关键词: 拟态防御, 裁决算法, 异常检测, 高阶异构度, 历史置信度

Abstract: In mimic defense system,the security of mimic voter directly affects the system defensive capability.Existing mimic voting algorithms typically either rely on anomaly detection to enhance the perception of error outputs of executors,or depend on heterogeneity or historical confidence to quantify the reliability of executor outputs,which leads to inexact voting output with higher-order common-mode vulnerabilities in dynamic network environments.To address above problem,this paper proposes a multivariable mimic voting based on anomaly perception.Because existing anomaly detection models always focuse on temporal or spatial information,a spatiotemporal anomaly perception model is constructed to more precisely capture the spatiotemporal cha-racteristics of executor output.Simultaneously,with the consideration of decision misjudgment caused by higher-order common-mode vulnerabilities and structural reasons of executors,higher-order heterogeneity and historical confidence are integrated with data consistency to improve the reliability of the voting results.Ultimately,an adaptive optimization strategy is desigened to adjust weight metrics to yield the optimal weighted outcome.Experimental results show that the proposed algorithm achieves an average accuracy of 98.77% on CICIDS and UNSW-NB15 datasets.Especially,a significant improvement of average about 2% over traditional algorithms on UNSW-NB15,demonstrating better stability and generalizability.

Key words: Mimic defense, Voting algorithm, Anomaly detection, Higher-order heterogeneity, Historical confidence