A network flexible defense architecture optimization method, electronic device and storage medium

Abstract

The present invention provides a network flexible defense architecture optimization method, electronic device and storage medium, the method comprising: S1, obtaining device information of a unified management and control platform device, a controller device, a security device and a controlled device at each level and an implementation path diagram of all security services; S2, forming an ideal defense architecture matrix group based on the direct connection relationship of the devices in the implementation path diagram of all security services, the ideal defense architecture matrix group comprising 3 ideal inter-level architecture matrices and 3 ideal intra-level architecture matrices, and the element values ​​in the architecture matrix represent the direct connection relationship between the devices; S3, generating a plurality of candidate defense architecture matrix groups to form a candidate population; the candidate defense architecture matrix group comprising 3 candidate inter-level architecture matrices and 3 candidate intra-level architecture matrices; S4, taking the business path coverage, average path length and architecture complexity of the candidate defense architecture matrix group as the objective function, iterating the candidate population based on a genetic algorithm to optimize the candidate defense architecture matrix group.

Description

Technical Field

[0001] The present invention relates to the field of flexible defense, and in particular to a network flexible defense architecture optimization method, electronic equipment and storage medium. Background Art

[0002] Flexibility refers to the ability of a system to flexibly respond to and actively adapt to environmental changes. It was first proposed by economists to study issues such as organizational restructuring, factor relationship optimization, and variable fluctuation characteristics. With the development of network technology, flexibility is also applied to the field of network technology. By building a flexible network architecture that can adapt to changing environments and can be dynamically adjusted and optimized according to actual needs, the flexibility and variability of the network can be improved.

[0003] Diversified and complex network intrusion attacks are becoming more and more frequent. Traditional security defense architectures with relatively fixed configurations and connections cannot cope with them step by step. Flexible defense architectures are needed to improve the anti-destruction and reconstruction capabilities of network systems. Flexible defense architectures are actually based on the physical connection architecture of devices. Through software-defined network technology, the actual connectivity of physical connections between devices is controlled, so as to achieve dynamic adjustment and optimization of the defense architecture. Therefore, due to factors such as resource allocation and architecture design, excessive flexibility of the defense architecture will lead to problems such as overly complex architectures and low efficiency of security business flow, while too low flexibility will lead to rigid defense architectures and ineffective response to network security risks. The optimization of defense architectures is to solve the problem of balancing architecture flexibility with complexity and efficiency.

[0004] The existing network architecture flexibility optimization scheme is usually: construct the adjacency relationship of all nodes in the network system into a large adjacency matrix, and then iterate the probability change of each element value in the adjacency matrix through the optimization algorithm such as ant algorithm, wolf pack algorithm, genetic algorithm, etc., to find the optimal adjacency matrix of multiple objectives such as flexibility and other balance parameters, that is, determine the adjacency relationship of all nodes in the network system, and then obtain the optimized flexible network architecture. However, most of the actual security defense architecture adopts a centralized and distributed control design, that is, at least includes a centralized control platform, each discrete control device, and each controlled device unit step by step, and there is no direct connection between the devices at the next level. For this kind of defense architecture with a decentralized control mode connected step by step, the existing scheme of constructing the adjacency matrix of all nodes in the system will result in a large number of meaningless elements in the adjacency matrix, which will cause the optimization algorithm to perform a large number of useless calculations, affecting the optimization efficiency of the defense architecture. In addition, it may also cause many wrong cross-level connection relationships in the final optimized adjacency matrix, and the defense architecture optimization cannot be achieved. Summary of the invention

[0005] The purpose of the present invention is to solve the above-mentioned problems of the prior art, and to provide a network flexible defense architecture optimization method, electronic device and storage medium, which perform flexible and other multi-objective optimization based on the inter-level architecture matrix and intra-level architecture matrix constructed in accordance with the distributed control defense architecture system, avoiding a large number of elements in the matrix that represent invalid cross-level connection relationships, so as to improve the optimization efficiency and optimization accuracy of the defense architecture.

[0006] In a first aspect, the present invention provides a method for optimizing a network flexible defense architecture, the method comprising:

[0007] S1, obtaining device information of the unified control platform device, controller device, security device, and controlled device at each level and an implementation path map of all security services, wherein the implementation path map of the security service includes all optional device path chains that can complete the security service;

[0008] S2, based on the direct connection relationship of the devices in the implementation path diagram of all security services, an ideal defense architecture matrix group is formed, and the ideal defense architecture matrix group includes 3 ideal inter-level architecture matrices and 3 ideal intra-level architecture matrices. When the element value of the xth row and yth column in the inter-level architecture matrix is ​​1, it means that the inter-level architecture matrix corresponds to a device with a device identifier x in one level and a device with a device identifier y in another level of two levels, and vice versa when it is 0; when the element value of the xth row and yth column in the intra-level architecture matrix is ​​1, it means that the device with a device identifier x in the level corresponding to the intra-level architecture matrix is ​​directly connected to the device with a device identifier y, and vice versa when it is 0;

[0009] S3, generating a number of candidate defense architecture matrix groups to form a candidate population; the candidate defense architecture matrix groups include 3 candidate inter-level architecture matrices and 3 candidate intra-level architecture matrices;

[0010] S4, taking the business path coverage and architecture complexity of the candidate defense architecture matrix group as the objective function, the candidate population is iterated based on the genetic algorithm to optimize the candidate defense architecture matrix group.

[0011] Preferably, the service path coverage of the candidate defense architecture matrix group is the average of the similarities between the candidate inter-level architecture matrices and the candidate intra-level architecture matrices therein and the corresponding ideal inter-level architecture matrices and the ideal intra-level architecture matrices.

[0012] Preferably, the similarity between the candidate inter-stage architecture matrix and the candidate intra-stage architecture matrix and the corresponding ideal inter-stage architecture matrix and the ideal intra-stage architecture matrix is ​​the Euclidean distance therebetween.

[0013] Preferably, the architectural complexity of the candidate defense architecture matrix group is the sum of the element values ​​of all candidate inter-level architecture matrices and candidate intra-level architecture matrices therein.

[0014] Preferably, in S4, the average path length of the candidate defense architecture matrix group is also used as the objective function.

[0015] Preferably, the method for determining the average path length of the candidate defense architecture matrix group is: calculating the average path length of each candidate inter-level architecture matrix and candidate intra-level architecture matrix in the candidate defense architecture matrix group, adding the average path lengths of all candidate inter-level architecture matrices and candidate intra-level architecture matrices in the candidate defense architecture matrix group, and obtaining the average path length of the candidate defense architecture matrix group.

[0016] Preferably, the method for determining the average path length of the architecture matrix within the candidate level includes:

[0017] S41, find the set of elements whose internal values ​​are 1 on one side of the main diagonal of the candidate-level internal architecture matrix and the number n;

[0018] S42, find all element groups with a characterization path length of k|k∈(1,2,…,n-1) in the element set, wherein a single element group with a characterization path length of k contains k elements; in the single element group with a characterization path length of k=2, the number of rows or columns of one element is the same as the number of rows or columns of another element; the k elements in the single element group with a characterization path length of k≥3 can be sorted according to a set rule, and the sorting rule is that the number of rows of the element in the middle is the same as the number of rows or columns of an adjacent element, and the number of columns is the same as the number of rows or columns of another adjacent element;

[0019] S43, based on the formula Calculate the average path length of the architecture matrix within the candidate level, where m(k) represents the number of element groups representing path length k;

[0020] The average path length of the candidate inter-stage architecture matrix is ​​1.

[0021] Preferably, generating a plurality of candidate defense architecture matrix groups in S3 includes:

[0022] S31, selecting at least one device path chain from the device path chains of each security service, and forming a single candidate defense architecture matrix group based on all the selected device path chains;

[0023] S32, repeat S31 several times to generate several candidate defense architecture matrix groups.

[0024] In a second aspect, the present invention provides an electronic device, including a memory, a computer program stored thereon, and a processor, wherein the processor implements the above-mentioned network flexible defense architecture optimization method when executing the computer program.

[0025] In a third aspect, the present invention provides a storage medium storing computer executable instructions, which, when loaded and executed by a processor, implement the above-mentioned network flexible defense architecture optimization method.

[0026] In summary, the present invention has the following beneficial effects: based on the inter-level architecture matrix and the intra-level architecture matrix constructed in accordance with the distributed control defense architecture system, multi-objective optimization such as flexibility is performed to avoid a large number of elements in the matrix that represent invalid cross-level connection relationships, so as to improve the optimization efficiency and accuracy of the defense architecture. In addition, an ideal defense architecture matrix group is constructed based on the implementation path diagram of the security business, and the mean similarity between the candidate architecture matrix and the ideal architecture matrix is ​​used as the business path coverage, and this is used as the objective function to characterize the flexibility of the defense architecture, so that the optimized flexible defense architecture is more in line with actual business needs.

[0027] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A schematic diagram of a flow chart of an embodiment of the present application.

[0030] Figure 2 This is a schematic diagram of the distributed control and defense architecture of an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages disclosed in the embodiments of the present invention clearer, the embodiments of the present invention are further described in detail in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present invention and are not intended to limit the embodiments of the present invention. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions.

[0032] It should be noted that the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products or devices.

[0033] The existing network architecture flexibility optimization scheme is usually to build the adjacency relationship of all nodes in the network system into a large adjacency matrix, and then iterate the probability of changing the value of each element in the adjacency matrix through optimization algorithms such as ant algorithm, wolf pack algorithm, genetic algorithm, etc., to find the optimal adjacency matrix for multiple objectives such as flexibility and other balance parameters, that is, to determine the adjacency relationship of all nodes in the network system, and then obtain the optimized flexible network architecture. Figure 2 As shown in the figure, most of the actual security defense architecture adopts a centralized and distributed control design, which means that at least the centralized control platform, each discrete control device, and each controlled device unit are included step by step, and there is no direct connection between the devices at the next level. For this type of defense architecture with a decentralized control mode that is connected step by step, the existing solution of building the adjacency matrix of all nodes in the system will result in a large number of meaningless elements in the adjacency matrix, which will cause the optimization algorithm to perform a large number of useless calculations, affecting the optimization efficiency of the defense architecture. In addition, it may also cause the final optimized adjacency matrix to have many incorrect cross-level connection relationships, making it impossible to optimize the defense architecture.

[0034] To solve the above problems, an embodiment of the present application provides a network flexible defense architecture optimization method, which performs flexible and other multi-objective optimization based on the inter-level architecture matrix and intra-level architecture matrix constructed in accordance with the distributed control defense architecture system, avoiding a large number of elements in the matrix that represent invalid cross-level connection relationships, so as to improve the optimization efficiency and accuracy of the defense architecture.

[0035] Specifically, Figure 1 As shown, the method includes S1, obtaining the equipment information of the unified management and control platform equipment, controller equipment, security equipment, and controlled equipment at each level and an implementation path map of all security services. The implementation path map of the security services includes all optional equipment path chains that can complete the security services.

[0036] In this step, the controller device may include a host controller, a core controller, a network controller, etc., the security device may include a firewall, an intrusion detection device, a bastion host, an edge gateway, etc., and the controlled device may include a user host and a server, etc. The device information includes the level identifier and the device identifier within the level. The level identifier may be identified by a number 1-4 corresponding to the number of levels. Similarly, the device identifier within the level may be identified by a number corresponding to the number of devices within the level. The xth device within the i|i∈(1,2,3,4)th level may be represented as Vi,x .

[0037] like Figure 1 As shown, the method of the present application also includes S2, forming an ideal defense architecture matrix group based on the direct connection relationship of the devices in the implementation path diagram of all security services, the ideal defense architecture matrix group includes 3 ideal inter-level architecture matrices and 3 ideal intra-level architecture matrices, when the element value of the xth row and yth column in the inter-level architecture matrix is ​​1, it means that the inter-level architecture matrix corresponds to a device with a device identification x in one level of the two levels and a device with a device identification y in the other level, and vice versa when it is 0; when the element value of the xth row and yth column in the intra-level architecture matrix is ​​1, it means that the device with a device identification x in the level corresponding to the intra-level architecture matrix is ​​directly connected to the device with a device identification y, and vice versa when it is 0.

[0038] It is understandable that the centralized and distributed control defense architecture system sets up a unified control platform device, so the three ideal intra-level architecture matrices correspond to the controller device level, the security device level, and the controlled device level, and the three ideal inter-level architecture matrices correspond to the unified control platform device level and the controller device level, the controller device level and the security device level, and the security device level and the controlled device level. j represents the ideal level intra-architecture matrix corresponding to the j|j∈(2,3,4)th level. For example, IA2 represents the ideal level intra-architecture matrix corresponding to the controller device level. The element IA2(x,y) in the matrix represents the device V in the controller device level. 2,x With device V 2,y Direct connection relationship. Available IB i,j represents the ideal inter-stage architecture matrix corresponding to the i|i<j and i∈(1,2,3,4)th stage and the j|j∈(2,3,4)th stage, such as IB 1,2 It represents the ideal inter-level architecture matrix corresponding to the unified control platform device level and the controller device level. The elements IB in the matrix 1,2 (x,y) represents the device V in the unified control platform device level 1,x Device V in the controller device level 2,y Direct connection relationship.

[0039] like Figure 1 As shown, the method of the present application also includes S3, generating a plurality of candidate defense architecture matrix groups to form a candidate population; the candidate defense architecture matrix group includes 3 candidate inter-level architecture matrices and 3 candidate intra-level architecture matrices. Similarly, the 3 candidate intra-level architecture matrices correspond to the controller device level, the security device level, and the controlled device level, respectively, and the 3 candidate inter-level architecture matrices correspond to the unified control platform device level and the controller device level, the controller device level and the security device level, and the security device level and the controlled device level, respectively. Available CA j represents the candidate level intra-architecture matrix corresponding to level j|j∈(2,3,4), CB i,jRepresents the candidate inter-level architecture matrix corresponding to the i|i<j and i∈(1,2,3,4)th level and the j|j∈(2,3,4)th level.

[0040] The element values ​​of the candidate inter-level architecture matrix and the candidate intra-level architecture matrix in the plurality of candidate defense architecture matrix groups in S3 may be randomly initialized. In some embodiments of the present application, the generating of the plurality of candidate defense architecture matrix groups in S3 includes:

[0041] S31, selecting at least one device path chain from the device path chains of each security service, and forming a single candidate defense architecture matrix group based on all the selected device path chains;

[0042] S32, repeat S31 several times to generate several candidate defense architecture matrix groups.

[0043] Compared with the traditional method of randomly generating candidate populations, this embodiment selects at least one device path chain from the device path chains of each security service and forms a single initial defense architecture matrix group based on all selected device path chains. This can optimize the initial objective function value of the candidate defense architecture matrix group in the candidate population, thereby helping to reduce the number of algorithm iterations and improve optimization efficiency.

[0044] The method of the present application also includes S4, taking the business path coverage and architecture complexity of the candidate defense architecture matrix group as the objective function, and optimizing the candidate defense architecture matrix group by iteratively optimizing the candidate population based on a genetic algorithm.

[0045] The higher the service path coverage of the defense architecture, the better the variability and flexibility of its service implementation path. Taking it as an objective function can characterize the flexibility of the defense architecture. In some embodiments of the present application, the service path coverage of the candidate defense architecture matrix group is the mean of the similarities between the candidate inter-level architecture matrix and the candidate intra-level architecture matrix and the corresponding ideal inter-level architecture matrix and the ideal intra-level architecture matrix, and the similarities between the candidate inter-level architecture matrix and the candidate intra-level architecture matrix and the corresponding ideal inter-level architecture matrix and the ideal intra-level architecture matrix are the Euclidean distances between them. In some embodiments of the present application, the cosine similarity, Manhattan distance, Jaccard similarity coefficient, Pearson correlation coefficient, etc. can also be used to determine the similarities between the candidate inter-level architecture matrix and the candidate intra-level architecture matrix and the corresponding ideal inter-level architecture matrix and the ideal intra-level architecture matrix.

[0046] The embodiment of the present application constructs an ideal defense architecture matrix group based on the implementation path diagram of the security business, takes the mean similarity between the candidate architecture matrix and the ideal architecture matrix as the business path coverage, and uses this as the objective function to characterize the flexibility of the defense architecture, so that the optimized flexible defense architecture is more in line with actual business needs.

[0047] The more connections a defense architecture has, the more complex the defense architecture is. Therefore, in some embodiments of the present application, the architecture complexity of the candidate defense architecture matrix group is the sum of the element values ​​of all candidate inter-level architecture matrices and candidate intra-level architecture matrices therein, that is, the number of direct connections between all devices.

[0048] In addition to service path coverage and architecture complexity, service efficiency is also an indicator that needs to be balanced when optimizing defense architecture. The longer the service implementation path, the lower the service efficiency. Conversely, the shorter the service implementation path, the higher the service efficiency. Figure 1 As shown, in some embodiments of the present application, the average path length of the candidate defense architecture matrix group is also used as the objective function in S4.

[0049] In some embodiments of the present application, the method for determining the average path length of the candidate defense architecture matrix group is: calculating the average path length of each candidate inter-level architecture matrix and candidate intra-level architecture matrix in the candidate defense architecture matrix group, adding the average path lengths of all candidate inter-level architecture matrices and candidate intra-level architecture matrices in the candidate defense architecture matrix group, and obtaining the average path length of the candidate defense architecture matrix group. It can be understood that, if Figure 2 As shown, there must be a directly connected device between the two levels in the distributed control defense architecture. After the business is transferred to the devices within the level, it can be transferred to the next level through the direct connection between the levels. Therefore, the average path length of the candidate inter-level architecture matrix is ​​1.

[0050] In some embodiments of the present application, the average path length of the candidate intra-level architecture matrix can be determined by the average of the path lengths between all two devices in the corresponding level. Corresponding to the candidate intra-level architecture matrix, the specific determination method includes S41, finding the set of elements with a value of 1 on one side of the main diagonal of the candidate intra-level architecture matrix and the number n; it can be understood that in the candidate intra-level architecture matrix, the elements with the same number of rows and columns represent the direct connection relationship between a single device in the level and itself, and are fixed to 0. The direct connection relationship between the intra-level devices represented on both sides of the main diagonal of the candidate intra-level architecture matrix is ​​repeated and redundant, so it is only necessary to select the elements with a value of 1 on either side of the main diagonal of the candidate intra-level architecture matrix.

[0051] S42, find all element groups with a representation path length of k|k∈(1,2,…,n-1) in the element set, a single element group with a representation path length of k contains k elements; in the single element group with a representation path length of k=2, the number of rows or columns of one element is the same as the number of rows or columns of another element; the k elements in the single element group with a representation path length of k≥3 can be sorted according to the set rules, and the sorting rule is that the number of rows of the element in the middle is the same as the number of rows or columns of an adjacent element, and the number of columns is the same as the number of rows or columns of another adjacent element.

[0052] Assume that the candidate intra-level architecture matrix corresponding to level 2 is , indicating that devices 1 and 2, devices 1 and 3, devices 2 and 4, and devices 3 and 4 are directly connected within the level. The set of elements with a value of 1 on one side of the main diagonal is {CB2(1,2), CB2(1,3), CB2(2,4), CB2(3,4)}. There are four groups of elements representing a path length of 1, namely CB2(1,2), CB2(1,3), CB2(2,4), and CB2(3,4), which represent four direct paths: device 1-device 2, device 1-device 3, device 2-device 4, and device 3-device 4. The groups of elements representing a path length of 2 are {CB2(1,2), CB2(1,3)}, {CB2(1,2), CB2(2,4)}, and {CB2(1,3), CB2(3,4)}, which represent three paths of length 2: device 2-device 1-device 3, device 1-device 2-device 4, and device 1-device 3-device 4. The groups of elements representing a path length of 3 are {CB2(1,2), CB2(1,3), CB2(3,4)}, {CB2(1,3), CB2(1,2), CB2(2,4)}, {CB2(1,3), CB2(3,4), CB2(2,4)}, {CB2(1,2), CB2(2,4), CB2(3,4)}, i.e. representing four paths of length 3: device 2-device 1-device 3-device 4, device 3-device 1-device 2-device 4, device 1-device 3-device 4-device 2, device 1-device 2-device 4-device 3.

[0053] S43, based on the formula The average path length of the architecture matrix within the candidate level is calculated, and m(k) represents the number of element groups representing the path length k.

[0054] In step S4, the objective function of the candidate defense architecture matrix group can be normalized, and the weight values ​​can be set and added as the comprehensive performance of the candidate defense architecture matrix group, and the comprehensive performance of the candidate population can be optimized based on the genetic algorithm. It can be understood that the weight needs to be set positive or negative according to whether the higher the objective function is, the better or the lower the better.

[0055] Optimizing the comprehensive performance of the candidate population based on the genetic algorithm may include: performing elite selection or proportional selection on the candidate population based on the comprehensive performance, performing crossover mutation operations on the selected matrix groups, and calculating the comprehensive performance of each matrix group in the new generation of candidate population; iterating in sequence, and ending when the comprehensive performance of the optimal matrix group for several consecutive generations remains unchanged or the number of iterations reaches a set number; selecting a candidate defense architecture matrix group from the candidate population as needed, and optimizing the network flexible defense architecture based on it. In some embodiments of the present application, the candidate defense architecture matrix group with the best comprehensive performance in the candidate population can be selected, and a comprehensive performance threshold can also be set. Among the candidate defense architecture matrix groups that meet the comprehensive performance threshold, the candidate defense architecture matrix group with the best priority objective function is selected according to the set objective function priority.

[0056] The embodiment of the present application also provides an electronic device, including a memory and a processor, and the memory and the processor can be connected via a bus or other means. The memory can be used to store software programs, computer programs and modules, such as the program / module corresponding to the above-mentioned network flexible defense architecture optimization method; the processor implements the above-mentioned network flexible defense architecture optimization method by executing the computer program and module in the memory.

[0057] The processor may be a central processing unit, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, etc., and the memory may be a high-speed random access memory, a non-volatile memory, etc.

[0058] The embodiment of the present application also provides a storage medium, wherein the storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by the processor, the above-mentioned network flexible defense architecture optimization method is implemented. The storage medium can be a combination of one or more of a magnetic disk, an optical disk, a read-only storage memory, a random access storage memory, a flash memory, a hard disk, etc.

[0059] It should be noted that the sequence of the above embodiments of the present invention is for description only and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of this specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0060] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0061] Those skilled in the art will appreciate that all or part of the steps of the above embodiments can be accomplished by hardware, or by programs instructing the relevant hardware to accomplish the steps. The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network flexible defense architecture optimization method, characterized in that: include: S1, obtaining device information of the unified control platform device, controller device, security device, and controlled device at each level and an implementation path map of all security services, wherein the implementation path map of the security service includes all optional device path chains that can complete the security service; S2, based on the direct connection relationship of the devices in the implementation path diagram of all security services, an ideal defense architecture matrix group is formed, and the ideal defense architecture matrix group includes 3 ideal inter-level architecture matrices and 3 ideal intra-level architecture matrices. When the element value of the xth row and yth column in the inter-level architecture matrix is ​​1, it means that the inter-level architecture matrix corresponds to a device with a device identifier x in one level and a device with a device identifier y in another level of two levels, and vice versa when it is 0; when the element value of the xth row and yth column in the intra-level architecture matrix is ​​1, it means that the device with a device identifier x in the level corresponding to the intra-level architecture matrix is ​​directly connected to the device with a device identifier y, and vice versa when it is 0; S3, generating several candidate defense architecture matrix groups to form a candidate population; The candidate defense architecture matrix group includes 3 candidate inter-level architecture matrices and 3 candidate intra-level architecture matrices; S4, taking the business path coverage and architecture complexity of the candidate defense architecture matrix group as the objective function, the candidate population is iterated based on the genetic algorithm to optimize the candidate defense architecture matrix group; the business path coverage of the candidate defense architecture matrix group is the mean of the similarities between the candidate inter-level architecture matrix and the candidate intra-level architecture matrix and the corresponding ideal inter-level architecture matrix and the ideal intra-level architecture matrix, and the similarities between the candidate inter-level architecture matrix and the candidate intra-level architecture matrix and the corresponding ideal inter-level architecture matrix and the ideal intra-level architecture matrix are the Euclidean distances therebetween; the architecture complexity of the candidate defense architecture matrix group is the sum of the element values ​​of all candidate inter-level architecture matrices and candidate intra-level architecture matrices therein.

2. A method for optimizing a network flexible defense architecture according to claim 1, characterized in that: The candidate defense architecture matrix groups generated in S3 include: S31, selecting at least one device path chain from the device path chains of each security service, and forming a single candidate defense architecture matrix group based on all the selected device path chains; S32, repeat S31 several times to generate several candidate defense architecture matrix groups.

3. A method for optimizing a network flexible defense architecture according to claim 1, characterized in that: In S4, the average path length of the candidate defense architecture matrix group is also used as the objective function.

4. A method for optimizing a network flexible defense architecture according to claim 3, characterized in that: The method for determining the average path length of the candidate defense architecture matrix group is as follows: calculating the average path length of each candidate inter-level architecture matrix and candidate intra-level architecture matrix in the candidate defense architecture matrix group, adding the average path lengths of all candidate inter-level architecture matrices and candidate intra-level architecture matrices in the candidate defense architecture matrix group, and obtaining the average path length of the candidate defense architecture matrix group.

5. A method for optimizing a network flexible defense architecture according to claim 4, characterized in that: The method for determining the average path length of the architecture matrix within the candidate level includes: S41, find the set of elements whose internal values ​​are 1 on one side of the main diagonal of the candidate-level internal architecture matrix and the number n; S42, find all element groups with a characterization path length of k|k∈(1,2,…,n-1) in the element set, wherein a single element group with a characterization path length of k contains k elements; in the single element group with a characterization path length of k=2, the number of rows or columns of one element is the same as the number of rows or columns of another element; the k elements in the single element group with a characterization path length of k≥3 can be sorted according to a set rule, and the sorting rule is that the number of rows of the element in the middle is the same as the number of rows or columns of an adjacent element, and the number of columns is the same as the number of rows or columns of another adjacent element; S43, based on the formula Calculate the average path length of the architecture matrix within the candidate level, where m(k) represents the number of element groups representing a path length of k; The average path length of the candidate inter-stage architecture matrix is ​​1.

6. An electronic device comprising a memory and a computer program and a processor stored thereon, characterized in that: When the processor executes the computer program, the method for optimizing a network flexible defense architecture as described in any one of claims 1 to 3 is implemented.

7. A storage medium, characterized in that The storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by the processor, a network flexible defense architecture optimization method as described in any one of claims 1 to 3 is implemented.

Images