Efficient mimicry defense system and method

Abstract

The invention provides an efficient mimicry defense system and method, and the system comprises an input agent, a heterogeneous execution body pool, a decision device, a fault detector, a fault collector, and a fault recovery module. The method comprises the following steps that 1, a fault detector detects the software and hardware running state of a heterogeneous execution body in real time and sends detected fault information to a fault collector, and then the fault collector transmits the fault information to a judgment device, an input agent device and a fault recovery module; step 2, theadjustor removes adjustments to the fault heterogeneous executor message; 3, the input agent removes the distribution of the input messages of the fault heterogeneous executor; and 4, the fault recovery module sends a setting command to the faulted heterogeneous execution body or resets the heterogeneous execution body in a hardware mode.

Description

technical field [0001] The invention belongs to the technical field of mimicry defense, and in particular relates to a high-efficiency mimicry judgment device and method. Background technique [0002] Mimic defense technology has changed the rules of the game in cyberspace defense and provided a new solution for network equipment to achieve network security. A mimic defense system usually consists of an input agent, a heterogeneous executive pool, an arbiter, and a scheduler. The input agent copies and distributes external messages to various heterogeneous executives, and the input agent does not monitor whether the heterogeneous executives fail; heterogeneous executives are usually implemented by operating systems or hardware modules with equivalent functions; the arbiter receives The message sent by the heterogeneous executive body judges whether the heterogeneous executive body is attacked by means of "large number judgment"; the scheduler cooperates with the threat info...

AI Technical Summary

Problems solved by technology

Although this judgment method can quickly detect external attacks, it is difficult to judge that due to the failure of the heterogeneous executive body itself, the arbiter misjudges the external attack, which leads to the low efficiency of the arbiter.

Images