信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (6): 988-1002.doi: 10.3969/j.issn.1671-1122.2025.06.013

• 专题论文: 网络主动防御 • 上一篇    下一篇

拟态函数：面向无服务器的拟态防御研究

傅则凡, 潘高宁(), 任一支, 胡铭德   

  1. 杭州电子科技大学网络空间安全学院，杭州 310018
  • 收稿日期:2025-02-28 出版日期:2025-06-10 发布日期:2025-07-11
  • 通讯作者: 潘高宁 E-mail:pgn@hdu.edu.cn
  • 作者简介:傅则凡（2000—），男，浙江，硕士研究生，主要研究方向为云计算安全|潘高宁（1996—），男，浙江，教授，博士，CCF会员，主要研究方向为云系统安全、软件漏洞挖掘、自动化攻防|任一支（1981—），男，安徽，教授，博士，CCF会员，主要研究方向为数据安全和人工智能安全|胡铭德（1977—），男，浙江，研究员，本科，主要研究方向为4/5G通信安全、漏洞挖掘。
  • 基金资助:
    国家自然科学基金(62402147)

Mimetic Function: Mimetic Defense Research for Serverless

FU Zefan, PAN Gaoning(), REN Yizhi, HU Mingde   

  1. School of Cyberspace, Hangzhou Dianzi University, Hangzhou 310018, China
  • Received:2025-02-28 Online:2025-06-10 Published:2025-07-11
  • Contact: PAN Gaoning E-mail:pgn@hdu.edu.cn

RichHTML

4

PDF (PC)

19

摘要：

虽然无服务器架构通过事件驱动和全托管模式降低了云计算的开发与运维成本，但其程序离散化、输入多源化和依赖复杂化的特性引发的安全威胁使传统防御机制难以应对。拟态防御虽能有效阻断漏洞利用链，但其异构策略在无服务器环境下存在局限性，与无服务器函数应用机制不适配，导致实际部署困难。文章针对无服务器环境的安全挑战，提出一种面向无服务器的拟态防御方案——拟态函数。文章通过分析拟态防御框架下的异构条件，设计面向无服务器架构的异构策略，构造基于无服务器的拟态防御原型系统，实现对面向无服务器的未知漏洞利用的拦截阻断；进而，为了避免拟态防御场景下的拒绝钱包攻击（DoW）放大问题，文章通过对异构执行体调度算法的设计，缓解高并发流量对异构执行体调度不均衡的影响，实现系统异构性与性能的平衡。实验结果表明，拟态函数原型系统能够有效抵御面向无服务器的未知攻击，并且能够有效控制异构执行体离散度。

关键词: 无服务器, 拟态防御, 云原生

Abstract:

Serverless architecture reduces cloud computing development and operational costs through its event-driven and fully managed model. However, the inherent security threats arising from program fragmentation, multi-source inputs, and complex dependency chains pose significant challenges to traditional defense mechanisms. While mimic defense can effectively block vulnerability exploitation chains, its heterogeneity strategies exhibit limitations in serverless environments due to incompatibility with serverless function ap- plication mechanisms, resulting in deployment difficulties. To address the security challenges in serverless environments, this paper proposed a serverless-oriented mimic defense scheme—mimic function. By analyzing heterogeneity conditions under the mimic defense framework, we designed a tailored heterogeneity strategy for serverless architectures and con- structed a prototype system to intercept unknown vulnerability exploits targeting serverless platforms. Furthermore, to mitigate the amplification of Denial-of-Wallet (DoW) attacks in mimic defense scenarios, we proposed a heterogeneous executor scheduling algorithm that alleviated the impact of high-concurrency traffic on load imbalance among executors, achieving a balance between system heterogeneity and performance. Experimental results demonstrate that the mimic function prototype system effectively defends against unknown serverless-targeted attacks while maintaining controlled dispersion of heterogeneous executors.

Key words: serverless, mimetic defense, cloud native

中图分类号: