Node zero-trust trusted access method for computing power network

Abstract

The invention discloses a node zero-trust trusted access method and device for a computing power network, and relates to the technical field of network security. And based on a zero-trust principle, credibility evaluation is carried out in a registration stage and a task execution stage of the computing power node. In the registration stage, a multi-source trust modeling mechanism fusing identity attributes, capability observation and organization reputation is constructed, and a Bayesian reasoning and graph regularization method is introduced to realize initial trust evaluation; in the operation stage, a multi-modal log anomaly detection method is designed, high-dimensional behavior modeling is carried out in combination with semantics, time, parameters and quantity characteristics, and the anomaly recognition capability is enhanced by utilizing long sequence dependence; and a dynamic trust adjustment strategy is provided by further combining time decay and a user feedback mechanism, so that continuous evolution and refined access control of node trust are realized. According to the method and the system, trusted access of the computing power nodes is realized by the scheduling system in the environment of the computing power network, and the safety and the reliability of the computing power network system are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a zero-trust trusted access method for nodes in a computing power network. Background Art

[0002] With the booming growth of various compute-intensive businesses and the large-scale application of AI across various industries, the demand for computing power resources is growing. Computing networks, as innovative solutions for resource integration and network collaboration, are becoming a crucial component of future digital infrastructure. By efficiently connecting distributed computing, storage, and other resources, computing networks not only improve resource utilization efficiency but also provide flexible and optimized computing services for diverse business scenarios. Computing networks distribute information about computing power, storage, algorithms, and other resources across the network. By integrating network information, they provide optimal resource allocation and network connectivity solutions tailored to user needs, thereby optimizing the use of resources across the entire network. The rapid development of computing networks also presents new security challenges. These challenges primarily stem from the new features brought about by computing power interconnection and computing-network convergence, which expand the attack surface. Changes in network architecture and the introduction of new network elements also increase security risks, leading to increased management complexity and operational risks. Security risks during node access and task execution are becoming increasingly significant issues impacting network stability and reliability.

[0003] Existing research mainly focuses on the security of the node access stage, usually ensuring the legitimacy of the access node through identity authentication. However, this approach ignores the dynamic behavior of the node during operation and its impact on the overall security of the system. However, in the complex context of the computing power network, as the node continues to operate in the network, a single evaluation cannot fully reflect the changes in the long-term behavior of the node. To this end, the present invention introduces the zero trust principle, which not only focuses on security at the time of access, but also realizes continuous monitoring and real-time evaluation of node behavior. Through this mechanism, the computing power network can promptly detect malicious nodes or abnormal behavior and improve overall security. The zero trust architecture requires real-time trusted evaluation of the node behavior during task execution to prevent potential security threats from persisting in the network.

[0004] In a computing network, the trustworthiness of node behavior is not only a crucial indicator of network health but also a crucial component in ensuring network security. "Behavior" here refers to the operations and states exhibited by nodes while executing computing tasks, processing data, and making resource requests. For example, a node's trustworthiness can be assessed based on its stability (e.g., whether tasks are successfully completed), resource usage (e.g., whether memory and CPU usage exceed expectations), response time (e.g., whether task requests are promptly responded to), and the presence of abnormal operations (e.g., unauthorized resource access or frequent task failures). Node behavior can change significantly with changes in workload, dynamic adjustments to network topology, and external environmental interference, and a single assessment cannot capture these changes in a timely manner. To address this issue, this paper proposes a dynamic and continuous node trusted access solution based on the principle of zero trust. In a zero trust architecture, no node is assumed to remain trustworthy after joining the network. Instead, the behavior of each node is continuously monitored and evaluated in real time. This means that, regardless of a node's access status, every interaction with the network and every task executed must undergo a trustworthiness assessment to ensure that the node consistently meets security requirements.

[0005] Logs generated during node operation record detailed node status and key events, serving as the primary basis for assessing the trustworthiness of node behavior. Traditional log anomaly detection methods analyze anomalous patterns in logs to identify potential node behavior issues. While these methods are effective to a certain extent, they remain limited in comprehensively assessing the trustworthiness of node behavior. Log anomalies are only part of the equation when assessing node trustworthiness. More multidimensional behavioral characteristics (such as resource consumption, task execution quality, and user feedback) need to be incorporated into trustworthiness assessments to achieve more comprehensive and accurate results.

[0006] When it comes to log anomaly detection, traditional methods rely on manual processing, which is clearly no longer feasible for the ever-increasing volume of log data in computing network environments. With the rapid development of computing networks, the continuous expansion of system scale, and the widespread application of distributed technologies, the volume of logs generated by systems has increased dramatically. Furthermore, the intertwined nature of log data and the complex dependencies between nodes make manual detection increasingly difficult. Therefore, traditional manual log analysis methods are no longer suitable for the needs of modern computing networks. To address this issue, researchers have proposed a variety of automated log anomaly detection methods. Early log anomaly detection methods primarily extracted semantic features from logs and combined them with machine learning algorithms for anomaly detection. However, these methods were limited in feature capture and struggled to effectively reveal deep patterns in log data. With the rapid development of deep learning technology, deep learning-based log anomaly detection methods have gradually become mainstream. These methods can automatically extract more complex and hidden features from large-scale log data, significantly improving the accuracy and efficiency of anomaly detection. Despite this, log anomaly detection for computing network nodes still faces many challenges, especially when dealing with complex dependencies between nodes and massive amounts of log data. Existing anomaly detection technologies still have significant room for improvement.

[0007] In terms of trustworthy assessment, especially in the computing power network environment, the task heterogeneity and resource allocation differences between nodes require not only relying on log data for anomaly detection, but also dynamically evaluating the credibility of node behavior, taking into account the diversity of tasks, the stability of execution, and the influence of external factors, in order to provide a more robust and efficient trustworthy assessment for the computing power network.

[0008] Therefore, it is necessary to design a zero-trust trusted access method for nodes in the computing power network to solve the technical difficulties of conducting robust and efficient security assessment in the computing power network scenario. Summary of the Invention

[0009] In response to the deficiencies of the existing technology, the present invention proposes a zero-trust trusted access method for nodes in computing power networks. This solution is based on the zero-trust principle and performs trust evaluations during both the registration and operation stages of computing power nodes. After obtaining the initial trust value upon registration, the behavior of computing power nodes is monitored in real time, and the trustworthiness of node behavior is comprehensively estimated, thereby achieving early detection and processing of abnormal behavior nodes and improving the security and efficiency of the overall operation of the computing power network. This solution extracts features of different dimensions of computing power network logs by introducing semantic feature extraction, temporal feature extraction, parameter feature extraction, and quantitative features, and performs effective feature fusion based on attention. It also captures long-distance relationships through a multi-step dependent anomaly detection model, significantly improving the accuracy of node log anomaly detection in the context of computing power networks. It also comprehensively scores the degree of anomalies in logs over a period of time and integrates them with user feedback. By responding to the trustworthiness scores and risks of computing power nodes, it promptly resolves unsafe factors in the computing power network and improves the overall security and availability of the system.

[0010] In order to achieve the above object, the present invention provides the following technical solutions: A zero-trust trusted access method for nodes in a computing network includes the following steps: Step S1: Trust Assessment during the Computing Node Registration Phase: In a computing network, node access is the first step to ensuring stable operation of the entire system. Idle computing devices register with the dispatch center to become computing nodes. When a new computing device applies to join the computing network, the computing network verifies the node's identity and capabilities to ensure its trustworthiness, prevent malicious nodes from invading the network, and obtain an initial trust value.

[0011] Step S2, trust assessment based on behavior logs during the computing power node task execution phase: Through the information collection probes deployed when the nodes are connected, the connected nodes are tracked in real time, and the operation data is collected to form a dynamic data stream. The scheduling system regularly requests the upload of computing power node logs, and uses the Brain parser to parse the original logs to obtain structured logs. Semantic features, time features, parameter features, and quantitative features are extracted from the obtained log templates respectively, and these four types of vectors are weighted feature fusion. In view of the fact that node behavior in the computing power network is often affected by multi-step time dependencies, the hidden states of multiple historical time steps are explicitly introduced to enhance the detection ability of abnormal patterns. After anomaly detection for each log, the trust score of the node is dynamically updated using the time decay model, and additional penalties are added according to the size of the outlier value. When the behavior of a node shows abnormality, the scheduling system can quickly identify and isolate the node to prevent potential threats from spreading to the entire network and adjust the corresponding payment standards.

[0012] Compared with the prior art, the present invention has the following beneficial effects: The present invention is based on the fact that computing power network, as the next generation of new information infrastructure, has become the cornerstone of the digital transformation of the entire society and has become the current status of key construction projects for major companies. However, most existing technologies focus on trust assessment during the node access phase, and lack dynamic monitoring and real-time assessment of the long-term behavior of nodes. This makes it difficult to capture the security changes of nodes in a timely manner during the execution of tasks by the nodes, posing potential security risks. Based on the principle of zero trust, the present invention not only conducts trust assessment during the access phase, but also focuses on the security risks of computing power network nodes during operation, and conducts precise risk prevention and control throughout the life cycle of the node, thereby greatly improving the security and adaptability of the computing power network.

[0013] 2. Based on the unique background of computing power network, the present invention proposes an improved multiple feature extraction. Existing log analysis methods usually rely on simple feature extraction, mainly focusing on single log feature anomaly analysis. These methods are often unable to effectively capture potential behavioral anomalies when faced with complex and changeable computing power network environments, resulting in inaccurate evaluation results. The present invention extracts key semantic features, time features, parameter features, and quantitative features in the computing power network, and combines the attention mechanism for weighted feature fusion, thereby more comprehensively extracting node behavior features in the computing power network log, ensuring that potential anomalies in the log are accurately captured in a complex and changeable environment, and providing higher accuracy and reliability for node behavior analysis.

[0014] 3. This invention builds an anomaly detection model based on multi-step dependencies. This model explicitly uses the hidden states of multiple historical time steps as input for each time unit, addressing the fact that anomalies in computing network log analysis are often not directly determined by log events in a single time step but rather by long-term dependencies. This effectively addresses the inability of traditional methods (such as GRU and LSTM) to fully capture long-term dependencies. This approach can handle the temporal characteristics of computing network log data, improving the sensitivity and accuracy of anomaly detection.

[0015] 4. The present invention introduces a time decay and penalty mechanism to comprehensively score the degree of log anomalies within a period of time, and integrates it with the user feedback score to comprehensively evaluate the credibility of the node, thereby achieving refined control of node access rights. It supplements the existing trust evaluation method that only scores log anomalies at a single time point, lacks a dynamic adjustment mechanism for abnormal behaviors in time series that change over time, and ignores the shortcomings of abnormal changes over a long period of time. The present invention can dynamically adjust the trust score of the node and integrate it with the user feedback score to provide a more refined node behavior credibility assessment, significantly improve the security and anti-attack capability of the computing power network, and ensure accurate control of node access rights to prevent potential malicious nodes from lurking for a long time.

[0016] In summary, the node behavior trust evaluation method in the computing power network context proposed in this invention improves the accuracy of anomaly detection while ensuring the robustness of the system. It also identifies and controls abnormal nodes at an early stage through intelligent stage scoring, greatly improving the security of the computing power network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 A diagram of the operating mechanism of a zero-trust trusted access method for nodes in a computing power network provided by an embodiment of the present invention.

[0019] Figure 2 This is a macro-architecture diagram of a zero-trust trusted access method for nodes in a computing power network provided by an embodiment of the present invention.

[0020] Figure 3 This is a detailed process diagram of the node computing power registration phase in a node zero-trust trusted access method for a computing power network provided by an embodiment of the present invention.

[0021] Figure 4 This is a detailed process diagram of behavior-based trust assessment during the node task execution phase in a node zero-trust trusted access method for a computing power network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to better understand the present technical solution, the method of the present invention is described in detail below with reference to the accompanying drawings.

[0023] The node behavior trust evaluation method for computing power network proposed in this invention is deployed in the scheduling system of computing power network, and collects node behavior information and makes trust evaluation and feedback through interaction with computing power nodes. Figure 1 The computing network consists of three components, in addition to "computing" and "network", it also introduces "brain". "Computing" refers to Figure 1 The computing power provider on the far right produces computing power, while the "network" connects the computing power. The "brain," or the scheduling system shown in the diagram, uniformly perceives, orchestrates, schedules, and coordinates the computing power within the network. Computing power consumers on the left request computing power from the scheduling system to obtain access and then rate the computing power nodes after use. The trust evaluation module in the scheduling system regularly assesses the trustworthiness of computing power nodes and responds to risks.

[0024] The node behavior trust evaluation method for computing power network proposed in this invention mainly consists of two modules, namely trust evaluation in computing power node registration phase and trust evaluation based on behavior log in computing power node task execution phase. In the access phase, it is divided into three steps: identity trust evaluation, capability trust evaluation, and initial trust value calculation. In the task execution phase, it is divided into three steps: log collection and analysis, multi-dimensional log feature extraction and fusion, and node trust evaluation based on log features. Figure 2 As shown, it specifically includes the following two modules and six steps: S1. Trust evaluation during the computing power node registration phase In a computing network, node access is the first step to ensuring stable operation of the entire system. Idle computing devices register with the dispatch center to become computing nodes. When a new computing device applies to join the computing network, the computing network verifies the node's identity and capabilities to ensure its trustworthiness and prevent malicious nodes from invading the network.

[0025] S1.1 Trusted Identity Verification In the computing power network, node access needs to meet strict requirements in terms of both identity legitimacy and computing power credibility. The present invention designs a phased evaluation method, which first verifies the legitimacy of the node through multi-factor identity authentication. If it fails, access is directly rejected and subsequent capability evaluation is no longer performed. Identity credibility is used to determine whether the registered identity and hardware identification of the node are authentic and credible. The platform first verifies the legitimacy of the digital certificate submitted by the node, verifies the validity of its certificate chain and the trusted issuing authority, and verifies the possession of the node private key through a digital signature. Finally, the integrity of the identity is judged in combination with the node model, MAC address and network protocol stack fingerprint consistency. Identity credibility It is defined as a concise binary threshold judgment, which is defined as 1 when all pass, and 0 otherwise.

[0026] S1.2 Capability Credibility Assessment After authentication is passed, the platform directly collects capability information through a lightweight probe program deployed on the node, avoiding resource consumption introduced by the benchmark task. Capability credibility assessment is divided into two parts: one is capability size assessment, which is used to generate capability labels; the other is capability consistency assessment, which is used to determine the degree of match between the node's declared resources and the measured resources. Capability size indicators include CPU computing performance, GPU acceleration capability, memory capacity and network bandwidth. Let the capability indicators measured by the probe be , , The total ability score can be defined as the weighted sum: (1), in is the weight of each dimension. Size classification capability standard (2), in is the high capability level threshold, nodes above this threshold have a high capability label, The node with the capability level between the high capability level and the medium capability level has a medium capability label.

[0027] Capability consistency is evaluated by comparing the relative difference between the node's declared value and the probe's measured value. Let the declared value be , the consistency score is: (3), The closer the value is to 1, the higher the consistency. The final node capability credibility is defined as , which is used for subsequent organizational reputation correction and access trust score generation. If identity verification fails, the system directly denies node access and capability data is not collected. This forms an access strategy that verifies identity first, then capability, in a phased, step-by-step manner. This ensures security while reducing computing power network access overhead and providing support for capability labels and consistency indicators for task scheduling.

[0028] S1.3 Node Trust Modeling Based on Bayesian Prior and Graph Regularization In a computing network environment, the trustworthiness of node access depends not only on the node's capability assessment results during the access phase, but is also closely related to the long-term reputation of the organization to which it belongs, and there is also potential behavioral consistency between nodes in the same organization. To achieve integrated modeling of organizational priors, node observations, and group smoothness, this patent proposes a node trust inference method based on Bayesian priors and graph regularization to generate a globally optimal trust score during the node registration phase.

[0029] Assume that the computing power network contains a set of organizations With node collection , and define heterogeneous bipartite graph : (4), in is the node-organization affiliation edge. For each node n, the reputation value of its organization R o (n) is the average trust value of the nodes leased by the organization. The probes deployed in the previous section collect data in real time when connected, reflecting the objective evaluation of its computing power performance. In order to reasonably integrate these two types of information, this patent first regards node trust as a potential probability variable x n ∈[0,1], and set the prior Beta distribution based on the organization’s reputation (5), The prior parameters , Through organizational reputation mapping, we can obtain: (6), κ represents the prior confidence strength, Identify the organizational reputation of node n. In the absence of historical trustworthy data, the distribution degenerates into a uniform distribution. Subsequently, the system corrects the node credibility to the posterior expectation based on the capability observation. It can be regarded as a continuous observation probability. This patent simplifies the modeling and the prior corrected credibility score of each node for: (7), in The introduction of is equivalent to an observation event, whose confidence contribution is smaller than the long-term organizational prior, in order to balance short-term capabilities and historical credibility.

[0030] After obtaining the prior corrected credibility score of each node Finally, in order to further express the consistency of node scores within the same organization, this patent introduces smoothing regularization on the global graph structure and defines the objective function (8), in is the smoothness weight, represents the graph regularization term, which is used to constrain the trust values ​​between adjacent nodes to be similar, ensuring trust consistency in the network structure. This objective function ensures that node trust is close to the organization's prior and its own capabilities, while maintaining reasonable consistency within the same organization. This optimization problem is equivalent to solving the linear equation: (9), in is the Laplacian matrix of the node-node graph, is the modified expectation vector. The closed form of the solution is: (10), Through node trust modeling based on Bayesian prior and graph regularization, the node trust score not only has probabilistic prior meaning, but also satisfies the smooth coupling relationship of the organization-node bipartite graph in the computing power network, significantly improving the score interpretability and global consistency.

[0031] S1.4 Access Decision and Dynamic Evolution After completing the trust inference of the node access period, the platform calculates the node credibility score and capability labels to make hierarchical decisions about node access status. The node access status is determined by the following decision function: (11), in is the access rejection threshold, nodes below this threshold are denied access, is the full access threshold, nodes above this threshold can be fully accessed, 、 It will be adjusted dynamically based on the current network load, task urgency, and available computing resources: (12), in Indicates the current computing power utilization (i.e. load ratio), is the static baseline threshold, The maximum dynamic adjustment range.

[0032] For access in the edge area (located and For nodes between , the platform can adopt a progressive access strategy, that is, first grant them limited permissions, allow them to perform low-risk or low-priority tasks, and continuously monitor their behavior during operation to decide whether to upgrade permissions.

[0033] After a node is connected to the computing network, the platform continuously collects its runtime behavior data (such as resource usage, task completion status, exception logs, etc.) through the deployed probe program, and dynamically evolves the node trust status based on the following mechanism. The system aggregates the trust status of the organization's subordinate nodes every 24 hours and updates the organization's reputation: (13), The median is used to enhance the robustness to abnormal nodes, where Represents the trust value of the organization in the kth cycle, which is used to indicate the overall credibility of the organization in the current cycle. The value range is usually [0,1]. It represents the trust value of the organization in the next cycle (the k+1th cycle), which is updated through the dynamic evolution mechanism. is a smoothing coefficient, ranging from 0 to 1, that controls the weighting of historical confidence values ​​and current observations. A larger value results in a greater reliance on historical values ​​and a more conservative update; a smaller value results in a greater reliance on new observations and a more sensitive response. The runtime behavior score of the nodes belonging to the organization at time t, Represents the collection of all nodes of the organization.

[0034] S2. Trust evaluation based on behavior logs during the computing node task execution phase S2.1 Log Collection and Analysis S2.1.1 Log Collection During node registration in step S1, the scheduling system deploys a data collection probe to each registered node. The probe runs continuously on each connected computing node, providing comprehensive real-time monitoring and data collection. The scheduling system collects various log data generated by nodes when they execute computing tasks. This log data typically includes, but is not limited to, task execution status (recording the initiation, execution, completion, and related status information of computing tasks), resource usage (including consumption of computing, storage, bandwidth, and other resources, reflecting the efficiency of node resource utilization), and abnormal behavior records (abnormal conditions that may occur during node operation, such as task failures and resource overloads).

[0035] The following specific requirements apply to the logs collected during the log collection process: First, the collected logs must originate from various nodes in the computing network and be uploaded regularly upon request from the scheduling system. Second, the frequency of log collection must meet the real-time requirements of node task execution within the computing network. Generally, log collection is performed once per second to capture subtle changes in node behavior. For high-frequency tasks, the frequency may be increased to reflect node status in real time. Finally, to ensure the accuracy and reliability of log data, the collection module implements consistency checking and integrity verification mechanisms. All log data is encrypted and verified during transmission and storage to prevent data loss or tampering. Furthermore, the collected data must maintain the accuracy of key information such as timestamps, node IDs, and task IDs to ensure data traceability.

[0036] Both the real-world HDFS and BGL datasets can be used as log collection results for this invention. The HDFS dataset is generated by a Hadoop-based map-reduce job on over 200 Amazon EC2 nodes and contains a total of 111,756,290 raw log messages. The BGL dataset is an open dataset of logs collected from the Blue Gene / L supercomputer system at Lawrence Livermore National Laboratory and contains 4,747,963 raw log messages.

[0037] S2.1.2 Brain-based log analysis Data collection analyzes the unstructured log data output by edge computing nodes and structures it using the most advanced Brain method. Log parsing removes redundant information and extracts the time and content of log events. Preprocessing primarily involves word segmentation and filtering for common variables. Initial groups are created based on the longest word combination selected from word combinations with a frequency greater than a threshold. For each initial group, a bidirectional parallel tree adds bidirectional nodes and outputs a log template.

[0038] S2.2 Multi-dimensional log feature extraction and fusion This step extracts semantic features, time features, parameter features, and quantity features from the log template, and performs multi-dimensional feature fusion, where: S2.2.1 Semantic Feature Extraction Based on ALBERT and Contrastive Learning In computing networks, node logs often contain complex semantic information, which is crucial for understanding node behavior patterns and detecting anomalies. For example, logs containing "exception" or "hrown" may indicate that a computing node experienced an anomaly during a task. However, log data often presents challenges such as polysemous words and log variability.

[0039] Unlike general system logs, computing network logs exhibit characteristics such as multi-task mixing, semantic ambiguity, and log variations depending on task type. Traditional rule-based feature extraction methods struggle to effectively address these issues. To more comprehensively capture the deep semantic information of computing network logs and improve the model's robustness to log variations, this paper uses ALBERT as a pre-trained language model, combined with a contrastive learning method, to achieve efficient semantic embedding of log templates. This method can effectively address challenges such as polysemous words, multi-task log variations, and unknown log templates, improving the accuracy of anomaly detection.

[0040] The log template A is split into M tokens, which are used as input to ALBERT, where [CLS] marks the starting position of the log template. Each token generates a corresponding semantic feature vector. The preliminary semantic embedding is calculated by averaging the hidden vectors of the penultimate encoding layer. .

[0041] In order to further improve the ability to distinguish log templates, this paper introduces contrastive learning to optimize the semantic representation of ALBERT. The embedding representation of , whose formula is as follows: (14), The goal is to bring log templates with similar semantics (positive samples) closer together and log templates with irrelevant semantics (negative samples) farther apart. The formula is as follows: (15), (16), Loss function for contrastive learning The definition is as follows: (17), in is a temperature parameter that controls the sensitivity of the sample distribution. represents the log template vector with similar context, are negative samples of irrelevant log templates.

[0042] Therefore, contrast learning adjustment The representation makes similar logs closer and different types of logs farther away, and finally obtains semantic embedding , as input for subsequent anomaly detection.

[0043] S2.2.2 Time feature extraction based on time difference change rate In most logging systems for computing network nodes, each log entry includes a timestamp, which can be used to calculate the time interval between log entries. In a stable system, the execution time for the same program path typically remains stable. However, when system performance issues occur, faulty components can cause abnormal variations in execution time, significantly increasing the time interval between log entries. For example, if a normal computing node completes a specified operation in 1 second, while a different node takes 1000 seconds to complete the same operation, this indicates a potential anomaly.

[0044] The absolute value of the time difference between logs may have dimensionality issues because different computing nodes may use different logging systems with different time units (e.g., milliseconds, seconds, minutes). The relative rate of change is a dimensionless metric and more versatile. Therefore, this paper introduces the relative rate of change of time differences as a temporal feature for anomaly detection. Through softmax normalization and high-dimensional embedding, it can capture subtle differences in time interval changes and improve detection accuracy.

[0045] First, calculate the timestamps of adjacent logs in the log sequence and The time difference between , and generate a time difference series, in , represents the time interval between adjacent logs. Next, calculate the relative change rate of adjacent time differences in the time difference series , the formula can be expressed as: (18), On this basis, a time difference relative change rate sequence is generated , the relative rate of change of time difference Embedded coding is performed to generate an embedding vector of the relative rate of change of the time difference. The process is as follows.

[0046] First, Multiply by the randomly initialized weight vector W and add the randomly initialized bias vector b to get the mapped high-dimensional vector . And use the softmax function to normalize the high-dimensional vector z, scale its value to the range of [0,1], and ensure that the sum of each dimension is 1. The formula can be expressed as: (19), For each in the sequence Perform the above operations in sequence, and finally get the time difference relative change rate embedded sequence .

[0047] S2.2.3 Numerical parameter feature extraction based on normalization enhancement The values ​​of certain parameters in logs are also crucial for anomaly detection. For example, in a computing network, resource consumption parameters such as memory usage, CPU utilization, and network bandwidth in log events are crucial for determining whether node behavior is normal. Abnormal parameter values ​​in certain log events may indicate performance issues or configuration errors with the node. For example, in a computing network, consider two log events using the same template: "Request for computing resources." However, in the second event, the log parameters indicate that the node's memory usage significantly exceeds the normal range (for example, memory utilization exceeds 90%). This abnormal resource usage often leads to node performance degradation or task failure.

[0048] In view of the log parameter characteristics in the computing power network environment, the present invention proposes a normalization-enhanced numerical parameter feature extraction method to improve the anomaly detection capability for computing power network logs. In computing power network logs, parameters typically include information such as task identification, computing nodes, resource requests, storage paths, etc. Although these parameters may have large numerical differences in different logs, they generally follow a certain distribution pattern during the normal execution of computing tasks. Therefore, the present invention enhances the expressiveness of numerical parameters in anomaly detection through dynamic normalization and hierarchical embedding.

[0049] Since the parameter values ​​in the computing power network logs span a large range, directly inputting the original values ​​may lead to misjudgment of anomaly detection. Therefore, we adopt a sliding window normalization strategy to normalize the parameters within a local window to preserve their relative change trends: (20), in, is the original parameter value, and are the mean and standard deviation within the sliding window, To prevent small numbers from being divided by zero. This method can effectively adapt to the dynamic task load changes in the computing power network, making the model more robust.

[0050] On the basis of normalization, the present invention uses a multi-layer perceptron (MLP) to extract the parameters to capture the numerical features at different levels. The formula is as follows: (twenty one), in, , , , The ReLU is a trainable parameter, and the nonlinear activation function enables the model to learn complex mapping relationships between parameter values. This hierarchical embedding can enhance the perception of abnormal patterns and improve detection accuracy. At the same time, in order to further improve the anomaly detection capability of numerical parameters, the present invention introduces a global distribution constraint loss during the training process to ensure that normal log parameters in the embedding space remain compact, while abnormal parameters can be effectively distinguished. By minimizing the embedding variance of normal log parameters and maximizing the Euclidean distance between abnormal log parameters and normal parameters, the model's sensitivity to abnormal parameters is enhanced.

[0051] S2.2.4 Optimizing Quantity Feature Extraction Based on Category-Aware Counting In computing networks, log template sequences contain not only temporal, semantic, and parameter information, but also rich quantitative patterns. In computing network log analysis, quantitative anomalies refer to deviations from the expected pattern in the number of occurrences of certain templates in the logs. Such anomalies often reflect abnormalities or malfunctions in the system's operational state. Excessive or insufficient execution of certain tasks, potentially due to abnormal resource usage, is crucial for identifying potential issues in computing networks.

[0052] Existing quantity embedding methods use a sliding window to count the occurrences of log templates to detect anomalies in quantity relationships. However, computing networks face heterogeneity in computing power types and task types, leading to significant discrepancies in log quantity statistics. Computing network logs originate from various computing tasks, including but not limited to AI training, parallel computing, and big data batch processing. Log behavior and quantity characteristics of different task types can be quite different. Existing quantity counting methods typically use a unified statistical approach, ignoring differences in task categories. This can lead to confusion in log characteristics, thus affecting the accuracy of anomaly detection. For example, in batch processing tasks, the number of log events such as "data submission" and "job completion" typically follows a specific periodic pattern and is much less frequent than AI training tasks. If these tasks are mixed in with AI training tasks, frequent "training progress" logs may be confused with less frequent "job completion" logs, resulting in failure in quantity anomaly detection.

[0053] To solve the above problems, this paper proposes a quantitative feature extraction method based on category-aware counting optimization to improve the effectiveness of log quantitative features in computing network anomaly detection. The logs in the computing network come from different types of computing tasks. To this end, this paper introduces a category-aware counting method to count the number of log templates for different task categories and define the optimized category-aware counting vector. The calculation process is: (twenty two), in, Represents a set of computing task categories, Representation category Download log template Through category-aware counting, we can effectively distinguish the log patterns of different tasks and improve the pertinence of anomaly detection.

[0054] S2.2.5 Multi-dimensional log feature fusion In order to detect multiple anomalies in log sequences, traditional methods usually take the approach of separately detecting whether each feature is abnormal or directly splicing, connecting different features in series and then inputting them into the detection model. However, for computing networks that require complex multi-dimensional features, this method has significant limitations. The directly spliced ​​vectors assign the same weight to different features, which cannot highlight the features that are more important for anomaly detection. At the same time, splicing increases the dimension of the input features, which may lead to increased computational overhead and introduce redundant information, affecting the generalization ability of the model. To this end, the present invention adopts a weighted feature fusion method, which adaptively assigns weights to log features through a learnable attention mechanism, thereby improving the anomaly detection ability of computing network logs.

[0055] Assume that the log data feature sequence of the computing power network is expressed as Each of these Represents the log feature embedding in one dimension, T is the sequence length, N is the number of sequences, and C is the number of channels. The specific fusion method is as follows: First, all log feature embeddings are concatenated to obtain a vector E, and the mapping relationship between channels is learned through a linear transformation layer to obtain , the formula is as follows: (twenty three), (twenty four), in, is a learnable parameter matrix used to adjust the information weights of different channels. Softmax normalization is applied on different dimensions to calculate the importance of log feature embedding in each dimension. Among them, W is the attention weight matrix, which can dynamically adjust the contribution of different features to the final log vector. Finally, each log feature is weighted by element-by-element multiplication, and the fused feature Y is calculated. The formula is as follows: (25), Y is the final fused log feature representation, which is used for anomaly detection in the next step S2.3.1.

[0056] Compared with the traditional splicing method, the present invention can highlight the anomaly by learning the attention weight in the task of anomaly detection of computing network logs. Frequently detect more important embedding scales to improve detection accuracy, avoid the high-dimensional feature redundancy problem caused by direct splicing, improve the computational efficiency and generalization ability of the model, and improve the ability to detect sudden anomalies and long-term trend anomalies.

[0057] S2.3. Node Trustworthiness Assessment Based on Log Features S2.3.1 Anomaly Detection Based on Multi-step Dependencies The log sequence, fused with multi-dimensional features, is used as input for the anomaly detection model, and a recurrent neural network is applied to detect various anomalies from this diverse information. In computing network log analysis, anomalies are often not directly determined by log events at a single time step, but rather by long-term dependencies. Therefore, relying solely on traditional RNN variants like GRU or LSTM can lead to poor detection performance due to their short-term dependency issues. To address this issue, the present invention uses a multi-step dependency network to construct an anomaly detection model.

[0058] In the computing network, let the log sequence after feature fusion be , where e represents the log event at time step t. We first construct the hidden state matrix H' of the current time step t and its previous K historical time steps as follows: (26), in, For the front The hidden state of time steps, is a learnable residual matrix that captures the correlation between historical log features and current features.

[0059] In order to extract the contributions of different historical time steps, the present invention uses the attention mechanism to calculate the time step weights of H' and performs weighted summation (27), (28), (29), (30), (31), Among them, softmax ensures that the sum of the weights of all time steps is 1, so that more important historical time steps contribute more and reduce the impact of irrelevant log events. Finally, the current time step and historical characteristics Fusion is performed to enhance feature expression capabilities. (32), (33), (34) Then update the hidden state to include the information of the current time step and pass it to the next step of calculation. The final hidden state Contains the integration of all historical information at this time step. The hidden state of each log are the final representations of the log in multi-step time dependencies, which capture the relationship between the logs and whether the logs exhibit normal or abnormal behavior patterns. The formula is as follows: (35), Next, by To convert the model output into a percentage score, we use the Sigmoid activation function to map the output to the range [0, 1] and then multiply it by 100 to obtain the percentage anomaly score A for each log entry, as shown below: (36).

[0060] S2.3.2 Node Log Collection Credibility Scoring Based on Time Decay and Penalty Mechanism In step S2.3.2, the anomaly score of the single log output in step S2.3.1 is processed to obtain a comprehensive anomaly score of the log within a period of time. The initial score of the node is the identity authentication score at the time of access, and the trust score during operation will be gradually adjusted according to the behavior changes of the node. In order to better reflect the decreasing impact of log anomalies over time, the present invention introduces a time decay mechanism. That is, the closer the abnormal events are to the current time point, the greater their contribution to the final trust score, and the contribution of earlier abnormal events to the score gradually decreases. For the kth log, the anomaly score after time decay adjustment It can be calculated by the following formula: (37), Where k is the sequential index of the log, k current Represents the sequence number of the current log, The anomaly score of the k-th log obtained by the anomaly detection model.

[0061] In order to further enhance the accuracy and reliability of the model, the present invention introduces a penalty mechanism. This mechanism is based on the abnormality of the log. Make a judgment, when the abnormality of a log Exceeding a certain threshold When the abnormality of the log is , the abnormality of the log will be penalized, so that the comprehensive score can better reflect the actual situation. As shown below: (38), Among them, α is a penalty value that controls the intensity of the penalty. is the threshold. When the threshold is exceeded, the penalty mechanism will be activated and the anomaly degree will be adjusted by the coefficient α, and additional penalties will be imposed on logs with very high anomaly degrees.

[0062] Finally, the comprehensive score It is obtained by taking the weighted average of the time-decayed anomaly score and the penalty-adjusted score. For example, consider a time window of length T containing N logs. The formula for calculating the comprehensive score is as follows: (39), in, is the abnormality score of the kth log after time decay adjustment, is the penalty-adjusted score of the kth log, and N is the number of logs in the window. At the same time, in order to facilitate the merging of the log anomaly score with the user score in the next step, the min function is used to control the overall value below 100. Thus, the log comprehensive score is obtained It reflects the degree of abnormality within the entire time window and can effectively evaluate the degree of behavioral abnormality reflected in the logs of computing network nodes.

[0063] S2.3.3 Comprehensive Credibility Calculation Integrating User Feedback In the computing power network, users obtain computing power services through the scheduling system. Although they do not directly perceive the computing power nodes providing services, they can rate the overall service quality through feedback. Figure 1 As shown in Figure 1, after receiving computing power allocation from the scheduling system, computing power consumers can rate their actual usage. This invention uses user ratings as a supplementary evaluation dimension, reflecting the actual service performance of computing network nodes in operation. This quantitative assessment is based on user feedback and specific node operational data. This scoring dimension provides a more intuitive and comprehensive assessment of node credibility.

[0064] For example, user ratings include the performance of the node in executing computing tasks, including the accuracy, completeness and timeliness of the tasks, the speed at which the node responds to user requests, and whether performance degradation or downtime occurs frequently during continuous operation.

[0065] Suppose a node receives m ratings in time period T In the special case when m is equal to 0, that is, the computing power node does not receive user feedback ratings during this period, the abnormality of user feedback is set to 0, and the total abnormality score from user feedback is It can be expressed as: (40), In order to further improve the accuracy of node behavior credibility assessment, this paper combines user ratings with log anomaly detection results. Specifically, user ratings are treated as an independent dimension, which is then standardized and weightedly integrated with the anomaly detection score based on log data. Based on this, we can finally get a comprehensive node trust score. , the calculation formula is as follows: (41), in, It is a log-based anomaly detection score, usually a value calculated by some deep learning model or statistical method. It is the average of all user ratings within a certain period of time.

[0066] It is a weight coefficient that can be adjusted according to actual conditions. Indicates that more attention is paid to log scores, and lower Indicates greater emphasis on user ratings. The higher the value, the less trustworthy the node is.

[0067] Finally, risk response is performed by rating the comprehensive score of the computing power node. The computing power node rating formula is as follows: (42), Among them is Warning threshold, Is the safety threshold. The anomaly score is less than the safety threshold The node has a level of 1, which means it is safe and continues to arrange computing tasks normally; the abnormality score is greater than the safety threshold But the warning threshold has not yet been reached The node has a level of 2, which means that the trustworthiness of the node's behavior has slightly decreased. It is assigned a low-importance task and continues to be observed. The anomaly score is greater than the warning threshold. The node has a level of 3, which means that the node is untrustworthy and the scheduling system will isolate the node.

Claims

1. A zero-trust trusted access method for nodes in a computing network, characterized in that: It includes the following modules and steps: Module S1: Trust assessment during the computing power node registration phase; Step S1.1: Identity trust verification; Step S1.2: Capability Credibility Assessment; Step S1.3: Node trust modeling based on Bayesian prior and graph regularization; Step S1.4: Access decision and dynamic evolution; Through identity and capability trust evaluation, we ensure that trusted computing nodes are connected to the computing network and calculate the initial trust value. At the same time, we deploy information collection probes to the computing nodes to facilitate real-time monitoring of node security during operation. Module S2: Trust evaluation based on behavior logs during the computing node task execution phase; Step S2.1: Log collection and analysis; Step S2.2, multi-dimensional log feature extraction and fusion; Step S2.3: Node trustworthiness assessment based on log features; Log templates are obtained through log parsing, and semantic, temporal, parameter, and quantitative features specific to the computing power network are extracted. The weight of each feature in the final log vector is dynamically adjusted. By capturing the long-term dependencies between log events in the time series, accurate anomaly detection is performed on each log. A time decay model and penalty mechanism are then used to obtain a log anomaly score over a period of time. This score is then integrated with the user feedback score to obtain the comprehensive node credibility. Based on the comprehensive credibility, the scheduling system can quickly identify and isolate the node to prevent potential threats from spreading to the entire network.

2. A node zero-trust trusted access method for computing power network according to claim 1, characterized in that: Step S1 arranges simple tasks for the computing power node requesting access and observes its completion status to perform dual authentication of capabilities and identities and calculate the initial trust value.

3. A node zero-trust trusted access method for computing power network according to claim 1, characterized in that: The specific implementation process in step S2.2 is: Step S2.2.1: Semantic feature extraction based on ALBERT and contrastive learning; Step S2.2.2: extracting time features based on the time difference change rate; Step S2.2.3: Parameter feature extraction based on normalization enhancement; Step S2.2.4: Quantitative feature extraction based on category-aware counting optimization; Step S2.2.5: Multi-dimensional feature fusion.

4. A node zero-trust trusted access method for computing power network according to claim 1, characterized in that: The specific implementation process in step S2.3 is: Step S2.3.1: Anomaly detection based on multi-step dependencies; Step S2.3.2: Node log collection trust score based on time decay and penalty mechanism; Step S2.3.3: Calculate the comprehensive credibility by integrating user feedback.

5. A node zero-trust trusted access method for computing power network according to claim 3, characterized in that: In step S2.2.2, in order to address the dimensionality problem that exists when different computing power nodes may have different log system time units, it is proposed to use the time difference change rate as the time feature to identify abnormal changes in execution time caused by system performance problems.

6. A node zero-trust trusted access method for computing power network according to claim 3, characterized in that: Step S2.2.3 proposes a normalization-enhanced numerical parameter feature extraction method for heterogeneous computing power networks to improve the anomaly detection capability for computing power network logs.

7. A node zero-trust trusted access method for computing power network according to claim 3, characterized in that: Step S2.2.4 addresses the problem of significant differences in log quantity features due to heterogeneity of computing power node types and task types. A category-aware counting optimized quantity feature extraction method is proposed to improve the effectiveness of log quantity features in computing power network anomaly detection.

8. A node zero-trust trusted access method for computing power network according to claim 4, characterized in that: Step S2.3.1 addresses the problem that anomalies in the log analysis of the computing power network are usually not directly determined by the log events of a single time step, but are affected by long-term dependencies. By explicitly inputting multiple hidden states, long-distance anomalies in the computing power network are captured, and the degree of anomaly of each log is output to facilitate trustworthy scoring.

9. A node zero-trust trusted access method for computing power network according to claim 4, characterized in that: In order to better reflect the decreasing impact of computing network log anomalies over time, Module S2.3.2 introduces a time decay mechanism and a penalty mechanism. This mechanism ensures that anomalies closer to the current time point contribute more to the final credibility score. When the anomaly degree of a log exceeds a set threshold, an additional penalty will be imposed on the anomaly degree of the log, thereby making the comprehensive score more reflective of the actual situation.

10. A node zero-trust trusted access method for computing power network according to claim 4, characterized in that: Step S2.3.3 uses user ratings as a supplementary evaluation dimension to reflect the service performance of computing network nodes in actual operation, and conducts quantitative evaluation based on user feedback and the specific operation data of the nodes to provide a more intuitive and comprehensive node credibility assessment.

Images