A Function-Aware Mimic Defense Theory and Its Practice

In recent years,network attacks have been characterized by diversification and scale,which indicates a requirement for defense strategies to sacrifice generalizability for higher security.As the latest theoretical achievement in active defense,mimic defense demonstrates high robustness against complex attacks.This study proposes a Function-aware,Bayesian adjudication,and Adaptive updating Mimic Defense(FBAMD)theory for addressing the current problems of existing work including limited ability to resist unknown threats,imprecise heterogeneous metrics,and over-reliance on relatively-correct axiom.FBAMD incorporates three critical steps.Firstly,the common features of executors’vulnerabilities are obtained from the perspective of the functional implementation(i.e,input-output relationships extraction).Secondly,a new adjudication mechanism considering Bayes’theory is proposed by leveraging the advantages of both current results and historical confidence.Furthermore,posterior confidence can be updated regularly with prior adjudication information,which provides mimic system adaptability.The experimental analysis shows that FBAMD exhibits the best performance in the face of different types of attacks compared to the state-of-the-art over real-world datasets.This study presents a promising step toward the theo-retical innovation of mimic defense.