A Mimic Judgment Method and Device Based on Output Subset Weight Assignment

Abstract

The invention discloses a mimicry judgment method and a mimicry judgment device based on output sub-set weight distribution. The method comprises the steps of firstly dividing output of each heterogeneous function equivalent body into a plurality of output sub-sets according to a content logic relation; endowing corresponding weights according to influence of each output sub-set on system security; arranging the output sub-sets according to a descending order of the weights, performing majority judgment on the output sub-sets according to the specified order by using an output processor; judging whether the effective majority judgment is completed, if the effective majority judgment is not completed, according to the specified order, selecting a next output sub-set for continuing the majority judgment, and if the effective majority judgment is completed, stopping the majority judgment, and selecting the corresponding heterogeneous function equivalent body to output as a system output according to a judgment result. According to the method provided by the invention, the amount of judgment data is reduced, a judgment speed is accelerated, the judgment data is treated selectively, the failure probability of the majority judgment is reduced, and normal output of the important data is ensured.

Description

technical field [0001] The invention relates to the technical field of cyberspace security protection, in particular to a mimic judgment method and device based on the weight distribution of output subsets. Background technique [0002] With the continuous development of network technology, the importance of cyberspace security has become increasingly prominent. The mimic defense architecture is a new idea to deal with the threat of network attacks. It realizes intrusion defense based on unknown vulnerabilities or backdoors by constructing a dynamic heterogeneous redundant system architecture and operating mechanism. [0003] Schematic diagram of a typical mimic defense architecture, such as figure 1 shown. [0004] In the mimic defense architecture, the redundant controller receives external control parameters, generates redundant scheduling strategy and output arbitration strategy, and sends them to the input agent and output agent respectively. The input agent selects ...

AI Technical Summary

Problems solved by technology

In the case of a large amount of output data, the amount of calculation is large, which may lead to excessive delay and power consumption;

[0011] 2. Due to the difference in structure and function of heterogeneous functional equivalents, such as operating system version, transmission protocol, calculation accuracy, random variables, etc., it is likely that the output of some non-core logic fields is inconsistent under normal working conditions As a result, most consistent judgment strategies cannot correctly identify their normal working conditions, and the judgment is "inconsistent", which is mistaken for abnormal working conditions and degenerates into random selection, which greatly reduces the defense against loopholes and backdoors;

[0012] 3. If the output result of the heterogeneous functional equivalent body is considered "inconsistent" in multiple consecutive multi-mode judgments, the redundant controller will issue a cleaning instruction to it, so the misjudgment will cause the heterogeneous functional equivalent body Unnecessary cleaning, wasting redundant resources of the mimic system during the cleaning cycle

Images