A hierarchical situational awareness method with proactive defense capabilities in edge-cloud scenarios

Abstract

The present invention discloses a hierarchical situational awareness method and device with active defense capability in an end-edge cloud scenario, the method comprising: constructing a feature extraction module library corresponding to a preset task in the cloud; constructing an initial situational awareness module in the edge node according to the situational awareness scenario of the end node and a feature extraction module randomly selected from the feature extraction module library in the cloud, and optimizing the parameters of the situational awareness module; generating noise data by a noise generation method, and performing secondary optimization on the parameters of the situational awareness module using the noise data and the original data to obtain a situational awareness module with active defense capability; using the situational awareness module, the end node performs real-time situational awareness of the perceived data. This method can efficiently and comprehensively utilize complex and heterogeneous computing resources, storage resources, and communication resources in the end-edge cloud scenario, so that resource-constrained end nodes in the end-edge cloud scenario can make accurate and efficient decisions using the perceived data.

Description

Technical Field

[0001] The present invention relates to the field of next-generation Internet network security technology, and in particular to a hierarchical situation awareness method and device with active defense capabilities in an end-edge-cloud scenario. Background Art

[0002] With the continuous and rapid development of the Internet, complex and heterogeneous Internet architectures have become very common. Among them, the complex heterogeneous network of end-edge-cloud integration has attracted widespread attention from the industry and academia. With the emergence of new technologies such as cloud computing, edge computing, and big data, the complex heterogeneous network composed of end-edge-cloud is also constantly changing. The rapid development of complex heterogeneous networks of end-edge-cloud has increased the complexity of the network, and it is urgent for end nodes to have efficient situational awareness capabilities to optimize the decision-making and execution of various network activities. In terms of computing resources and storage resources, the cloud is the most abundant, followed by edge nodes, and the end nodes are the weakest. The situational awareness tasks performed by the end nodes, which are at a disadvantage in terms of resources, are the key to the efficient operation of the entire Internet. However, a single end node cannot provide the large-scale computing resources and data resources required by the high-quality situational awareness model, making it difficult for the situational awareness capabilities of existing end nodes to meet the optimization needs of network activities. Moreover, with the complex changes in network activities, the data perceived by the end nodes are often naturally accompanied by various disturbances, which greatly reduces the limited situational awareness capabilities of the end nodes and needs to be solved urgently. Summary of the invention

[0003] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0004] To this end, one object of the present invention is to propose a hierarchical situational awareness method with active defense capability in an end-edge cloud scenario, which can efficiently and comprehensively utilize complex and heterogeneous computing resources, storage resources, and communication resources in the end-edge cloud scenario, so that resource-constrained end nodes in the end-edge cloud scenario can use the perceived data to make accurate and efficient decisions, and can achieve hierarchical situational awareness in complex heterogeneous network scenarios of end-edge cloud without human intervention, and has active defense capabilities against various types of interference (including naturally existing interference noise and specific interference noise designed by attackers).

[0005] Another object of the present invention is to propose a hierarchical situational awareness device with active defense capabilities in an end-edge-cloud scenario.

[0006] To achieve the above-mentioned purpose, an embodiment of the present invention proposes a hierarchical situational awareness method with active defense capability in an end-edge-cloud scenario, comprising the following steps: constructing a feature extraction module library corresponding to a preset task in the cloud; constructing an initial situational awareness module in the edge node based on the situational awareness scenario of the end node and the feature extraction modules randomly selected from the cloud feature extraction module library, and optimizing the parameters of the situational awareness module; generating noise data through a noise generation method, and performing secondary optimization on the parameters of the situational awareness module using the noise data and the original data to obtain a situational awareness module with active defense capability; using the situational awareness module, the end node performs real-time situational awareness of the perceived data.

[0007] The hierarchical situational awareness method with active defense capability in the end-edge-cloud scenario of the embodiment of the present invention optimizes the design of multiple modules such as the construction, training, optimization, and execution of the situational awareness model in a hierarchical manner, making full use of various resources and communication rules in the end-edge-cloud network. Based on the idea of ​​quasi-active immunity, the edge node gives the situational awareness module the ability to resist potential interference or attacks without affecting the end node's execution of real-time situational awareness tasks, thereby improving the robustness and availability of the situational awareness model. In terms of situational awareness in complex heterogeneous network scenarios of end-edge-cloud, it has the advantages of high accuracy, strong timeliness, and wide versatility, and is very suitable for deployment and application in real-world scenarios.

[0008] In addition, the hierarchical situation awareness method with active defense capability in the edge-cloud scenario according to the above embodiment of the present invention may also have the following additional technical features:

[0009] According to an embodiment of the present invention, constructing a feature extraction module library corresponding to a preset task in the cloud includes: selecting multiple neural networks to construct a feature extraction module candidate set according to the preset task, and using cloud data to train and optimize the parameters of each feature extraction module in the feature extraction module candidate set; screening each feature extraction module in the feature extraction module candidate set according to screening conditions to obtain the feature extraction module library.

[0010] According to an embodiment of the present invention, based on the situation awareness scenario of the end node and the feature extraction module randomly selected from the cloud feature extraction module library, an initial situation awareness module is constructed at the edge node, and the parameters of the situation awareness module are optimized, including: randomly selecting a feature extraction module from the feature extraction module library through the edge node; determining a localization module according to the selected feature extraction module and the situation awareness scenario; combining the feature extraction module with the localization module to form a situation awareness module, and optimizing the parameters of the situation awareness module using the data uploaded from the end node to the edge node.

[0011] According to an embodiment of the present invention, the optimization of the parameters of the situation awareness module includes: optimizing with the goal of minimizing the loss function of the situation awareness module,

[0012]

[0013] in, is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j Data uploaded to edge nodes and parameters after data label optimization.

[0014] According to an embodiment of the present invention, the noise data is generated by a noise generation method, and the parameters of the situation awareness module are optimized twice using the noise data and the original data to obtain a situation awareness module with active defense capability, including:

[0015] Generate noise data by using a noise generation method;

[0016] Utilize the noise data and the original data to optimize the parameter θ of the situation awareness module j , where the parameters of the situation awareness module after secondary optimization are for:

[0017]

[0018] Among them, β0 is an evaluation parameter used to weigh the ability of the situational awareness module in terms of benign data and active defense capability. is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j The data uploaded to the edge node and the optimized parameters of the data label, s is the noise generation method used, A collection of noise generation methods.

[0019] According to an embodiment of the present invention, the situation awareness module is used to perform real-time situation awareness of the perceived data by the end node, including: before executing the situation awareness task, the associated edge node obtains the architectural configuration of the initial situation awareness module to perform the initialization operation of the situation awareness module of the end node; each end node uploads the data collected by the node to the associated edge node at a specific synchronization time interval, updates the data stored in the edge node by incremental update, and the end node uses the edge node to obtain the situation awareness module with active defense capability, and the end node instructs the edge node to update the parameters of the situation awareness module with active defense capability using the updated data; each end node perceives external data in real time, and updates the parameters of the situation awareness module with active defense capability at the operating time interval.

[0020] According to an embodiment of the present invention, when updating data stored in an edge node by incremental updating, it also includes: the edge node saves data within a preset time period before the current time through a time window, and uses the newly saved data to eliminate data outside the time window.

[0021] To achieve the above-mentioned purpose, another embodiment of the present invention proposes a hierarchical situational awareness device with active defense capability in an end-edge-cloud scenario, including: a construction module, used to construct a feature extraction module library corresponding to a preset task in the cloud; a first optimization module, used to construct an initial situational awareness module at the edge node based on the situational awareness scenario of the end node and the feature extraction modules randomly selected from the cloud feature extraction module library, and optimize the parameters of the situational awareness module; a second optimization module, used to generate noise data through a noise generation method, and use the noise data and the original data to perform secondary optimization on the parameters of the situational awareness module to obtain a situational awareness module with active defense capability; a perception module, used to use the situational awareness module to perform real-time situational awareness of the perceived data by the end node.

[0022] The hierarchical situational awareness device with active defense capability in the end-edge-cloud scenario of the embodiment of the present invention optimizes the design of multiple modules such as the construction, training, optimization, and execution of the situational awareness model in a hierarchical manner, making full use of various resources and communication rules in the end-edge-cloud network. Based on the idea of ​​quasi-active immunity, the edge node gives the situational awareness module the ability to resist potential interference or attacks without affecting the end node's execution of real-time situational awareness tasks, thereby improving the robustness and availability of the situational awareness model. In terms of situational awareness in complex heterogeneous network scenarios of end-edge-cloud, it has the advantages of high accuracy, strong timeliness, and wide versatility, and is very suitable for deployment and application in real-world scenarios.

[0023] In addition, the hierarchical situation awareness device with active defense capability in the edge-cloud scenario according to the above embodiment of the present invention may also have the following additional technical features:

[0024] According to an embodiment of the present invention, the construction module is further used to select multiple neural networks to construct a feature extraction module candidate set according to the preset task, and use cloud data to train and optimize the parameters of each feature extraction module in the feature extraction module candidate set; and filter each feature extraction module in the feature extraction module candidate set according to the filtering conditions to obtain the feature extraction module library.

[0025] According to an embodiment of the present invention, the first optimization module is further used to randomly select a feature extraction module from the feature extraction module library through an edge node; determine a localization module based on the selected feature extraction module and the situation awareness scenario; combine the feature extraction module with the localization module to form a situation awareness module, and optimize the parameters of the situation awareness module using the data uploaded from the end node to the edge node.

[0026] According to an embodiment of the present invention, the optimization of the parameters of the situation awareness module includes: optimizing with the goal of minimizing the loss function of the situation awareness module,

[0027]

[0028] in, is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j Data uploaded to edge nodes and parameters after data label optimization.

[0029] In an embodiment of the present invention, the second optimization module is further used to:

[0030] Generate noise data by using a noise generation method;

[0031] Utilize the noise data and the original data to optimize the parameter θ of the situation awareness module j , where the parameters of the situation awareness module after secondary optimization are for:

[0032]

[0033] Among them, β0 is an evaluation parameter used to weigh the ability of the situational awareness module in terms of benign data and active defense capability. is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j The data uploaded to the edge node and the optimized parameters of the data label, s is the noise generation method used, A collection of noise generation methods.

[0034] According to an embodiment of the present invention, the perception module is further used to, before executing the situational awareness task, associate the edge node with the architecture configuration of the initial situational awareness module to perform the initialization operation of the situational awareness module of the end node; each end node uploads the data collected by the node to the associated edge node at each specific synchronization time interval, updates the data stored in the edge node by incremental update, and the end node uses the edge node to obtain the situational awareness module with active defense capability, and the end node instructs the edge node to update the parameters of the situational awareness module with active defense capability using the updated data; each end node perceives external data in real time, and updates the parameters of the situational awareness module with active defense capability at the running time interval.

[0035] In an embodiment of the present invention, when updating data stored in an edge node by incremental updating, it also includes: the edge node saves data within a preset time period before the current time through a time window, and uses the newly saved data to eliminate data outside the time window.

[0036] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0038] Figure 1 This is a flow chart of a hierarchical situation awareness method with active defense capability in an edge-cloud scenario according to an embodiment of the present invention;

[0039] Figure 2 This is a schematic diagram of the structure of a hierarchical situational awareness device with active defense capabilities in an edge-cloud scenario according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0041] In order to further improve the efficiency of end nodes in situational awareness and make full use of the respective advantages of end-edge-cloud networks, a hierarchical situational awareness method and device with active defense capabilities in end-edge-cloud scenarios are proposed. This method can collaboratively utilize various network resources based on the amount of available resources, communication delay, and differences in situational awareness model optimization and reasoning in the complex heterogeneous network of end-edge-cloud, and comprehensively improve the accuracy and effectiveness of situational awareness while ensuring the stability of the end node situational awareness task. First, cloud resources are the most abundant and suitable for large-scale model parameter optimization, such as a large number of model parameter optimizations with different structures. However, the communication overhead between the end node and the cloud is high, so the edge node is used to design localized modules for specific tasks, thereby constructing the overall situational awareness module and optimizing some parameters. At the same time, the communication delay between the end node and the edge node is very low, which can update the situational awareness module of the end node itself according to the latest parameters and structure of the situational awareness module in the edge node at a specific time interval while the end node performs the situational awareness task in real time. In addition, based on the idea of ​​quasi-active immunity, the edge node gives the situation awareness module the ability to resist potential interference and attacks without affecting the end node's execution of real-time situation awareness tasks, thereby improving the robustness and availability of the situation awareness module. In general, this method and device have the advantages of high accuracy, strong timeliness, and wide versatility in situation awareness in complex heterogeneous network scenarios of end-edge-cloud, and are very suitable for deployment and application in real-world scenarios.

[0042] The following describes a hierarchical situational awareness method and device with active defense capability in an edge-cloud scenario proposed according to an embodiment of the present invention with reference to the accompanying drawings.

[0043] First, a hierarchical situational awareness method with active defense capability in an edge-cloud scenario proposed according to an embodiment of the present invention will be described with reference to the accompanying drawings.

[0044] Figure 1 The present invention is a flowchart of a hierarchical situational awareness method with active defense capability in an edge-cloud scenario according to an embodiment of the present invention.

[0045] like Figure 1 As shown, the hierarchical situational awareness method with active defense capability in the edge-cloud scenario includes the following steps:

[0046] In step S101, a feature extraction module library corresponding to a preset task is constructed in the cloud.

[0047] In an embodiment of the present invention, a feature extraction module library corresponding to a preset task is constructed in the cloud, including: selecting multiple neural networks to construct a feature extraction module candidate set according to the preset task, and using cloud data to train and optimize the parameters of each feature extraction module in the feature extraction module candidate set; and screening each feature extraction module in the feature extraction module candidate set according to the screening conditions to obtain a feature extraction module library.

[0048] Specifically, the situational awareness model based on deep learning requires a high-performance feature extraction module, and the parameter optimization of the feature extraction module requires a large amount of computing resources and storage resources. The end node cannot provide sufficient resources. Therefore, the optimization task of the feature extraction module is deployed in the cloud, and a specific feature extraction library is built for a certain type of specific preset task.

[0049] Step 1.1: Construct a candidate set of feature extraction modules. In the edge-cloud network scenario, the cloud has abundant computing and storage resources, and has a large number of deep neural network models with different architectures, such as LSTM networks, VGG16 networks, ResNet18 networks, and AlexNet networks, etc. In addition, neural networks with different architectures can adopt different detailed schemes in terms of detailed configurations such as the number of neurons, number of network layers, and activation functions, which will also lead to differences in the models. For a certain type of preset task, such as abnormal traffic detection in network security incident identification, all N' models that meet the required scenarios together constitute the candidate set of feature extraction modules for this type of preset task. Right now

[0050] Step 1.2: Optimize the parameters of each feature extraction module. The cloud has abundant high-performance computing resources. Using the existing public data, we can optimize the parameters of each model in the feature extraction module candidate set in step 1.1. Training is performed to optimize the parameters of each feature extraction module.

[0051] Step 1.3: Screen the candidate set of feature extraction modules to form a feature extraction library. After completing the model parameter optimization in step 1.2, it is necessary to screen the feature extraction modules that meet specific requirements according to specific scenarios to form a feature extraction library, that is, Taking abnormal traffic detection in network security incident identification as an example, the accuracy of the model is only useful after it exceeds the threshold γ = 0.9. Therefore, for each feature extraction module after the model parameter optimization in step 1.2, all feature extraction modules with a model accuracy exceeding γ are selected to form a feature extraction library, that is, Among them, N refers to the cloud feature extraction library The number of all feature extraction modules in .

[0052] In step S102, an initial situation awareness module is constructed at the edge node according to the situation awareness scenario of the end node and a feature extraction module randomly selected from a cloud feature extraction module library, and the parameters of the situation awareness module are optimized.

[0053] In an embodiment of the present invention, an initial situation awareness module is constructed at an edge node based on a situation awareness scenario of an end node and a feature extraction module randomly selected from a cloud feature extraction module library, and the parameters of the situation awareness module are optimized, including: randomly selecting a feature extraction module from the feature extraction module library through the edge node; determining a localization module based on the selected feature extraction module and the situation awareness scenario; combining the feature extraction module with the localization module to form a situation awareness module, and optimizing the parameters of the situation awareness module using data uploaded from the end node to the edge node.

[0054] Specifically, the feature extraction library built on the cloud The general feature extraction module belonging to a certain type of preset task still needs to be optimized in combination with the specific data of such preset tasks. Considering that the transmission delay between the cloud and the end node is much higher than the transmission delay between the edge node and the end node, the feature extraction library The localization work is completed by the edge nodes, and constitutes a situational awareness module with situational awareness capabilities.

[0055] Step 2.1: Determine the feature extraction module in a random manner. To defend against potential attacks, each edge node randomly downloads a feature extraction module from the feature extraction library in the cloud. This type of random operation can effectively prevent attackers from designing efficient attack plans for a specific feature extraction module and then attacking all edge nodes.

[0056] Step 2.2: Determine the localization module by combining the feature extraction module and the situation awareness scenario. The feature extraction module randomly selected according to step 2.1 The structure of the localization module (e.g., the last layer has 100 neurons) determines the input configuration of the localization module (e.g., the input layer has 100 neurons); and, according to the task scenario (e.g., abnormal traffic detection in network security incident identification, the classification task has only 2 types of results: normal and abnormal), determines the output configuration of the localization module (e.g., the output layer has 2 neurons); in addition, the intermediate composition of the localization module can be decided by the researchers themselves (e.g., there is 1 hidden layer). All edge nodes constitute the set ε. For a specific edge node E i ∈ε, the localization module consists of L i Indicates. Among them, Li All trainable parameters are given by θ i express.

[0057] Step 2.3: Combine the feature extraction module with the localization module to form a situation awareness module. i ∈ε, after determining the feature extraction module randomly selected in step 2.1 and the localization module L designed in step 2.2 i After that, the situation awareness module is formed through localization operation. The whole localization process can be expressed as the following formula:

[0058] M i,k (θ i,k )=f(M k ,L i )

[0059] Among them, M i,k refers to the situation awareness module after localization, θ i,k Refers to the situational awareness module M i,k All parameters of f refers to the whole localization process, the randomly selected feature extraction module M k At the edge node E i The localization function on , that is, the localization process.

[0060] Step 2.4: Optimize the parameters of the situational awareness module. Although the computing resources and storage resources of edge nodes are better than those of end nodes, they are still inferior to those of the cloud. Moreover, a specific edge node is associated with multiple end nodes at the same time. Therefore, when optimizing the parameters of the situational awareness module, the edge node E i ∈ε situation awareness module M i,k , M k All the original parameters θ i,k \θ i Will be frozen, no changes, only localized module L i The parameter θ i will continue to improve as the training process progresses. Here, we use Represents the loss function of the situation awareness module. The process of optimizing parameters aims to minimize the loss function, as follows:

[0061]

[0062] Among them, using Represents all end nodes, and an end node with index j is represented as and Respectively represent the end nodes T jUpload to edge node E i data and data labels, and θ j Refers to all parameters of the situation awareness module θ i,k Using the end node T j Data uploaded to edge nodes and parameters after data label optimization.

[0063] In step S103, noise data is generated by a noise generation method, and the parameters of the situation awareness module are optimized twice using the noise data and the original data to obtain a situation awareness module with active defense capability.

[0064] In an embodiment of the present invention, noise data is generated by a noise generation method, and the parameters of the situation awareness module are optimized twice using the noise data and the original data to obtain a situation awareness module with active defense capability, including:

[0065] Generate noise data by using a noise generation method;

[0066] Use noise data and original data to optimize the parameters θ of the situation awareness module j , where the parameters of the situation awareness module after secondary optimization are for:

[0067]

[0068] Among them, β0 is an evaluation parameter used to weigh the ability of the situational awareness module in terms of benign data and active defense capability. is the loss function of the situation awareness module, j is the index number of the end node, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j The data uploaded to the edge node and the optimized parameters of the data label, s is the noise generation method used, A collection of noise generation methods.

[0069] Specifically, the parameters θ of the situation awareness module optimized according to step 2.4 are j It performs well in terms of benign perception data. However, the data perceived by the end node is likely to be interfered by the external environment, which may cause the situation awareness module to make wrong decisions. Similar to the active immunity achieved by vaccination in biology, a variety of gradient-based noise generation methods are used to generate noisy perception data and secondary optimize the parameters θ of the situation awareness module. j, and then build a situational awareness module with active defense capabilities.

[0070] Step 3.1: Data enhancement based on the idea of ​​active immunity. Gradient-based noise generation method is a widely used scheme, such as FGSM, PGD, etc. Represents N” optional noise generation methods. For each noise generation method All based on step 2.4 and θ j , generate the corresponding noise version data

[0071] Step 3.2: Active defense capability improvement based on secondary optimization. After completing step 3.1, for each noise generation method There are corresponding noise versions of data Combining the original data and various noise versions of the data, the secondary training process is as follows:

[0072]

[0073] in, Refers to the end node T j The situation awareness task in β0 has a parameter of active defense capability. β0 is used to weigh the ability of the situation awareness module in terms of benign data and active defense capability, and the value of β0 cannot be less than 0.5. s Noise Generation Method Association can be manually configured and satisfies the following formula:

[0074]

[0075] In step S104, the situation awareness module is used to perform real-time situation awareness on the sensed data by the end node.

[0076] In an embodiment of the present invention, a situation awareness module is used to perform real-time situation awareness of the perceived data by the end node, including: before executing the situation awareness task, the associated edge node obtains the architectural configuration of the initial situation awareness module to perform the initialization operation of the situation awareness module of the end node; each end node uploads the data collected by the node to the associated edge node at a specific synchronization time interval, updates the data stored in the edge node by incremental update, and the end node uses the edge node to obtain the situation awareness module with active defense capability, and the end node instructs the edge node to update the parameters of the situation awareness module with active defense capability using the updated data; each end node perceives external data in real time, and updates the parameters of the situation awareness module with active defense capability at the operating time interval.

[0077] In an embodiment of the present invention, when updating data stored in an edge node by incremental updating, it also includes: the edge node saves data in a preset time period before the current time through a time window, and uses the newly saved data to eliminate data outside the time window.

[0078] For example, taking the storage of data within 24 hours as an example, the edge node can store the data within 24 hours before the current time through the time window. As time goes by, the edge node stores the latest data within 24 hours before the current time. While storing the latest data, the old data stored outside the time window is deleted.

[0079] Specifically, using the situation awareness module constructed in S102 and the situation awareness model parameters with active defense capability optimized in S103, the end node directly performs real-time situation awareness on the perceived data.

[0080] Step 4.1: For each end node Before performing the situation awareness task, from the associated edge node E i Download the architecture configuration of the situation awareness module constructed in step S102 to implement the initialization operation of the end node situation awareness module.

[0081] Step 4.2: For each end node Every specific synchronization time interval η, the data collected by the node is sent to and Upload to the associated edge node E i , and use incremental update to update edge nodes E i Storage and When performing incremental updates, the edge node uses a logic similar to that of a finite queue, that is, the data maintained is in a first-in-first-out manner, and only the data within the most recent window Λ is maintained, and Λ is much larger than η. j From the edge node E i Download the latest parameters with active defense capabilities obtained in step 3.2 Then, the end node T j Indicates edge node E i Step S103 is executed again using the incrementally updated data.

[0082] Step 4.3: For each end node Perceive the external data in real time, and execute the latest situation awareness module obtained in step 4.2 at a very small running time interval τ. Among them, τ is much smaller than η. Taking the abnormal traffic detection in network security incident identification as an example, the situation awareness module will give whether the network traffic in the recent τ time period is abnormal.

[0083] In summary, the present invention proposes a hierarchical situational awareness method with active defense capability in an end-edge cloud scenario, which is mainly used for resource-constrained end nodes in complex heterogeneous network scenarios of end-edge clouds to make accurate and efficient decisions using perceived data, such as data packet scheduling decisions and network security event identification decisions. First, in view of the current situation that a variety of neural network models can be used for the same type of situational awareness tasks, and the advantages of abundant cloud computing resources and storage resources, a model library for a certain type of preset tasks is established in the cloud, and a large number of neural network models trained and optimized by cloud computing resources are stored in the model library. Considering that the overhead of direct communication between the end node and the cloud is relatively high, and the computing and storage resources of the end node are very limited, and the edge node has the advantage of low communication overhead compared to the cloud, the edge network is used as an intermediate bridge, and the edge node downloads the trained neural network from the cloud model library as a feature extraction module, and combines the specific data uploaded by the end node to the edge node to design a localization module, which is combined with the feature extraction module to form a situational awareness module. Subsequently, the data uploaded by the end node to the edge node is used to fine-tune the parameters of the situational awareness module. Considering that the data perceived by the end node may be interfered by the external environment, similar to the active immunity achieved by vaccination in biology, a variety of gradient-based noise generation methods are used to create noisy perception data, and these data are put together with the initial data to further optimize the situational awareness module, so that the situational awareness module can have stronger robustness and still show good performance in terms of noisy perception data. Finally, the end node will download the latest situational awareness module with active defense capabilities from the nearest edge node according to a specific time interval, and make accurate and efficient decisions on the perceived data in real time. The present invention can fully utilize computing resources and storage resources at different levels in a hierarchical manner in the complex and heterogeneous network scenario of the end-edge cloud, effectively avoiding the inefficiency caused by the communication overhead between different layers, and can use a quasi-active immunity method to give the situational awareness module the ability to actively defend against known and unknown external interference, so that the end node has the advantages of high accuracy and strong timeliness in real-time situational awareness, thereby ensuring that the end node can more efficiently complete network tasks such as data packet scheduling and network security event identification.

[0084] According to the hierarchical situational awareness method with active defense capability in the end-edge-cloud scenario proposed in the embodiment of the present invention, in order to improve the situational awareness capability of the end nodes and ensure the timeliness of situational awareness, a hierarchical approach is adopted to optimize the design of multiple modules such as the construction, training, optimization, and execution of the situational awareness model, and make full use of various resources and communication rules in the end-edge-cloud network. Based on the idea of ​​quasi-active immunity, the edge node gives the situational awareness module the ability to resist potential interference or attacks without affecting the end node's execution of real-time situational awareness tasks, thereby improving the robustness and availability of the situational awareness model. In terms of situational awareness in complex heterogeneous network scenarios of end-edge-cloud, it has the advantages of high accuracy, strong timeliness, and wide versatility, and is very suitable for deployment and application in real-world scenarios.

[0085] Secondly, a hierarchical situation awareness device with active defense capability in an edge-cloud scenario proposed in an embodiment of the present invention is described with reference to the accompanying drawings.

[0086] Figure 2 This is a schematic diagram of the results of a hierarchical situational awareness device with active defense capabilities in an edge-cloud scenario according to an embodiment of the present invention.

[0087] like Figure 2 As shown, the hierarchical situational awareness device with active defense capability in the end-edge-cloud scenario includes: a construction module 100, a first optimization module 200, a second optimization module 300 and a perception module 400.

[0088] Among them, the construction module 100 is used to construct a feature extraction module library corresponding to the preset task in the cloud. The first optimization module 200 is used to construct an initial situation awareness module at the edge node based on the situation awareness scenario of the end node and the feature extraction module randomly selected from the cloud feature extraction module library, and optimize the parameters of the situation awareness module. The second optimization module 300 is used to generate noise data through a noise generation method, and use the noise data and the original data to perform secondary optimization on the parameters of the situation awareness module to obtain a situation awareness module with active defense capabilities. The perception module 400 is used to use the situation awareness module to perform real-time situation awareness of the perceived data by the end node.

[0089] In an embodiment of the present invention, the construction module is further used to select multiple neural networks to construct a feature extraction module candidate set according to a preset task, and use cloud data to train and optimize the parameters of each feature extraction module in the feature extraction module candidate set; and filter each feature extraction module in the feature extraction module candidate set according to the filtering conditions to obtain a feature extraction module library.

[0090] In an embodiment of the present invention, the first optimization module is further used to randomly select a feature extraction module from a feature extraction module library through an edge node; determine a localization module based on the selected feature extraction module and the situation awareness scenario; combine the feature extraction module with the localization module to form a situation awareness module, and optimize the parameters of the situation awareness module using the data uploaded from the end node to the edge node.

[0091] In an embodiment of the present invention, the parameters of the situation awareness module are optimized, including: optimizing with the loss function of the situation awareness module minimized as the goal,

[0092]

[0093] in, is the loss function of the situation awareness module, j is the index number of the end node, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j Data uploaded to edge nodes and parameters after data label optimization.

[0094] In an embodiment of the present invention, the second optimization module is further used to generate noise data by a noise generation method;

[0095] Use noise data and original data to optimize the parameters θ of the situation awareness module j , where the parameters of the situation awareness module after secondary optimization are for:

[0096]

[0097] Among them, β0 is an evaluation parameter used to weigh the ability of the situational awareness module in terms of benign data and active defense capability. is the loss function of the situation awareness module, j is the index number of the end node, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j The data uploaded to the edge node and the optimized parameters of the data label, s is the noise generation method used, A collection of noise generation methods.

[0098] In an embodiment of the present invention, the perception module is further used to, before executing the situational awareness task, associate the edge node with the architecture configuration of the initial situational awareness module to perform the initialization operation of the situational awareness module of the end node; each end node uploads the data collected by the node to the associated edge node at each specific synchronization time interval, updates the data stored in the edge node by incremental update, and the end node uses the edge node to obtain the situational awareness module with active defense capability, and the end node instructs the edge node to update the parameters of the situational awareness module with active defense capability using the updated data; each end node perceives external data in real time, and updates the parameters of the situational awareness module with active defense capability at the operating time interval.

[0099] In an embodiment of the present invention, when updating data stored in an edge node by incremental updating, it also includes: the edge node saves data in a preset time period before the current time through a time window, and uses the newly saved data to eliminate data outside the time window.

[0100] It should be noted that the above explanation of the method embodiment is also applicable to the device of this embodiment, and will not be repeated here.

[0101] According to the hierarchical situational awareness device with active defense capability in the end-edge-cloud scenario proposed in the embodiment of the present invention, in order to improve the situational awareness capability of the end nodes and ensure the timeliness of situational awareness, a hierarchical approach is adopted to optimize the design of multiple modules such as the construction, training, optimization, and execution of the situational awareness model, and make full use of various resources and communication rules in the end-edge-cloud network. Based on the idea of ​​quasi-active immunity, the edge node gives the situational awareness module the ability to resist potential interference or attacks without affecting the end node's execution of real-time situational awareness tasks, thereby improving the robustness and availability of the situational awareness model. In terms of situational awareness in complex heterogeneous network scenarios of end-edge-cloud, it has the advantages of high accuracy, strong timeliness, and wide versatility, and is very suitable for deployment and application in real-life scenarios.

[0102] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0103] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0104] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A hierarchical situational awareness method with active defense capability in an edge-cloud scenario, characterized in that: The following steps are involved: Build a feature extraction module library corresponding to preset tasks in the cloud; According to the situation awareness scenario of the end node and the feature extraction module randomly selected from the feature extraction module library, an initial situation awareness module is constructed at the edge node, and the parameters of the situation awareness module are optimized; Generating noise data by a noise generation method, and performing secondary optimization on the parameters of the situation awareness module by using the noise data and the original data to obtain a situation awareness module with active defense capability; Using the situation awareness module, the end node performs real-time situation awareness on the perceived data; The optimizing of the parameters of the situation awareness module comprises: optimizing with the minimization of the loss function of the situation awareness module as the goal, in, is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j Data uploaded to edge nodes and parameters after data label optimization; The noise data is generated by the noise generation method, and the parameters of the situation awareness module are optimized twice using the noise data and the original data to obtain the situation awareness module with active defense capability, including: Generate noise data by using a noise generation method; Utilize the noise data and the original data to optimize the parameter θ of the situation awareness module j , where the parameters of the situation awareness module after secondary optimization are for: Among them, β0 is an evaluation parameter used to weigh the ability of the situational awareness module in terms of benign data and active defense capability. is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j The data uploaded to the edge node and the optimized parameters of the data label, s is the noise generation method used, A collection of noise generation methods; The method of using the situation awareness module to perform real-time situation awareness on the perceived data by the end node includes: Before executing the situation awareness task, the associated edge node obtains the architecture configuration of the initial situation awareness module to perform the initialization operation of the end node situation awareness module; Each end node uploads the data collected by the node to the associated edge node at a specific synchronization time interval, updates the data stored in the edge node by incremental update, and the end node uses the edge node to obtain the situation awareness module with active defense capability, and the end node instructs the edge node to update the parameters of the situation awareness module with active defense capability using the updated data; Each end node senses external data in real time and updates the parameters of the situation awareness module with active defense capability at a running time interval.

2. The method according to claim 1, characterized in that The feature extraction module library corresponding to the preset task is constructed in the cloud, including: Selecting multiple neural networks to construct a candidate set of feature extraction modules according to the preset task, and using cloud data to train and optimize the parameters of each feature extraction module in the candidate set of feature extraction modules; Each feature extraction module in the feature extraction module candidate set is screened according to the screening condition to obtain the feature extraction module library.

3. The method according to claim 1, characterized in that The method of constructing an initial situation awareness module at the edge node based on the situation awareness scenario of the end node and the feature extraction module randomly selected from the cloud feature extraction module library, and optimizing the parameters of the situation awareness module, includes: Randomly select a feature extraction module from the feature extraction module library through an edge node; Determine the localization module based on the selected feature extraction module and situation awareness scenario; The feature extraction module is combined with the localization module to form a situation awareness module, and the parameters of the situation awareness module are optimized using the data uploaded from the end node to the edge node.

4. The method according to claim 1, characterized in that When updating the data stored in the edge node by incremental update, it also includes: The edge node saves data within a preset time period before the current time through a time window, and uses the newly saved data to eliminate data outside the time window.

5. A hierarchical situational awareness device with active defense capability in an edge-cloud scenario, characterized in that: include: A construction module is used to build a feature extraction module library corresponding to the preset task in the cloud; A first optimization module is used to construct an initial situation awareness module at the edge node according to the situation awareness scenario of the end node and the feature extraction module randomly selected from the feature extraction module library, and optimize the parameters of the situation awareness module; A second optimization module is used to generate noise data by a noise generation method, and use the noise data and the original data to perform secondary optimization on the parameters of the situation awareness module to obtain a situation awareness module with active defense capability; A perception module, used to use the situation awareness module to enable the end node to perform real-time situation awareness on the perceived data; The optimizing of the parameters of the situation awareness module comprises: optimizing with the minimization of the loss function of the situation awareness module as the goal, in, is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j Data uploaded to edge nodes and parameters after data label optimization; The second optimization module is further used to: Generate noise data by using a noise generation method; Utilize the noise data and the original data to optimize the parameter θ of the situation awareness module j , where the parameters of the situation awareness module after secondary optimization are for: Among them, β0 is an evaluation parameter used to weigh the ability of the situational awareness module in terms of benign data and active defense capability. is the loss function of the situation awareness module, j is the end node index number, and Respectively represent the end nodes T j Upload to edge node E i data and data labels, θ j are all the parameters θ of the situation awareness module i,k Using the end node T j The data uploaded to the edge node and the optimized parameters of the data label, s is the noise generation method used, A collection of noise generation methods; The perception module is further used to, before executing the situational awareness task, associate the edge node with the architecture configuration of the initial situational awareness module to perform the initialization operation of the situational awareness module of the end node; each end node uploads the data collected by the node to the associated edge node at a specific synchronization time interval, updates the data stored in the edge node by incremental update, and the end node uses the edge node to obtain the situational awareness module with active defense capability, and the end node instructs the edge node to update the parameters of the situational awareness module with active defense capability using the updated data; each end node perceives external data in real time, and updates the parameters of the situational awareness module with active defense capability at a running time interval.

6. The device according to claim 5, characterized in that The construction module is further used to select multiple neural networks to construct a feature extraction module candidate set according to the preset task, and use cloud data to train and optimize the parameters of each feature extraction module in the feature extraction module candidate set; and filter each feature extraction module in the feature extraction module candidate set according to the filtering conditions to obtain the feature extraction module library.

7. The device according to claim 5, characterized in that The first optimization module is further used to randomly select a feature extraction module from the feature extraction module library through an edge node; determine a localization module based on the selected feature extraction module and the situation awareness scenario; combine the feature extraction module with the localization module to form a situation awareness module, and use the data uploaded from the end node to the edge node to optimize the parameters of the situation awareness module.

8. The device according to claim 5, characterized in that When updating the data stored in the edge node by incremental update, it also includes: The edge node saves data within a preset time period before the current time through a time window, and uses the newly saved data to eliminate data outside the time window.

Images