Attack defense device and method based on mimicry defense, equipment and medium

Abstract

The invention discloses an attack defense device and method based on mimicry defense, equipment and a medium. The device comprises a mimicry scheduler and a plurality of heterogeneous executors; the heterogeneous executive receives and processes the message data sent by the mimicry scheduler; the mimicry scheduler comprises a mimicry judgment module and an attack defense module and is used for receiving message data sent by the front-end chip and forwarding the message data to the heterogeneous executor to realize data distribution, mimicry judgment and cleaning management of the heterogeneous executor; the mimicry judgment module performs mimicry judgment on downlink data of the heterogeneous executor and sends a mimicry judgment result to the attack defense module; and the attack defense module performs acquisition, extraction and log storage on the message data sent by the front-end chip, and performs log updating, attack defense detection and attack data filtering according to a mimicry judgment result of the mimicry judgment module. According to the invention, attack detection judgment is carried out on the message data and the abnormal message data is effectively filtered, so that the isomer executor cleaning frequency is reduced.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an attack defense device, method, equipment and medium based on mimicry defense. Background technique [0002] The current cyberspace is in a security situation of "easy to attack but difficult to defend". How to improve the security of cyberspace is one of the most severe challenges in the current information age. Mimic defense technology is an endogenous security theory with a dynamic heterogeneous redundant structure as the core, which can prevent security threats based on unknown and known vulnerability backdoors, and greatly enhances the ability of critical business networks to deal with external intrusion and internal penetration. [0003] The mimic product is based on the existing network equipment, integrates the mimic defense technology, introduces multiple heterogeneous processing engines as heterogeneous executives in its architecture, and includes a ...

AI Technical Summary

Problems solved by technology

However, if the mimic scheduler sends the same attack message to the heterogeneous executable again, the heterogeneous executable will still appear abnormal again after receiving it, resulting in the heterogeneous executable being in an unavailable state all the time. Greatly reduces the advantages of heterogeneous redundancy and affects the overall stability of the system

Images