Zero-day attack detection, analysis and response system and method based on mimic defense architecture

Abstract

The invention relates to a mimicry defense architecture based zero-day attack detection, analysis and response system and a method thereof. The method comprises the steps of performing attack detection and processing on the input, cheating and inducing an attacker through honeypot type executing bodies, and performing meta-function inspection on the output of each executing body; performing statistical analysis on abnormal output by combining abnormal information, updating a zero-day attack database, feeding back an analysis result to an intrusion response module, and preventing persistent attacks of the attacker; performing dynamic adjustment and management on an online executing body by combining voting conditions, executing body dispatching, the executing body with abnormal output and the like, and selecting executing bodies from an executing body resource pool to get into a dynamic online executing body set; and analyzing a zero-day vulnerability in the executing body with abnormal output according to an anomaly statistical analysis result, and repairing the related executing bodies in the executing body pool. According to the invention, functions and the flexibility of mimicry defense architecture are enhanced, values of the abnormal output are sufficiently utilized, and the threat and the defense cost of zero-day attacks are reduced.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a zero-day attack detection, analysis and response system and method based on a mimic defense architecture. Background technique [0002] With the continuous updating of network technology, the problem of network security is becoming more and more serious. Because it is impossible to be 100% error-free in the coding process of operating systems or applications, the ubiquitous zero-day attacks have become an urgent and severe challenge to the security of information systems. Attacks launched by attackers against certain vulnerabilities in various operating systems and application software that are not known to developers or not patched in time are often extremely destructive, and are becoming a disaster for most enterprises and seriously endangering national security. Today, profit-driven attackers are creating specialized and sophisticated malware designed t...

AI Technical Summary

Problems solved by technology

Due to the effectiveness of the mimic defense mechanism, the defender can tolerate the existence of vulnerabilities in the execution body, and does not need to frequently patch the vulnerabilities in the heterogeneous execution body, which leads to the existence of vulnerabilities, that is, the threat of zero-day attacks continues to exist, especially for those Critical bug that could lead to incorrectly consistent output

Although the continuous switching of the online heterogeneous redundant executive body set in the mimic defense mechanism can block the attacker and confuse the attacker's next move, the attacker who may have obtained the internal information of the mimic defense system can still rely on some of the vulnerabilities he has mastered. Information launches repeated attacks on the mimic defense system, or even coordinated attacks among attackers, which will lead to frequent abnormal output and executive switching, which will greatly increase the defense cost and lead to the de facto loss of meta-functions. It is slightly passive to zero-day attacks and lacks the means to further respond to attacks. At the same time, the simple principle of majority unanimous voting may also lead to the occurrence of majority consensus error output of non-meta functions, which will bring serious errors

Images