。
上述方案中，当相应所述虚拟运行环境中的用户业务版本发送系统调用时，所述按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境包括：
获取当前受控的系统调用的相关信息；使用当前访问的系统调用情况与已有的监控系统调用信息中进行匹配，如果匹配不成功，则允许执行当前系统调用，继续执行原有的系统调用以及用户业务流程；如果匹配成功，则，
检查除所述相应虚拟运行环境外的其他虚拟运行环境是否已处于系统调用等待判决的状态，
如果其他虚拟运行环境并未处于系统调用等待判决状态，则设置当前虚拟运行环境为等待判决状态，设置超时定时器；直到超时定时器到期，检查其他虚拟运行环境是否处于系统调用等待判决状态；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境；
如果其他虚拟运行环境均已进入系统调用等待判决状态，对所有虚拟运行环境下的当前系统调用情况进行判决，对判决为合法的虚拟运行环境标记为正常状态，按照系统调用的原有流程进行处理；将判决为非法的虚拟运行环境设置为异常状态，对异常状态的虚拟运行环境的进行清洗。
上述方案中，所述方法还包括：启动所述清洗后的异常状态虚拟运行环境和用户业务并重新设置为正常状态。
上述方案中，所述判决包括：择多判决；
所述择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问；或者，
所述判决包括：一致性判决；所述一致性判决包括：当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。
上述方案中，所述方法还包括：
当发生外部事件时，接收通过主机操作系统传递的外部事件；遍历处于正常状态的虚拟运行环境并依次转发接收到的外部事件。
本公开实施例还提供了一种存储介质，其上存储有计算机可执行指令，所述计算机可执行指令用于上述任一方法的步骤。
本公开实施例的技术方案包括：建立若干个异构的虚拟运行环境的镜像，以及若干个异构的用户业务的镜像；设置用于标识需要监控的系统调用的监控系统调用信息，以及需要创建的虚拟运行环境的目标个数；根据建立的虚拟运行环境的镜像和用户业务的镜像创建目标个数个虚拟运行环境，并按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境。本公开实施例提供的实现移动目标防御的装置，一方面，通过创建若干异构虚拟运行环境，虚拟运行环境模块的镜像和用户业务模块的镜像使用多种方式形成随机、多样的异构体，异构体对外攻击面也呈现随机、多样的特征；另一方面，运行时随机、动态加载虚拟运行环境模块的镜像和用户业务模块的镜像，使得运行时的对外攻击面不可预测。也就是说，本公开实施例提供的技术方案，从用户业务和虚拟运行环境等多个角度运用移动目标防御的思想，实现了动态改变实现移动目标防御的装置对外暴露的可攻击表面以及攻击路径，便于及时发现安全威胁，提高了整个系统的安全级别。
进一步地，本公开实施例提供的技术方案通过多个虚拟运行环境的系统调用进行多模判决，根据判决结果可及时识别和阻止各种类型的非法特权操作和非法业务操作，实现了对未知的安全威胁的应对处理。
进一步地，当若干个虚拟运行环境中的某个虚拟运行环境中的用户业务被劫持攻击后，可能对虚拟运行环境模块或用户业务模块内部进行破坏，但是，无法对外部的关键操作进行破坏，因此，不会影响整个实现移动目标防御的装置的安全性，大大降低了单个执行体的安全性直接影响整个系统的安全性的问题。仅当半数以上的虚拟运行环境在一个对外行为或特权操作上，出现完全一致的非法操作，才会影响整个实现移动目标防御的装置的安全性。然而，由于本公开实施例中的虚拟运行环境模块和用户业务 模块都是结构相异的，漏洞的成因以及利用的方法也是相异的，因此，出现半数以上完全一致的非法操作的概率是极低的。
本公开的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本公开而了解。本公开的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
此处所说明的附图用来提供对本公开的进一步理解，构成本申请的一部分，本公开的示意性实施例及其说明用于解释本公开。在附图中：
图1为本公开实施例实现移动目标防御的装置的组成结构示意图；
图2为本公开实施例实现移动目标防御的方法的流程图；
图3为本公开实现移动目标防御的方法中创建若干虚拟运行环境的实施例的流程示意图；
图4为本公开实现移动目标防御的方法中系统调用的执行和判决的实施例的流程示意图；
图5为本公开实现移动目标防御的方法中传递外部事件的实施例的流程示意图；
图6为本公开实现移动目标防御的方法中用户业务被攻击后输出错误结果的实施例的示意图；
图7为本公开实现移动目标防御的方法中用户业务被攻击后执行非法特权操作的实施例的示意图；
图8为本公开实现移动目标防御的方法中用户业务被攻击后出现异常状况的实施例的示意图；
图9为本公开实现移动目标防御的方法中多个用户业务同时被攻击的实施例的示意图。
具体实施方式
为使本公开的目的、技术方案和优点更加清楚明白，下文中将结合附图对本公开的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1为本公开实现移动目标防御的装置的组成结构示意图，如图1所示，至少包括：设置在主机操作系统内的虚拟运行环境管理模块、系统调用管理模块，以及虚拟运行环境模块、用户业务模块。
图1中，虚拟运行环境模块，包括若干个异构(功能相同但内部结构不同)的虚拟运行环境模块的镜像，配置为负责对上层的用户业务模块提供虚拟的运行环境，实现从用户业务视角来看运行在虚拟运行环境等同于独占使用实际操作系统的目的。
在一实施例中，虚拟运行环境模块以轻量级虚拟化的基础设施组件如LXC容器及相关库、Docker等的形式存在。各个虚拟运行环境模块的功能相同但结构不同，具体实现方式包括但不限于：基础设施组件的配置选项不同、基础设施组件的源代码版本不同、基础设施组件的编译选项不同等。
不同的虚拟运行环境模块的建立，通过获取功能相同但源码版本不同的若干基础设施组件版本，对不同的基础设施组件版本(比如V1.0、V1.2等功能相同、源代码不同的版本)，使用不同的编译器(比如gcc3.1.4或gcc4.1.2等不同编译器版本)以及不同的编译选项(比如O1、O2、O3等编译优化选项)生产若干个异构(功能相同但内部结构不同)的虚拟运行环境模块的镜像。
图1中，用户业务模块，包括若干个异构(功能相同但内部结构不同)的用户业务模块的镜像，配置为负责实际的用户业务功能。
在一实施例中，每一个用户业务模块运行在一个虚拟运行环境模块之上。各个用户业务模块的功能相同但内部结构不同，具体实现方式包括但不限于：编译优化选项不同、编译器版本不同等。
不同的用户业务模块的建立，通过使用不同版本的编译器，比如：gcc3.1.4或gcc4.1.2等不同编译器版本，以及不同的编译选项，比如：O1、 O2、O3等编译优化选项，以生成若干个异构(功能相同但内部结构不同)的用户业务模块的镜像。
图1中，虚拟运行环境管理模块，配置为按照生成的虚拟运行环境的目标个数，根据建立的虚拟运行环境模块的镜像和用户业务模块的镜像创建目标个数个虚拟运行环境；按照来自系统调用管理模块的通知，管理可能存在安全问题的虚拟运行环境。
在一实施例中，对若干个虚拟运行环境进行管理包括但不限于：创建、清洗以及运行状态的管理。
在一实施例中，虚拟运行环境管理模块中创建目标个数个虚拟运行环境包括：
首先，初始化虚拟运行环境模块以及用户业务模块，以形成不可预测的攻击面，具体包括：从若干个异构的虚拟运行环境模块的镜像中，动态地随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像；从若干个异构的用户业务模块的镜像中，动态地随机选择一个镜像作为即将运行的用户业务模块的镜像；根据选择出的上述镜像创建一个虚拟运行环境；利用上述方法创建虚拟运行环境，直到创建的虚拟运行环境的个数达到目标个数个。然后，加载和运行建立的若干个虚拟运行环境，依次设置创建的虚拟运行环境的状态为正常可用状态。
图1中，系统调用管理模块，其中设置有用于标识需要监控的系统调用的监控系统调用信息，配置为按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行管理，以确定可能存在安全问题的虚拟运行环境并通知虚拟运行环境管理模块。
在一实施例中，监控系统调用信息包括但不限于：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用等安全敏感的系统调用。
其中，对创建的虚拟运行环境中的系统调用进行管理具体包括：
基于监控系统调用信息识别虚拟运行环境运行中发生的受控的系统调用；收集受控的系统调用的信息，包括系统调用号、系统调用参数等信息； 基于所有虚拟运行环境的受控的系统调用的信息进行判决，将可能存在安全问题的虚拟运行环境通知给虚拟运行环境管理模块进行清洗。
在一实施例中，当用户业务功能涉及到关键操作、关键输出以及操作系统特权操作时，需要通过操作系统的系统调用统一的对外操作。也就是说，基于本公开图1所示的实现移动目标防御的装置中对冗余虚拟运行环境的系统调用执行和判决方式，可以对关键业务操作、关键业务输出、操作系统特权操作进行合法性判别，具体地，
当某一个虚拟运行环境中的用户业务版本发送系统调用时，系统调用管理模块具体配置为：
获取当前受控的系统调用的相关信息，包括系统调用号、系统调用参数等；使用当前访问的系统调用情况与已有的监控系统调用信息中进行匹配，如果匹配不成功则允许执行当前系统调用，继续执行原有的系统调用以及用户业务流程；如果匹配成功，则，检查其他虚拟运行环境是否已处于系统调用等待判决的状态，如果其他虚拟运行环境并未处于系统调用等待判决状态，则设置当前虚拟运行环境为等待判决状态，设置超时定时器；直到超时定时器到期，检查其他虚拟运行环境是否处于系统调用等待判决状态；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境并通知虚拟运行环境管理模块；
如果其他虚拟运行环境均已进入系统调用等待判决状态，对所有虚拟运行环境下的当前系统调用情况进行判决，并将判决结果通知给虚拟运行环境管理模块。其中，判决包括但不限于以下方式：择多判决和一致性判决。其中，择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问。一致性判决包括：只有当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。这里，对于安全性要求极高但对响应时间要求不高的场景可以采用一致性判决；对于安全性要求不是非常高并对响应时间要求比较高的场景可以采用择多判决。
相应地，虚拟运行环境管理模块具体配置为：
对判决为合法的虚拟运行环境标记为正常状态，并按照系统调用的原 有流程进行处理：执行系统调用、返回执行结果、回到用户态业务程序继续执行原有用户业务流程；将判决为非法的虚拟运行环境设置为异常状态，对异常状态的虚拟运行环境的进行清洗。进一步地，还配置为：启动清洗后的异常状态虚拟运行环境和用户业务并重新设置为正常状态。
在一实施例中，当发生外部事件时，虚拟运行环境管理模块还配置为：
接收通过主机操作系统传递的外部事件；遍历处于正常状态的虚拟运行环境并依次转发接收到的外部事件；
虚拟运行环境管理模块可以通过虚拟化运行环境所属的虚拟设备如虚拟网卡等传递外部事件；同时，将按照原有流程将接收到的外部事件传递给上层的用户业务模块，用户业务模块按照已有的业务流程处理外部事件。
实际应用时，虚拟运行环境管理模块、系统调用管理模块可由实现移动目标防御的装置中的处理器实现。
本公开实施例提供的实现移动目标防御的装置，一方面，通过创建若干异构虚拟运行环境，虚拟运行环境模块的镜像和用户业务模块的镜像使用多种方式形成随机、多样的异构体，异构体对外攻击面也呈现随机、多样的特征；另一方面，运行时随机、动态加载虚拟运行环境模块的镜像和用户业务模块的镜像，使得运行时的对外攻击面不可预测。也就是说，本公开实施例提供的技术方案，从用户业务和虚拟运行环境等多个角度运用移动目标防御的思想，实现了动态改变实现移动目标防御的装置对外暴露的可攻击表面以及攻击路径，便于及时发现安全威胁，提高了整个系统的安全级别。
进一步地，通过多个虚拟运行环境的系统调用进行多模判决，根据判决结果可及时识别和阻止各种类型的非法特权操作和非法业务操作，实现了对未知的安全威胁的应对处理。
进一步地，当若干个虚拟运行环境中的某个虚拟运行环境中的用户业务被劫持攻击后，可能对虚拟运行环境模块或用户业务模块内部进行破坏，但是，无法对外部的关键操作进行破坏，因此，不会影响整个实现移动目标防御的装置的安全性，大大降低了单个执行体的安全性直接影响整个系统的安全性的问题。仅当半数以上的虚拟运行环境在一个对外行为或特权 操作上，出现完全一致的非法操作，才会影响整个实现移动目标防御的装置的安全性。然而，由于本公开实施例中的虚拟运行环境模块和用户业务模块都是结构相异的，漏洞的成因以及利用的方法也是相异的，因此，出现半数以上完全一致的非法操作的概率是极低的。
图2为本公开实现移动目标防御的方法的流程图，如图2所示，包括：
步骤200：建立若干个异构的虚拟运行环境的镜像，以及若干个异构的用户业务的镜像。
其中，用户业务包括至少两个负责实际的用户业务功能的用户业务模块，虚拟运行环境包括至少两个负责对上层的用户业务模块提供虚拟的运行环境的虚拟运行环境模块。
每一个用户业务模块运行在一个虚拟运行环境模块之上。各个业务模块的功能相同但内部结构不同，具体实现方式包括但不限于：编译优化选项不同、编译器版本不同等。
不同的用户业务模块的建立，通过使用不同版本的编译器，比如：gcc3.1.4或gcc4.1.2等不同编译器版本，以及不同的编译选项，比如：O1、O2、O3等编译优化选项，以生成若干个异构(功能相同但内部结构不同)的用户业务模块的镜像。
虚拟运行环境模块负责对上层的用户业务模块提供虚拟的运行环境，实现从用户业务视角来看运行在虚拟运行环境等同于独占使用实际操作系统的目的。虚拟机运行环境模块以轻量级虚拟化的基础设施组件如LXC容器及相关库、Docker等的形式存在。各个虚拟运行环境模块的功能相同但结构不同，具体实现方式包括但不限于：基础设施组件的配置选项不同、基础设施组件的源代码版本不同、基础设施组件的编译选项不同等。
不同的虚拟运行环境模块的建立，通过获取功能相同但源码版本不同的若干基础设施组件版本，对不同的基础设施组件版本(比如V1.0、V1.2等功能相同、源代码不同的版本)，使用不同的编译器(比如gcc3.1.4或gcc4.1.2等不同编译器版本)以及不同的编译选项(比如O1、O2、O3等编译优化选项)生成若干个异构(功能相同但内部结构不同)的虚拟运行环境模块的镜像。
步骤201：设置用于标识需要监控的系统调用的监控系统调用信息，以及需要创建的虚拟运行环境的目标个数。
本步骤中，根据用户业务的安全需求设置监控系统调用信息，包括监控系统调用信息的配置信息中需要监控的系统调用包括但不限于用户业务的关键操作系统调用等。监控系统调用信息包括但不限于：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用等安全敏感的系统调用。
本步骤中的虚拟运行环境的目标个数可以是生成的一个随机数。
步骤202：根据建立的虚拟运行环境的镜像和用户业务的镜像创建目标个数个虚拟运行环境，并按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境。
本步骤中的创建目标个数个虚拟运行环境包括：
首先，初始化虚拟运行环境模块以及用户业务模块，以形成不可预测的攻击面，具体包括：
从若干个异构的虚拟运行环境模块的镜像中，动态的随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像；从若干个异构的用户业务模块的镜像中，动态的随机选择一个镜像作为即将运行的用户业务模块的镜像；根据选择出的上述镜像创建一个虚拟运行环境；利用上述方法创建虚拟运行环境，直到创建的虚拟运行环境的个数达到目标个数个。
然后，加载和运行建立的若干个虚拟运行环境，依次设置创建的虚拟运行环境状态为正常可用状态。
每一个基于虚拟运行环境的用户业务模块都可以独立的执行即在不同虚拟运行环境中的用户业务模块之间不存在业务上的耦合关系，每个用户业务都可以相互独立的执行；但是，当用户业务功能涉及到关键操作、关键输出以及操作系统特权操作时，需要通过操作系统的系统调用统一的对外操作，其中，系统调用是用户业务的关键操作的接口，例如操作系统特权操作、用户业务对外的输入和输出操作等等。
在一实施例中，基于本公开图1所示的实现移动目标防御的装置中对 冗余虚拟运行环境的系统调用执行和判决的方法，可以对关键业务操作、关键业务输出、操作系统特权操作进行合法性判别，包括：
当某一个虚拟运行环境中的用户业务版本发送系统调用时，步骤202中的按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境，具体包括：
获取当前受控的系统调用的相关信息，包括系统调用号、系统调用参数等；使用当前访问的系统调用情况与已有的监控系统调用信息进行匹配，如果匹配不成功则允许执行当前系统调用，继续执行原有的系统调用以及用户业务流程；如果匹配成功，则，检查其他虚拟运行环境是否已处于系统调用等待判决的状态，如果其他虚拟运行环境并未处于系统调用等待判决状态，则设置当前虚拟运行环境为等待判决状态，设置超时定时器；直到超时定时器到期，检查其他虚拟运行环境是否处于系统调用等待判决状态；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境；
如果其他虚拟运行环境均已进入系统调用等待判决状态，对所有虚拟运行环境下的当前系统调用情况进行判决，并根据判决结果获知虚拟运行环境的合法性。其中，判决包括但不限于以下方式：择多判决和一致性判决。其中，择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问。一致性判决包括：只有当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。这里，对于安全性要求极高但对响应时间要求不高的场景可以采用一致性判决；对于安全性要求不是非常高并对响应时间要求比较高的场景可以采用择多判决。
对判决为合法的虚拟运行环境标记为正常状态，并按照系统调用的原有流程进行处理：执行系统调用、返回执行结果、回到用户态业务程序继续执行原有用户业务流程；将判决为非法的虚拟运行环境设置为异常状态，对异常状态的虚拟运行环境的进行清洗。进一步地，还包括：启动清洗后的异常状态虚拟运行环境和用户业务并重新设置为正常状态。
在一实施例中，当发生外部事件时，本公开实施例方法还包括：
接收通过主机操作系统传递的外部事件；遍历处于正常状态的虚拟运行环境并依次转发接收到的外部事件；
虚拟运行环境管理模块可以通过虚拟化运行环境所属的虚拟设备如虚拟网卡等传递外部事件；同时，将按照原有流程将接收到的外部事件传递给上层的用户业务模块，用户业务模块按照已有的业务流程处理外部事件。
本公开提供的实现移动目标防御的方法，一方面，通过创建若干异构虚拟运行环境，虚拟运行环境模块的镜像和用户业务模块的镜像使用多种方式形成随机、多样的异构体，异构体对外攻击面也呈现随机、多样的特征；另一方面，运行时随机、动态加载虚拟运行环境模块的镜像和用户业务模块的镜像，使得运行时的对外攻击面不可预测。也就是说，本公开提供的技术方案，从用户业务和虚拟运行环境等多个角度运用移动目标防御的思想，实现了动态改变实现移动目标防御的装置对外暴露的可攻击表面以及攻击路径，便于及时发现安全威胁，提高了整个系统的安全级别。
进一步地，通过多个虚拟运行环境的系统调用进行多模判决，根据判决结果可及时识别和阻止各种类型的非法特权操作和非法业务操作，实现了对未知的安全威胁的应对处理。
进一步地，当若干个虚拟运行环境中的某个虚拟运行环境中的用户业务被劫持攻击后，可能对虚拟运行环境模块或用户业务模块内部进行破坏，但是，无法对外部的关键操作进行破坏，因此，不会影响整个实现移动目标防御的装置的安全性，大大降低了单个执行体的安全性直接影响整个系统的安全性的问题。仅当半数以上的虚拟运行环境在一个对外行为或特权操作上，出现完全一致的非法操作，才会影响整个实现移动目标防御的装置的安全性。然而，由于本公开实施例中的虚拟运行环境模块和用户业务模块都是结构相异的，漏洞的成因以及利用的方法也是相异的，因此，出现半数以上完全一致的非法操作的概率是极低的。
下面结合图1所示的实现移动目标防御的装置，对本公开实现移动目标防御的方法的具体实施方式进行详细描述。
图3为本公开实现移动目标防御的方法中创建若干异构虚拟运行环境的实施例的流程示意图，如图3所示，具体包括：
首先，建立若干个作为执行体的异构(功能相同但内部结构不同)的基础设施组件(包括虚拟运行环境模块的镜像和用户业务模块的镜像)，使得这些基础设施组件的对外攻击面呈现随机、多样的特征。以便破坏攻击者所依赖的系统固定的规律，比如缓存区溢出攻击依赖符号的布局规律等。具体包括：
步骤300：针对不同源代码版本的虚拟运行环境的基础设施组件配置不同的扩展功能选项，使用不同的编译器版本以及不同编译优化选项生成若干个基本功能相同但结构不同的虚拟运行环境模块的镜像。
也就是说，针对虚拟运行环境模块，获取功能相同但源码版本不同的基础设施组件版本，针对不同的基础设施组件版本(比如V1.0、V1.2等功能相同、源代码不同的版本)，使用不同的编译器(比如gcc3.1.4或gcc4.1.2等不同编译器版本)以及不同的编译选项(比如O1、O2、O3等编译优化选项)生产若干个异构(功能相同但内部结构不同)的虚拟运行环境模块的镜像。
步骤301：针对用户业务模块，使用不同的编译器版本以及不同编译优化选项生成若干个功能相同但结构不同的用户业务模块的镜像。
也就是说，针对用户业务模块，使用不同的版本的编译器(比如gcc3.1.4或gcc4.1.2等不同编译器版本)以及不同的编译选项(比如O1、O2、O3等编译优化选项)生成若干个异构(功能相同但内部结构不同)的用户业务模块的镜像。
然后，初始化系统调用管理模块，具体包括步骤302：从预先设置(如由业务人员预先填写)的配置信息中读取并设置监控系统调用信息。
监控系统调用信息可以采用监控系统调用表的形式存在，用于标识需要监控的系统调用。监控系统调用表中的内容包括但不限于：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用等安全敏感的系统调用。
接着，初始化虚拟运行环境管理模块，具体包括步骤303：生成一个随机数用于标识需要创建的虚拟运行环境的目标个数；
最后，初始化虚拟运行环境模块以及用户业务模块以创建若干个虚拟运行环境，从而形成不可预测的攻击面。具体包括：
步骤304：判断已创建的虚拟运行环境个数是否小于目标个数，如果小于，则进入步骤305；如果不小于，则进入步骤308。
步骤305：从若干个异构的虚拟运行环境模块的镜像中，动态地随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像。
步骤306：从若干个异构的用户业务模块的镜像中，动态地随机选择一个镜像作为即将运行的用户业务模块的镜像；根据选择出的上述镜像创建一个虚拟运行环境。
步骤307：虚拟运行环境管理模块使用选择出的虚拟运行环境模块的镜像及用户业务模块的镜像创建一个虚拟运行环境。之后返回步骤304。
步骤308：虚拟运行环境管理模块加载和运行建立的目标个数个虚拟运行环境，依次设置创建的虚拟运行环境状态为正常可用状态。
通过本公开实施例创建若干异构虚拟运行环境，为虚拟运行环境模块的镜像和用户业务模块的镜像使用多种方式形成随机、多样的异构体，异构体对外攻击面也呈现随机、多样的特征；而且，运行时随机、动态加载虚拟运行环境模块的镜像和用户业务模块的镜像，使得运行时的对外攻击面不可预测。实现了动态改变系统对外暴露的可攻击表面以及攻击路径，便于及时发现安全威胁，提高了整个系统的安全级别。
图4为本公开实现移动目标防御的方法中系统调用的执行和判决的实施例的流程示意图，如图4所示，具体包括：
步骤400：当某一个虚拟运行中的用户业务版本发送系统调用时，系统调用管理模块会获取当前系统调用的相关信息，包括系统调用号、系统调用参数等。
步骤401：系统调用管理模块将当前访问的系统调用与已有的监控系统调用表中的系统调用进行匹配，如果匹配不成功，则允许当前系统调用执行，返回步骤400继续执行原有的系统调用以及用户业务流程；如果匹配成功，进入步骤402。
步骤402：操作系统检查其他虚拟运行环境是否都已处于系统调用等待判决的状态，如果其他虚拟运行环境并未处于系统调用等待判决的状态，则进入步骤403；如果其他虚拟运行环境均已进入系统调用等待判决的状态，则进入步骤405。
步骤403：设置当前虚拟运行环境为等待判决状态，设置超时定时器并阻塞当前虚拟运行环境，进入步骤404。
步骤404：超时定时器到期后检查其他虚拟运行环境是否处于系统调用等待判决的状态。对于已进入系统调用等待状态的虚拟运行环境，执行步骤405；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境，则进入步骤407的清洗流程。
步骤405～步骤406：对所有虚拟运行环境下的当前系统调用情况进行判决，并根据判决结果获知虚拟运行环境的合法性，对于判决结果为合法虚拟运行环境，进入步骤411；对于判决结果为非法虚拟运行环境，进入步骤407。
本步骤中，判决包括但不限于以下方式：择多判决和一致性判决。其中，择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问。一致性判决包括：只有当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。这里，对于安全性要求极高但对响应时间要求不高的场景可以采用一致性判决；对于安全性要求不是非常高并对响应时间要求比较高的场景可以采用择多判决。
步骤407：虚拟运行环境管理模块针对判决为非法的虚拟运行环境，设置该虚拟运行环境为异常状态，对异常状态的虚拟运行环境的进行清洗，停止并销毁异常的虚拟运行环境。
步骤408：从若干个虚拟运行环境模块和若干个用户业务模块中，重新随机选择异构的虚拟运行环境模块的镜像和用户业务模块的镜像。
本步骤中，有多少个异常的虚拟运行环境就重新创建多少个新的虚拟运行环境。
步骤409：组合随机选择出的镜像，创建并运行新的虚拟运行环境。
步骤410：初始化新的虚拟运行环境完成，设置该虚拟运行环境为正常状态。结束本流程。
步骤411：虚拟运行环境管理模块针对判决为合法的虚拟运行环境标记为正常状态，并按照系统调用的原有流程进行处理：执行系统调用、返回执行结果、回到用户态业务程序继续执行原有用户业务流程。
本实施例中，由多个虚拟运行环境的系统调用进行多模判决，根据判决结果可及时识别和阻止各种类型的非法特权操作和非法业务操作，实现了对未知的安全威胁的应对处理。
图5为本公开实现移动目标防御的方法中传递外部事件的实施例的流程示意图，如图5所示，具体包括：
首先，步骤500：外部事件发生后首先通过主机操作系统传递到虚拟运行环境管理模块。
接着，虚拟运行环境管理模块遍历处于正常状态的虚拟运行环境，并依次注入收到的外部事件。具体包括：
步骤501：虚拟运行环境管理模块选择一个未注入外部事件的虚拟化运行环境。
步骤502：虚拟运行环境管理模块通过虚拟运行环境所属的虚拟设备如虚拟网卡传递外部事件。
步骤503：虚拟运行环境模块接收到外部事件后，按照原有流程传递给上层的用户业务模块，用户业务模块按照已有的业务流程处理外部事件。
步骤504：判断是否所有的虚拟运行环境都已经转发了外部事件，如果是，结束本流程；如果不是，返回步骤501。
下面结合四个不同的攻击实例和攻击过程，详细描述本公开异构虚拟运行环境的执行过程。
图6为本公开实现移动目标防御的方法中用户业务被攻击后输出错误结果的实施例的示意图。假设本实施例中，已按照图3所示的异构虚拟运行环境的创建方法创建出如图6所示的5个虚拟运行环境的异构冗余系统， 并完成相应模块的初始化流程。当用户业务通过网络收到外部的控制命令时，如图6所示，包括：
主机操作系统的虚拟运行环境管理模块首先收到外部发送的网络报文，虚拟运行环境管理模块通过各个虚拟运行环境的虚拟网卡设备依次给5个虚拟运行环境转发外部发来的网络报文；
5个虚拟运行环境以及用户业务模块依次通过系统调用感知到虚拟网卡有待接收的网络报文，虚拟运行环境依次执行接收网络报文的系统调用；
系统调用管理模块收集当前系统调用情况，并与监控系统调用表进行匹配。由于接收报文不属于监控系统调用，因此，系统调用管理模块是允许5个虚拟运行环境读取网络报文数据的。
如图6所示，本实施例中，假设在五个虚拟运行环境及用户业务模块读取并处理网络数据报文时，其中有一个用户业务模块或虚拟运行环境模块，如图6中的虚拟运行环境3存在漏洞并被这次数据报文攻击成功(如图6中的六角星型标志所示)，而且假设还篡改了此用户业务对控制命令的执行结果；而由于其他的用户业务模块或虚拟运行环境模块与被攻击的模块结构不同，因此，不存在相同的漏洞或存在漏洞但利用方式不同，在当前数据报文的攻击下表现不同，并未被篡改用户业务的对控制命令的执行结果。
如图6所示，5个虚拟运行环境执行完成后将执行结果提交到系统调用控制模块，如图6所示，虚线表示虚拟运行环境3提交执行结果。本实施例中，假设系统调用控制模块对5个虚拟运行环境的执行结果进行择多判决：由于有4个虚拟运行环境的输出结果是一致的，只有一个虚拟运行环境即虚拟运行环境3的输出结果是不一致的。因此，判定虚拟运行环境3为非法虚拟运行环境，而其他虚拟运行环境为合法虚拟运行环境；
按照合法的输出结果执行系统调用，统一对外输出正确的结果；对于非法虚拟执行环境3则执行清洗流程，并重新选择并加载虚拟运行环境模块和用户业务模块。
图7为本公开实现移动目标防御的方法中用户业务被攻击后执行非法特权操作的实施例的示意图，假设本实施例中，已按照图3所示的异构虚 拟运行环境的创建方法创建出如图7所示的5个虚拟运行环境的异构冗余系统，并完成相应模块的初始化流程。如图7所示，包括：
当某个用户业务模块或虚拟运行环境模块，如本实施例中的虚拟运行环境4自身存在安全漏洞(如图7中的六角星型标志所示)，并且在合法的输入情况下被注入攻击代码，比如图6所示的用户业务被攻击后输出错误结果实施例的接收网络报文过程，如果预先设置在某个用户业务执行流程时触发注入代码执行非法特权操作，那么，如图7所示，当5个虚拟运行环境执行到触发攻击代码时，被注入攻击代码的虚拟运行环境4会企图执行非法的特权操作，而其他的虚拟运行环境则按照原有的业务流程执行正常的系统调用过程。
之后，所有的虚拟运行环境的系统调用请求都提交到系统调用控制模块，如图7所示，虚线表示虚拟运行环境4提交系统调度请求。系统调用控制模块对5个虚拟运行环境的执行结果进行择多判决。本实施例中，由于有4个虚拟运行环境的系统调用请求是一致的，只有一个虚拟运行环境即虚拟运行环境4的系统调用请求是不一致的。因此，判定虚拟运行环境4为非法虚拟运行环境，其他的虚拟运行环境为合法虚拟运行环境；
这样，允许合法的系统调用请求按照原有的业务流程正常处理；对于非法的系统调用请求即虚拟运行环境4执行清洗流程，并重新选择并加载虚拟运行环境模块和用户业务模块。
图8为本公开实现移动目标防御的方法中用户业务被攻击后出现异常状况的实施例的示意图，假设本实施例中，已按照图3所示的异构虚拟运行环境的创建方法创建出如图8所示的5个虚拟运行环境的异构冗余系统，并完成相应模块的初始化流程。当外部事件如外部网络报文，通过虚拟运行环境管理模块、虚拟运行环境模块以及相关虚拟设备传递到如图8所示的5个虚拟运行环境及相应的用户业务模块中，如图8所示，包括：
本实施例中，如图8中的六角星型标志所示，假设在该外部网络报文的攻击下，命中虚拟运行环境5的漏洞，并导致虚拟运行环境5进入挂起或死循环等异常状态。而其他虚拟运行环境由于镜像结构不同，漏洞情况不同或相同漏洞下利用方式不同，在当前报文攻击下仍可正常执行，并通 过系统调用反馈输出结果；
当其他4个虚拟运行环境提交系统调用后，进入到系统调用等待判决阶段，并设置了超时定时器；但是，处于异常状态的虚拟运行环境5始终处于挂起或死循环状态；
当超时定时器超时后，对于已经进入系统调用等待判决阶段的虚拟运行环境进行判决处理：由于此时所有虚拟运行环境输出的是一致性的结构，所以均判决为合法；而超时未通过系统调用反馈输出结果的虚拟运行环境5则被标记为非法寻你运行环境；
对于合法的虚拟运行环境，允许其执行系统调用并输出结果，按照原有的业务流程正常处理；对于非法的虚拟运行环境5则执行清洗流程，并重新选择并加载虚拟运行环境模块和用户业务模块。
图9为本公开实现移动目标防御的方法中多个用户业务同时被攻击的实施例的示意图，假设本实施例中，已按照图3所示的异构虚拟运行环境的创建方法创建出如图9所示的5个虚拟运行环境的异构冗余系统，并完成相应模块的初始化流程。并且，按照图5所示的传递外部事件的实施例流程，在发生外部网络数据时已依次将外部事件传递给如图9所示的5个虚拟运行环境。如图9所示，
假设本实施例中，有两个用户业务模块或虚拟运行环境模块，如虚拟运行环境1和虚拟运行环境5存在相同的漏洞，并且，在外部事件即给定的输入网络攻击报文下漏洞会被利用。
由于虚拟运行环境1和虚拟运行环境5使用了不同编译器、不同的编译选项等手段，因此自身结构不同。而相同的攻击报文下只能针对特定的结构产生相同的攻击效果，因此，结构相异的漏洞在相同的攻击方式下产生了不同的攻击结果，如图9中的八角型标志和六角星型标志分别所示。其他3个虚拟运行环境不存在此漏洞的情况下，反馈正常的处理结果。
5个虚拟运行环境都通过系统调用反馈结果，如图9所示，系统调用管理模块对5个异构虚拟运行环境的结果进行判决，由于3个虚拟运行环境输出为一致性的结果，而2个虚拟运行环境输出不同结果。因此，判定反馈一致性结果的3个虚拟运行环境为合法寻你运行环境，而反馈不同结果 的两个虚拟运行环境为非法虚拟运行环境即虚拟运行环境1和虚拟运行环境5。
对于合法的虚拟运行环境，允许其执行系统调用并输出结果，按照原有的业务流程正常处理；对于非法的虚拟运行环境1和非法的虚拟运行环境5则执行清洗流程，并重新选择并加载虚拟运行环境模块和用户业务模块。
通过上述实施例可以看出，本公开实施例提供的技术方案，通过对关键系统调用进行判决，及时发现了未知的安全威胁。而且，当单个或少数虚拟运行环境出现安全问题时不影响整个系统的安全性，且及时清洗了出现安全问题的虚拟运行环境，确保了系统持续的安全性和健壮性。
本公开实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行本公开实施例上述任一实现移动目标防御的方法的步骤。
以上所述，仅为本公开的较佳实例而已，并非用于限定本公开的保护范围。凡在本公开的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。
工业实用性
本公开实施例提供的方案，建立若干个异构的虚拟运行环境的镜像，以及若干个异构的用户业务的镜像；设置用于标识需要监控的系统调用的监控系统调用信息，以及需要创建的虚拟运行环境的目标个数；根据建立的虚拟运行环境的镜像和用户业务的镜像创建目标个数个虚拟运行环境，并按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境。一方面，通过创建若干异构虚拟运行环境，虚拟运行环境模块的镜像和用户业务模块的镜像使用多种方式形成随机、多样的异构体，异构体对外攻击面也呈现随机、多样的特征；另一方面，运行时随机、动态加载虚拟运行环境模块的镜像和用户业务模块的镜像，使得运行时的对外攻击面不可预测。也就是说，本公开实施例提供的技术方案，从用户业务和虚拟运行环境等多个角度运用移动目标防 御的思想，实现了动态改变实现移动目标防御的装置对外暴露的可攻击表面以及攻击路径，便于及时发现安全威胁，提高了整个系统的安全级别。

Claims (23)

  1. 一种实现移动目标防御的装置，包括：设置在主机操作系统内的虚拟运行环境管理模块、系统调用管理模块，以及虚拟运行环境模块、用户业务模块；其中，
    虚拟运行环境模块，包括至少两个异构的虚拟运行环境模块的镜像，配置为负责对上层的用户业务模块提供虚拟的运行环境；
    用户业务模块，包括至少两个异构的用户业务模块的镜像，配置为负责实际的用户业务功能；
    虚拟运行环境管理模块，配置为按照生成的虚拟运行环境的目标个数，根据建立的虚拟运行环境模块的镜像和用户业务模块的镜像创建目标个数个虚拟运行环境；按照来自系统调用管理模块的通知，管理可能存在安全问题的虚拟运行环境；
    系统调用管理模块，设置有用于标识需要监控的系统调用的监控系统调用信息，配置为按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行管理，以确定可能存在安全问题的虚拟运行环境并通知虚拟运行环境管理模块；
    其中，异构为功能相同但内部结构不同。
  2. 根据权利要求1所述的装置，其中，所述虚拟运行环境模块的镜像为轻量级虚拟化的基础设施组件。
  3. 根据权利要求1所述的装置，其中，所述异构的虚拟运行环境模块的镜像包括：基础设施组件的配置选项不同、基础设施组件的源代码版本不同、基础设施组件的编译选项不同。
  4. 根据权利要求1所述的装置，其中，所述异构的业务模块的镜像包括：编译优化选项不同、编译器版本不同。
  5. 根据权利要求1所述的装置，其中，所述虚拟运行环境管理模块中的创建目标个数个虚拟运行环境包括：
    初始化所述虚拟运行环境模块以及所述用户业务模块，以形成不可预 测的攻击面；
    加载和运行建立的若干个所述虚拟运行环境，依次设置创建的虚拟运行环境的状态为正常可用状态。
  6. 根据权利要求5所述的装置，其中，所述虚拟运行环境管理模块中的初始化所述虚拟运行环境模块以及所述用户业务模块包括：
    从所述至少两个异构的虚拟运行环境模块的镜像中，随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像；从所述至少两个异构的用户业务模块的镜像中，随机选择一个镜像作为即将运行的用户业务模块的镜像；根据选择出的镜像创建一个虚拟运行环境，直到创建的虚拟运行环境的个数达到所述目标个数个。
  7. 根据权利要求1所述的装置，其中，所述系统调用管理模块中的对创建的虚拟运行环境中的系统调用进行管理包括：
    基于所述监控系统调用信息识别虚拟运行环境运行中发生的受控的系统调用；收集受控的系统调用的信息；
    基于所有虚拟运行环境的受控的系统调用的信息进行判决，将可能存在安全问题的虚拟运行环境通知给所述虚拟运行环境管理模块。
  8. 根据权利要求7所述的装置，其中，所述监控系统调用信息包括：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用。
  9. 根据权利要求7或8所述的装置，其中，
    所述系统调用管理模块配置为：
    当相应虚拟运行环境中的用户业务版本发送系统调用时，获取当前受控的系统调用的相关信息；使用当前访问的系统调用情况与已有的监控系统调用信息中进行匹配，如果匹配不成功，则允许执行当前系统调用，继续执行原有的系统调用以及用户业务流程；如果匹配成功，则，
    检查除所述相应虚拟运行环境外的其他虚拟运行环境是否已处于系统调用等待判决的状态，
    如果其他虚拟运行环境并未处于系统调用等待判决状态，则设置当前 虚拟运行环境为等待判决状态，设置超时定时器；直到超时定时器到期，检查其他虚拟运行环境是否处于系统调用等待判决状态；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境并通知所述虚拟运行环境管理模块；
    如果其他虚拟运行环境均已进入系统调用等待判决状态，对所有虚拟运行环境下的当前系统调用情况进行判决，并将判决结果通知给所述虚拟运行环境管理模块；
    相应地，所述虚拟运行环境管理模块配置为：
    对判决为合法的虚拟运行环境标记为正常状态，按照系统调用的原有流程进行处理；将判决为非法的虚拟运行环境设置为异常状态，对异常状态的虚拟运行环境的进行清洗。
  10. 根据权利要求9所述的装置，其中，所述虚拟运行环境管理模块还配置为：启动清洗后的异常状态虚拟运行环境和用户业务并重新设置为正常状态。
  11. 根据权利要求9所述的装置，其中，所述判决包括：择多判决；所述择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问；
    或者，
    所述判决包括：一致性判决；所述一致性判决包括：当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。
  12. 根据权利要求1所述的装置，其中，所述虚拟运行环境管理模块还配置为：
    当发生外部事件时，接收通过主机操作系统传递的外部事件；遍历处于正常状态的虚拟运行环境并依次转发接收到的外部事件。
  13. 一种实现移动目标防御的方法，包括：
    建立至少两个异构的虚拟运行环境的镜像，以及至少两个异构的用户业务的镜像；
    设置用于标识需要监控的系统调用的监控系统调用信息，以及需要创建的虚拟运行环境的目标个数；
    根据建立的虚拟运行环境的镜像和用户业务的镜像创建目标个数个虚拟运行环境，并按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境；
    其中，异构为功能相同但内部结构不同。
  14. 根据权利要求13所述的方法，其中，所述虚拟运行环境模块的镜像为轻量级虚拟化的基础设施组件；
    所述建立至少两个异构的虚拟运行环境的镜像包括：
    通过获取功能相同但源码版本不同的基础设施组件版本，对不同的基础设施组件版本使用不同的编译器以及不同的编译选项，生成所述至少两个异构的虚拟运行环境模块的镜像。
  15. 根据权利要求13所述的方法，其中，所述建立至少两个异构的用户业务的镜像包括：
    通过使用不同版本的编译器，以及不同的编译选项，生成所述至少两个异构的用户业务模块的镜像。
  16. 根据权利要求13所述的方法，其中，根据预先设置的配置信息设置所述监控系统调用信息；
    所述监控系统调用信息包括：用户业务的关键操作系统调用、用户业务的关键输出系统调用、操作系统管理的设备特权系统调用。
  17. 根据权利要求13所述的方法，其中，所述创建目标个数个虚拟运行环境包括：
    初始化所述虚拟运行环境模块以及所述用户业务模块，以形成不可预测的攻击面；
    加载和运行建立的若干个所述虚拟运行环境，依次设置创建的虚拟运行环境的状态为正常可用状态。
  18. 根据权利要求17所述的方法，其中，所述初始化所述虚拟运行环境模块以及所述用户业务模块包括：
    从所述至少两个异构的虚拟运行环境模块的镜像中，随机选择一个镜像作为即将运行的虚拟运行环境模块的镜像；从所述至少两个异构的用户业务模块的镜像中，随机选择一个镜像作为即将运行的用户业务模块的镜像；根据选择出的镜像创建一个虚拟运行环境，直到创建的虚拟运行环境的个数达到所述目标个数个。
  19. 根据权利要求13所述的方法，其中，当相应虚拟运行环境中的用户业务版本发送系统调用时，所述按照监控系统调用信息对创建的虚拟运行环境中的系统调用进行监控，以确定可能存在安全问题的虚拟运行环境包括：
    获取当前受控的系统调用的相关信息；使用当前访问的系统调用情况与已有的监控系统调用信息中进行匹配，如果匹配不成功，则允许执行当前系统调用，继续执行原有的系统调用以及用户业务流程；如果匹配成功，则，
    检查除所述相应虚拟运行环境外的其他虚拟运行环境是否已处于系统调用等待判决的状态，
    如果其他虚拟运行环境并未处于系统调用等待判决状态，则设置当前虚拟运行环境为等待判决状态，设置超时定时器；直到超时定时器到期，检查其他虚拟运行环境是否处于系统调用等待判决状态；针对超时仍未进入系统调用等待状态的虚拟运行环境被认为是非法虚拟运行环境；
    如果其他虚拟运行环境均已进入系统调用等待判决状态，对所有虚拟运行环境下的当前系统调用情况进行判决，对判决为合法的虚拟运行环境标记为正常状态，按照系统调用的原有流程进行处理；将判决为非法的虚拟运行环境设置为异常状态，对异常状态的虚拟运行环境的进行清洗。
  20. 根据权利要求19所述的方法，其中，所述方法还包括：启动所述清洗后的异常状态虚拟运行环境和用户业务并重新设置为正常状态。
  21. 根据权利要求19所述的方法，其中，所述判决包括：择多判决；所述择多判决包括：在所有的虚拟运行环境中，认为多数相同的系统调用情况为合法访问，而与多数系统调用不同的系统调用为非法访问；
    或者，
    所述判决包括：一致性判决；所述一致性判决包括：当所有虚拟运行环境中所有系统调用情况完全一致，才认为当前访问合法，否则均为非法访问。
  22. 根据权利要求13所述的方法，其中，所述方法还包括：
    当发生外部事件时，接收通过主机操作系统传递的外部事件；遍历处于正常状态的虚拟运行环境并依次转发接收到的外部事件。
  23. 一种存储介质，其上存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求13至22任一项所述方法的步骤。
PCT/CN2018/081967 2017-03-20 2018-04-04 一种实现移动目标防御的方法、装置及存储介质 WO2018171810A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710166174.9 2017-03-20
CN201710166174.9A CN108632214B (zh) 2017-03-20 2017-03-20 一种实现移动目标防御的方法及装置

Publications (1)

Publication Number Publication Date
WO2018171810A1 true WO2018171810A1 (zh) 2018-09-27

Family

ID=63585012

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/081967 WO2018171810A1 (zh) 2017-03-20 2018-04-04 一种实现移动目标防御的方法、装置及存储介质

Country Status (2)

Country Link
CN (1) CN108632214B (zh)
WO (1) WO2018171810A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111666562A (zh) * 2020-06-04 2020-09-15 郑州昂视信息科技有限公司 一种软件安全的主动防御方法及系统
CN111859391A (zh) * 2020-07-09 2020-10-30 河南信大网御科技有限公司 可信执行体、拟态逃逸快速识别方法及拟态防御架构
CN112506620A (zh) * 2020-12-28 2021-03-16 网络通信与安全紫金山实验室 基于docker容器部署的ospf协议的清洗恢复方法、装置、设备和介质
CN116015978A (zh) * 2023-02-13 2023-04-25 中国南方电网有限责任公司 一种基于拟态安全技术的异构冗余流量检测系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109598123B (zh) * 2018-12-04 2023-01-24 国家电网有限公司 一种配电自动化系统安全防御平台及方法
CN109873816A (zh) * 2019-01-30 2019-06-11 基本立子(北京)科技发展有限公司 自主弹性云系统管理方法
CN113761520B (zh) * 2020-06-01 2024-04-12 中移(苏州)软件技术有限公司 一种检测防御方法、服务器和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103116515A (zh) * 2011-09-28 2013-05-22 西门子公司 提供用于虚拟运行环境的独立的时间源的方法和虚拟化软件
US20140282539A1 (en) * 2013-03-15 2014-09-18 Adventium Enterprises, Llc Wrapped nested virtualization
CN104519068A (zh) * 2014-12-26 2015-04-15 赵卫伟 一种基于操作系统指纹跳变的移动目标防护方法
CN105847248A (zh) * 2016-03-19 2016-08-10 浙江大学 一种基于虚拟环境的主动防御木马的方法
US20160321093A1 (en) * 2015-04-28 2016-11-03 United States Government As Represented By The Secretary Of The Navy CYBERNAUT: A Cloud-Oriented Energy-Efficient Intrusion-Tolerant Hypervisor

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090204964A1 (en) * 2007-10-12 2009-08-13 Foley Peter F Distributed trusted virtualization platform
US9154492B2 (en) * 2013-09-27 2015-10-06 The University Of North Carolina At Charlotte Moving target defense against cross-site scripting
CN103747036B (zh) * 2013-12-23 2017-05-24 中国航天科工集团第二研究院七〇六所 一种桌面虚拟化环境下的可信安全增强方法
CN104239797B (zh) * 2014-10-13 2017-07-07 北京奇虎科技有限公司 主动防御方法及装置
CA2934311C (en) * 2014-10-21 2017-06-13 Robert L. Grossman Cybersecurity system
CN106254312B (zh) * 2016-07-15 2019-12-13 浙江宇视科技有限公司 一种通过虚拟机异构实现服务器防攻击的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103116515A (zh) * 2011-09-28 2013-05-22 西门子公司 提供用于虚拟运行环境的独立的时间源的方法和虚拟化软件
US20140282539A1 (en) * 2013-03-15 2014-09-18 Adventium Enterprises, Llc Wrapped nested virtualization
CN104519068A (zh) * 2014-12-26 2015-04-15 赵卫伟 一种基于操作系统指纹跳变的移动目标防护方法
US20160321093A1 (en) * 2015-04-28 2016-11-03 United States Government As Represented By The Secretary Of The Navy CYBERNAUT: A Cloud-Oriented Energy-Efficient Intrusion-Tolerant Hypervisor
CN105847248A (zh) * 2016-03-19 2016-08-10 浙江大学 一种基于虚拟环境的主动防御木马的方法

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111666562A (zh) * 2020-06-04 2020-09-15 郑州昂视信息科技有限公司 一种软件安全的主动防御方法及系统
CN111666562B (zh) * 2020-06-04 2023-03-28 郑州昂视信息科技有限公司 一种软件安全的主动防御方法及系统
CN111859391A (zh) * 2020-07-09 2020-10-30 河南信大网御科技有限公司 可信执行体、拟态逃逸快速识别方法及拟态防御架构
CN111859391B (zh) * 2020-07-09 2023-08-04 河南信大网御科技有限公司 可信执行体、拟态逃逸快速识别方法及拟态防御架构
CN112506620A (zh) * 2020-12-28 2021-03-16 网络通信与安全紫金山实验室 基于docker容器部署的ospf协议的清洗恢复方法、装置、设备和介质
CN112506620B (zh) * 2020-12-28 2023-11-24 网络通信与安全紫金山实验室 基于docker容器部署的ospf协议的清洗恢复方法、装置、设备和介质
CN116015978A (zh) * 2023-02-13 2023-04-25 中国南方电网有限责任公司 一种基于拟态安全技术的异构冗余流量检测系统
CN116015978B (zh) * 2023-02-13 2023-12-05 中国南方电网有限责任公司 一种基于拟态安全技术的异构冗余流量检测系统

Also Published As

Publication number Publication date
CN108632214A (zh) 2018-10-09
CN108632214B (zh) 2022-02-22

Similar Documents

Publication Publication Date Title
WO2018171810A1 (zh) 一种实现移动目标防御的方法、装置及存储介质
EP3430557B1 (en) System and method for reverse command shell detection
CA3006003C (en) Dual memory introspection for securing multiple network endpoints
RU2646352C2 (ru) Система и способ для применения индикатора репутации для облегчения сканирования на наличие вредоносных программ
US9813445B2 (en) Taint injection and tracking
US11991203B2 (en) Method and system for generating stateful attacks
US9183377B1 (en) Unauthorized account monitoring system and method
US9460290B2 (en) Conditional security response using taint vector monitoring
US9443085B2 (en) Intrusion detection using taint accumulation
US20150128262A1 (en) Taint vector locations and granularity
US9819696B2 (en) Systems and methods for detecting domain generation algorithm (DGA) malware
KR20060092832A (ko) 웜 봉쇄 방법
US20220417255A1 (en) Managed detection and response system and method based on endpoints
Levitin et al. Optimization of time constrained N-version programming service components with competing task execution and version corruption processes
Araujo et al. Improving cybersecurity hygiene through JIT patching
US20220391506A1 (en) Automated Interpreted Application Control For Workloads
Li et al. A framework for mimic defense system in cyberspace
CN115879099A (zh) 一种dcs控制器、操作处理方法和防护子系统
US20230208862A1 (en) Detecting malware infection path in a cloud computing environment utilizing a security graph
US11706252B1 (en) Detecting malware infection path in a cloud computing environment utilizing a security graph
CN114730338A (zh) 用于发现应用程序篡改的系统和方法
Okamoto et al. Toward an artificial immune server against cyber attacks
Qin et al. TICS: Trusted industry control system based on hardware security module
Bilar et al. Using a novel behavioral stimuli-response framework to defend against adversarial cyberspace participants
Araujo et al. Embedded honeypotting

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18772540

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18772540

Country of ref document: EP

Kind code of ref document: A1