Task determination method, device, equipment and storage medium

Abstract

The present application provides a task determination method, apparatus, device and storage medium, which relate to the field of distributed system technology. The method is applied to a first device in a distributed scenario, where the first device refers to any device with threat handling capabilities, including: obtaining a capability information set, the capability information set includes capability information of all devices with threat handling capabilities in the distributed scenario, and each capability information is used to indicate the threat handling capabilities of the corresponding device; performing task scheduling based on the capability information included in the capability information set, and obtaining a task scheduling result, which is used to indicate the task allocation of threat handling. This avoids the need for communication negotiation between multiple devices, thereby saving communication overhead.

Description

Technical Field

[0001] The present application relates to the technical field of distributed systems, and in particular to a task determination method, apparatus, device and storage medium. Background Art

[0002] In distributed scenarios, in order to ensure the security of information transmission, threat processing can usually be performed to block some malicious attacks. Since the attack path in distributed scenarios is more complex and the threat processing capability of a single device is limited, multiple devices usually collaborate to achieve threat processing in distributed scenarios.

[0003] In the related art, it is usually necessary for each two devices in a distributed scenario to communicate and negotiate with each other to select one device from the multiple devices as the master device. The master device then performs task allocation, that is, determines which device or devices perform which tasks. Afterwards, the master device can send the results of the task allocation to other devices that need to perform tasks, so that threat processing can be achieved through the cooperation of these devices.

[0004] However, some devices in the distributed scenario may not have the threat handling capability, but in the above implementation, these devices without the threat handling capability still need to participate in the communication negotiation process, thus increasing additional communication overhead. Summary of the invention

[0005] The present application provides a task determination method, apparatus, device and storage medium, which solves the problem in the prior art that devices without threat handling capabilities still need to participate in the communication negotiation process, resulting in additional communication overhead.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, a task determination method is provided, which is applied to a first device in a distributed scenario, where the first device refers to any device with threat processing capability, including:

[0008] Acquire a capability information set, the capability information set including capability information of all devices with threat handling capabilities in the distributed scenario, each capability information being used to indicate the threat handling capability of the corresponding device;

[0009] Task scheduling is performed based on the capability information included in the capability information set to obtain a task scheduling result, where the task scheduling result is used to indicate a task allocation situation for threat processing.

[0010] As an example, any device with threat processing capabilities in a distributed scenario may have one or more threat processing capabilities.

[0011] As an example, the threat handling capability may include but is not limited to data collection capability, data analysis capability, and data interception capability. Data collection capability refers to the ability to collect data such as traffic and instructions, data analysis capability refers to the ability to analyze the collected data to determine whether it is threat data, and data interception capability refers to the ability to intercept threat data.

[0012] In the embodiment of the present application, the device with threat handling capability in the distributed scenario can determine the task allocation by itself, avoiding the need for communication negotiation between multiple devices, saving communication overhead. Moreover, even if a device goes offline or a new device comes online in the distributed scenario, the method provided in the embodiment of the present application does not require frequent selection of the master device, thereby improving the efficiency of determining tasks.

[0013] In a possible implementation of the present application, the method further includes:

[0014] If it is determined according to the task scheduling result that the first device needs to execute a task, then executing the task to be executed if the task execution condition is met;

[0015] The tasks include one or more of data collection tasks, data analysis tasks and data interception tasks.

[0016] Depending on the type of task that the first device needs to perform, the task execution conditions that need to be met are also different. As an example, if the task that the first device needs to perform is a data collection task, then if the data collection conditions are met, it is determined that the task execution conditions are met; as another example, if the task that the first device needs to perform is a data analysis task, then if the collected data is obtained, it is determined that the task execution conditions are met; as another example, if the task that the first device needs to perform is a data interception task, then if the data analysis results are obtained and the data analysis results indicate the presence of threat data, it is determined that the task execution conditions are met.

[0017] It should be noted that when the first device is assigned two or more tasks, the task execution conditions corresponding to each task may be different. In implementation, when the task execution conditions are met, the task corresponding to the currently met task execution conditions is executed, and the waiting state is entered for other tasks.

[0018] In a possible implementation of the present application, the method further includes:

[0019] generating a first scheduling result identifier for identifying the task scheduling result;

[0020] After the execution of the tasks required to be performed, it also includes:

[0021] If it is determined according to the task scheduling result that the task execution result of the first device needs to be sent to the second device, the task execution result of the first device and the first scheduling result identifier are sent to the second device, and the second device is a device other than the first device among all devices with threat processing capabilities in the distributed scenario.

[0022] In implementation, since the device may have abnormal information acquisition capability set, the task scheduling results of each device may be different, which leads to inconsistent task allocation. Therefore, in order to ensure the accuracy of determining the task, the first device can generate a first scheduling result identifier and send the first scheduling result identifier together with the task execution result to the second device, so that the second device can determine whether the task scheduling results are consistent, thereby improving the accuracy of determining the task.

[0023] In a possible implementation of the present application, before executing the task to be executed when the task execution condition is met, the method further includes:

[0024] If it is determined according to the task scheduling result that the task execution result of the third device needs to be used as the task execution condition, then upon receiving the task execution result of the third device and the second scheduling result identifier sent by the third device, the first scheduling result identifier is compared with the second scheduling result identifier, the third device being a device other than the first device among all devices with threat processing capabilities in the distributed scenario, and the second scheduling result identifier is used to identify the task scheduling result obtained by the third device performing task scheduling;

[0025] If the first orchestration result identifier is the same as the second orchestration result identifier, determining that the task execution condition is currently met;

[0026] When the task execution conditions are met, executing the tasks to be executed includes:

[0027] When the task execution condition is met, the task to be executed is executed based on the task execution result of the third device.

[0028] If a task execution result and a second orchestration result identifier are received from a third device, the second orchestration result identifier can be compared with the first orchestration result identifier. If they are the same, it means that the task orchestration result of the third device is the same as the task orchestration result of the first device. At this time, the task allocation situation is the same, so the corresponding task can be executed based on the task execution result of the third device, thereby ensuring the effectiveness of the task execution.

[0029] In a possible implementation of the present application, the method further includes:

[0030] If the first orchestration result identifier is different from the second orchestration result identifier, the process returns to execute the step of acquiring the capability information set and subsequent steps.

[0031] If the first scheduling result identifier is different from the second scheduling result identifier, it means that the task scheduling result of the first device is inconsistent with the task scheduling result of the third device. In this case, it may be caused by the abnormality of the first device obtaining the information capability set. Therefore, in order to ensure the consistency of the task scheduling results obtained by the subsequent re-task scheduling, the first device can re-acquire the capability information set and re-schedule the task. In this way, the system can be corrected through reconciliation to ensure the effectiveness and accuracy of task allocation in the system.

[0032] In a possible implementation of the present application, the acquiring capability information set includes:

[0033] Obtaining a capability information set stored in a distributed database in the distributed scenario;

[0034] The method further comprises:

[0035] If the first orchestration result identifier is different from the second orchestration result identifier, the capability information of the first device is written into the distributed database, and the process returns to execute the step of obtaining the capability information set and subsequent steps.

[0036] If the first scheduling result identifier is different from the second scheduling result identifier, it means that the task execution result of the first device is different from the task execution result of the third device. In this case, the first device may fail to write its own capability information. Therefore, in order to ensure that the task scheduling results obtained by subsequent rescheduling are consistent, the first device can rewrite its own capability information to the distributed database, then reacquire the capability information set, and rescheduling the task. In this way, the system can be corrected through reconciliation to ensure the effectiveness and accuracy of task allocation in the system.

[0037] In a second aspect, a task determination apparatus is provided, which is configured on a first device in a distributed scenario, wherein the first device refers to any device having a threat processing capability, including:

[0038] An acquisition module, used to acquire a capability information set, wherein the capability information set includes capability information of all devices with threat handling capabilities in the distributed scenario, and each capability information is used to indicate the threat handling capability of the corresponding device;

[0039] The scheduling module is used to perform task scheduling based on the capability information included in the capability information set to obtain a task scheduling result, wherein the task scheduling result is used to indicate the task allocation status of threat processing.

[0040] In a possible implementation of the present application, the device further includes:

[0041] A task execution module, configured to execute the task to be executed if it is determined according to the task scheduling result that the first device needs to execute a task and if a task execution condition is met;

[0042] The tasks include one or more of data collection tasks, data analysis tasks and data interception tasks.

[0043] In a possible implementation of the present application, the task execution module is further used to:

[0044] generating a first scheduling result identifier for identifying the task scheduling result;

[0045] If it is determined according to the task scheduling result that the task execution result of the first device needs to be sent to the second device, the task execution result of the first device and the first scheduling result identifier are sent to the second device, and the second device is a device other than the first device among all devices with threat processing capabilities in the distributed scenario.

[0046] In a possible implementation of the present application, the task execution module is further used to:

[0047] If it is determined according to the task scheduling result that the task execution result of the third device needs to be used as the task execution condition, then upon receiving the task execution result of the third device and the second scheduling result identifier sent by the third device, the first scheduling result identifier is compared with the second scheduling result identifier, the third device being a device other than the first device among all devices with threat processing capabilities in the distributed scenario, and the second scheduling result identifier is used to identify the task scheduling result obtained by the third device performing task scheduling;

[0048] If the first orchestration result identifier is the same as the second orchestration result identifier, determining that the task execution condition is currently met;

[0049] When the task execution condition is met, the task to be executed is executed based on the task execution result of the third device.

[0050] In a possible implementation of the present application, the task execution module is further used to:

[0051] If the first orchestration result identifier is different from the second orchestration result identifier, the process returns to execute the step of acquiring the capability information set and subsequent steps.

[0052] In a possible implementation of the present application, the acquisition module is used to:

[0053] Obtaining a capability information set stored in a distributed database in the distributed scenario;

[0054] The task execution module is also used for:

[0055] If the first orchestration result identifier is different from the second orchestration result identifier, the capability information of the first device is written into the distributed database, and the process returns to execute the step of obtaining the capability information set and subsequent steps.

[0056] According to a third aspect, an electronic device is provided, wherein the structure of the electronic device includes a processor and a memory, wherein the memory is used to store a program that supports the electronic device to execute any of the task determination methods described in the first aspect, and to store data involved in implementing any of the task determination methods described in the first aspect; the processor is configured to execute the program stored in the memory; the electronic device may also include a communication bus, wherein the communication bus is used to establish a connection between the processor and the memory.

[0057] According to a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a computer, the computer executes the method as described in any one of the above-mentioned first aspects.

[0058] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the task determination method described in the first aspect.

[0059] The technical effects obtained by the above-mentioned second, third, fourth and fifth aspects are similar to the technical effects obtained by the corresponding technical means in the above-mentioned first aspect, and will not be repeated here.

[0060] The technical solution provided by this application can at least bring the following beneficial effects:

[0061] The first device in the distributed scenario obtains a capability information set. The first device has threat handling capabilities. The capability information set includes capability information of all devices with threat handling capabilities in the distributed scenario. Since each capability information indicates the threat handling capabilities of the corresponding device, the first device can perform task scheduling according to the capability information included in the capability information set and obtain a task scheduling result. The task allocation of each device can be determined according to the task scheduling result. This avoids the need for communication negotiation between multiple devices, thereby saving communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0063] Figure 2 A software structure block diagram of an electronic device provided in an embodiment of the present application;

[0064] Figure 3 A schematic diagram of a system architecture provided for an embodiment of the present application;

[0065] Figure 4 A flowchart of a task determination method provided in an embodiment of the present application;

[0066] Figure 5 A flowchart of another task determination method provided in an embodiment of the present application;

[0067] Figure 6 A flowchart of another task determination method provided in an embodiment of the present application;

[0068] Figure 7 A flowchart of another task determination method provided in an embodiment of the present application;

[0069] Figure 8 A flowchart of another task determination method provided in an embodiment of the present application;

[0070] Fig. 9 A schematic diagram of the structure of a task determination device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0072] It should be understood that the "multiple" mentioned in this application refers to two or more. In the description of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate the clear description of the technical solution of this application, the words "first" and "second" are used to distinguish between the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not limit them to be different.

[0073] First, the execution subject involved in the embodiment of the present application is introduced. The task determination method provided in the embodiment of the present application can be executed by an electronic device. In one embodiment, the electronic device may include smart home devices, terminals, car equipment, etc. Exemplarily, smart home devices may include but are not limited to smart speakers, smart TVs, smart toilets, smart washing machines, and smart air conditioners, and terminals may include but are not limited to mobile phones, tablet computers, personal digital assistants (PDAs), laptops, and portable computers, which are not limited in the embodiments of the present application.

[0074] See also Figure 1 , Figure 1 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0075] The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0076] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0077] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0078] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0079] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0080] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0081] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the electronic device 100.

[0082] The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset.

[0083] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0084] The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset.

[0085] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the shooting function of the electronic device 100. The processor 110 and the display screen 194 communicate via the DSI interface to implement the display function of the electronic device 100.

[0086] The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0087] The USB interface 130 is an interface that complies with the USB standard specification, and can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and a peripheral device. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other terminal devices, such as AR devices, etc.

[0088] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present invention is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0089] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the electronic device 100. While the charging management module 140 is charging the battery 142, it may also power the terminal device through the power management module 141.

[0090] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0091] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0092] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0093] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0094] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0095] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0096] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0097] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0098] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0099] The electronic device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0100] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0101] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0102] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the electronic device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0103] Video codecs are used to compress or decompress digital videos. The electronic device 100 may support one or more video codecs. Thus, the electronic device 100 may play or record videos in a variety of coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0104] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of electronic device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0105] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0106] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0107] The electronic device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0108] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0109] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0110] The receiver 170B, also called a "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the human ear.

[0111] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to microphone 170C to input the sound signal into microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C to collect sound signals, reduce noise, identify the sound source, realize directional recording function, etc.

[0112] The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0113] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The electronic device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the electronic device 100 detects the touch operation intensity according to the pressure sensor 180A. The electronic device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0114] The gyro sensor 180B can be used to determine the motion posture of the electronic device 100. In some embodiments, the angular velocity of the electronic device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyro sensor 180B. The gyro sensor 180B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyro sensor 180B detects the angle of the electronic device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the electronic device 100 through reverse movement to achieve anti-shake. The gyro sensor 180B can also be used for navigation and somatosensory game scenes.

[0115] The air pressure sensor 180C is used to measure air pressure. In some embodiments, the electronic device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

[0116] The magnetic sensor 180D includes a Hall sensor. The electronic device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the electronic device 100 is a flip phone, the electronic device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover can be automatically unlocked.

[0117] The acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device 100 in all directions (generally three axes). When the electronic device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the electronic device 100 and applied to applications such as horizontal and vertical screen switching and pedometers.

[0118] The distance sensor 180F is used to measure the distance. The electronic device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing.

[0119] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The electronic device 100 emits infrared light outward through the light emitting diode. The electronic device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 100. When insufficient reflected light is detected, the electronic device 100 can determine that there is no object near the electronic device 100. The electronic device 100 can use the proximity light sensor 180G to detect that the user holds the electronic device 100 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 180G can also be used in leather case mode and pocket mode to automatically unlock and lock the screen.

[0120] The ambient light sensor 180L is used to sense the ambient light brightness. The electronic device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the electronic device 100 is in a pocket to prevent accidental touches.

[0121] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0122] The temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the electronic device 100 reduces the performance of a processor located near the temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the electronic device 100 heats the battery 142 to avoid abnormal shutdown of the electronic device 100 due to low temperature. In other embodiments, when the temperature is lower than another threshold, the electronic device 100 performs a boost on the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.

[0123] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device 100, which is different from the position of the display screen 194.

[0124] The bone conduction sensor 180M can obtain a vibration signal. In some embodiments, the bone conduction sensor 180M can obtain a vibration signal of a vibrating bone block of the vocal part of the human body. The bone conduction sensor 180M can also contact the human pulse to receive a blood pressure beat signal. In some embodiments, the bone conduction sensor 180M can also be set in an earphone and combined into a bone conduction earphone. The audio module 170 can parse out a voice signal based on the vibration signal of the vibrating bone block of the vocal part obtained by the bone conduction sensor 180M to realize a voice function. The application processor can parse the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 180M to realize a heart rate detection function.

[0125] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The electronic device 100 may receive key input and generate key signal input related to user settings and function control of the electronic device 100.

[0126] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0127] Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc.

[0128] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the electronic device 100 by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195. The electronic device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The electronic device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the electronic device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0129] The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. In the embodiment of the present invention, the Android system of the layered architecture is taken as an example to exemplify the software structure of the electronic device 100.

[0130] Figure 2 It is a software structure block diagram of the electronic device 100 according to an embodiment of the present application.

[0131] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.

[0132] The application layer can include a series of application packages.

[0133] like Figure 2 As shown, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.

[0134] Furthermore, the application layer may also include at least one of a collector, an analyzer and an interceptor.

[0135] The collector can be used to obtain source data from a local database. The source data of the local database can be obtained by detecting the collection probe. As an example, the source data includes traffic and / or instructions. Further, the obtained source data can be parsed into a target file in combination with the task scheduling result, and the target file is sent to the electronic device equipped with the analyzer through a remote procedure call (RPC).

[0136] The analyzer can be used to obtain the data collected by the collector through a local or RPC interface (for example, the data includes the above-mentioned target file), call the Software Development Kit (SDK), and send the data to the SDK for data analysis and processing. After that, the task execution result returned by the SDK can be obtained. In addition, the task execution result can be sent to an electronic device equipped with an interceptor through RPC in combination with the task scheduling result. The analyzer can also be used to update local models (such as artificial intelligence (AI) models) and manage multiple engines, etc., wherein a variety of analysis capabilities are integrated in the multiple engines.

[0137] The interceptor can be used to obtain data from other electronic devices through local or RPC interfaces, and then complete the data interception task through SDK based on the data combined with local security policies. Among them, the local security policy can be set according to actual needs.

[0138] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0139] like Figure 2 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, an orchestrator, a configuration management service module, and the like.

[0140] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0141] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0142] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0143] The phone manager is used to provide communication functions of the electronic device 100, such as management of call status (including connecting, hanging up, etc.).

[0144] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0145] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, an electronic device vibrates, an indicator light flashes, etc.

[0146] The orchestrator can register the threat handling capability of the electronic device 100 with the soft bus, and receive a capability information set, perform task scheduling for threat handling based on the capability information set, thereby determining the task scheduling result, and notify the application layer of the task scheduling result so that the application layer can execute the corresponding task.

[0147] The configuration management service module can be used to maintain local configuration files, which may include but are not limited to one or more of a task scheduling policy file and an interception policy file, wherein the task scheduling policy file refers to a file related to the task scheduling policy, and the interception policy file refers to a file related to the interception policy. In implementation, the configuration management service module can remotely download and locally verify the local configuration file. In addition, the configuration management service module can also be used to implement remote downloading and local verification of AI models, wherein the AI ​​model can be used for data analysis and detection.

[0148] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0149] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0150] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0151] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), distributed database, etc.

[0152] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0153] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0154] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0155] A 2D graphics engine is a drawing engine for 2D drawings.

[0156] In the embodiment of the present application, the distributed database can at least be used to store capability information of the electronic device.

[0157] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0158] The following is an illustrative description of the workflow of the software and hardware of the electronic device 100 in conjunction with capturing a photo scene.

[0159] When the touch sensor 180K receives a touch operation, the corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, timestamp of the touch operation, and other information). The raw input event is stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer and identifies the control corresponding to the input event. For example, if the touch operation is a touch single-click operation and the control corresponding to the single-click operation is the control of the camera application icon, the camera application calls the interface of the application framework layer to start the camera application, and then starts the camera driver by calling the kernel layer to capture static images or videos through the camera 193.

[0160] Next, we will briefly introduce the system architecture of the embodiment of this application. Please refer to Figure 3 ,The system architecture mainly includes application layer, framework layer, system layer and hardware layer.

[0161] The application layer mainly includes collectors, analyzers and interceptors.

[0162] The collector may include a collection service unit, which may provide collection services for the collector; the analyzer includes an SDK and an analysis engine service unit, which performs data analysis by calling the analyzer's SDK, and the analysis engine service unit may be used to provide analysis services for the analyzer's SDK; the interceptor includes an SDK and a protection framework service unit, which implements data interception by calling the system layer's protection isolation interface through the interceptor's SDK, and the protection framework service unit may provide interception services for the interceptor's SDK.

[0163] The framework layer includes the orchestrator and configuration management service modules. For specific functions, see above.

[0164] The system layer at least includes a collection probe, a device product model, a soft bus, and a protection isolation interface. The collection probe can be used to collect data for the collector to call; the device product model can be used to describe the device's capability information; the soft bus can be used to implement bus communication functions, which can usually include buses with different access mechanisms, such as distributed soft buses, Hicom buses, or HiChain buses; the protection isolation interface can be called by the SDK in the interceptor to implement data interception.

[0165] As an example, the hardware layer includes multiple electronic devices such as routers, TV (television), speakers, PADs and mobile phones. That is, the multiple electronic devices collaborate to implement threat processing in a distributed scenario corresponding to the system architecture.

[0166] For ease of understanding and distinction, the following description will be made by taking the task determination method applied to a first device as an example. The first device is any device with threat processing capability in a distributed scenario. Specifically, the first device may be the electronic device 100. Figure 1-Figure 3 The specific implementation of the task determination method provided by the embodiment of the present application is introduced by the first device, please refer to Figure 4 , Figure 4 is a schematic flow chart of a task determination method provided in an embodiment of the present application, which method may include part or all of the following contents:

[0167] Step 401: The first device obtains a capability information set, where the capability information set includes capability information of all devices with threat handling capabilities in a distributed scenario, and each capability information is used to indicate the threat handling capability of the corresponding device.

[0168] The threat processing capability refers to the ability to process threat data. The processing described here may include but is not limited to data collection processing, data analysis processing and data interception processing.

[0169] As an example, the threat handling capability may include but is not limited to data collection capability, data analysis capability, and data interception capability. Data collection capability refers to the ability to collect data such as traffic and instructions, data analysis capability refers to the ability to analyze the collected data to determine whether it is threat data, and data interception capability refers to the ability to intercept threat data.

[0170] In one embodiment, any device with threat processing capabilities in a distributed scenario may have one or more threat processing capabilities. For example, the first device may only have data collection capabilities. For another example, the first device may have both data collection capabilities and data analysis capabilities. This embodiment of the present application does not limit this.

[0171] As an example, a specific implementation of the first device acquiring the capability information set may include: the first device acquires the capability information set stored in a distributed database in a distributed scenario.

[0172] For each device with threat handling capability in a distributed scenario, its capability information can be written into the distributed database in advance. Taking the first device as an example, the first device can write its capability information into the distributed database after it is powered on. That is, the distributed database stores the capability information of each device with threat handling capability in a distributed scenario, which is referred to as a capability information set. In this way, the first device obtains the capability information set in the distributed database when necessary.

[0173] As an example, the capability information in the capability information set may include static capability information or dynamic capability information, wherein the so-called static capability information generally refers to capability information that will not change; and the so-called dynamic capability information generally refers to capability information that will change under certain conditions. For example, if the first device has data collection capability and data analysis capability under preset conditions, otherwise the first device only has data collection capability but not data analysis capability, then the first device can determine its own capability information based on whether the preset conditions are currently met, and update its own capability information in the distributed database if the capability changes. The preset conditions can be set according to actual needs.

[0174] As an example, the first device may obtain the capability information set under a specified trigger condition, wherein the specified trigger condition may be set according to actual needs. Exemplarily, the first device may obtain the capability information set after writing its own capability information into a distributed database and determining that the writing is successful, that is, the specified trigger condition may be the successful writing of the capability information into the distributed database.

[0175] Of course, the above is an example of obtaining an information capability set from a distributed database. In another embodiment, the information capability set can also be obtained in other ways. As an example, the distributed scenario may include a target device dedicated to storing the information capability set, and other devices in the distributed scenario can establish communication with the target device. Devices with threat processing capabilities in the distributed scenario can store their respective capability information in the target device in advance, so that the first device can obtain the information capability set from the target device. The embodiments of the present application are not limited to this.

[0176] It is not difficult to understand that for devices that do not have threat handling capabilities in distributed scenarios, they cannot participate in threat handling capabilities, so no capability information will be written into the distributed data. That is, devices that do not have threat handling capabilities do not need to participate in the threat handling process, thus avoiding the need to add additional communication overhead.

[0177] Step 402: The first device performs task scheduling based on the capability information included in the capability information set to obtain a task scheduling result, where the task scheduling result is used to indicate a task allocation status of threat processing.

[0178] The task allocation includes which device among all devices with threat processing capabilities in a distributed scenario needs to perform which task or tasks. In one embodiment, the task includes but is not limited to a data collection task, a data analysis task, and a data interception task. A data collection task refers to a task for collecting data such as traffic and instructions, a data analysis task refers to a task for analyzing the collected data to determine whether it is threat data, and a data interception task refers to a task for intercepting threat data.

[0179] For example, assuming that the devices with threat processing capabilities in the distributed scenario include a first device, a second device, and a third device, the task scheduling result may indicate that the first device is required to perform a data collection task, the second device is required to perform a data analysis task, and the third device is required to perform a data interception task. The first device can determine whether it has a task to perform and what task it needs to perform based on the task scheduling result.

[0180] As an example, performing task scheduling based on capability information included in the capability information set and obtaining the task scheduling result may include: the first device performs task scheduling according to a specified scheduling strategy based on the capability information included in the capability information set to obtain the task scheduling result.

[0181] The designated orchestration strategy can be pre-set according to actual needs. As an example, the designated orchestration strategy can refer to a strategy related to device priority. For example, if there are three devices with threat processing capabilities in a distributed scenario, the device with the lowest device priority can be assigned a data collection task, the device with the second highest device priority can be assigned a data analysis task, and the device with the highest device priority can be assigned a data interception task.

[0182] It should be noted that the specified orchestration strategy can be stored in all devices with threat handling capabilities in the distributed scenario, and can be maintained by the configuration management service module in the device. That is, the orchestration strategy in all devices with threat handling capabilities in the distributed scenario is the same.

[0183] As an example, when the specified scheduling policy is a policy related to device priority, the first device can also obtain the device priority of all devices with threat processing capabilities in the distributed scenario, for example, from a distributed database. Then, the first device performs task scheduling according to the specified scheduling policy based on the capability information included in the capability information set and the acquired device priority, and obtains the task scheduling result.

[0184] It is worth mentioning that in the embodiment of the present application, the device with threat handling capability in the distributed scenario can determine the task allocation by itself, avoiding the need for communication and negotiation between multiple devices, saving communication overhead. Moreover, even if a device goes offline or a new device comes online in the distributed scenario, the method provided in the embodiment of the present application does not require frequent selection of the master device, thereby improving the efficiency of determining tasks.

[0185] It should be noted that the task determination method provided by the embodiment of the present application has been implemented. Further, after determining the task, the first device can also perform other operations, for example, it can execute the assigned task according to actual needs, and send the task execution result to other devices, etc., please refer to the following steps for details.

[0186] Step 403: If the first device determines that the first device needs to execute a task according to the task scheduling result, then the task to be executed is executed if the task execution condition is met.

[0187] The tasks to be performed may include, but are not limited to, one or more of a data collection task, a data analysis task, and a data interception task.

[0188] The first device may determine what kind of task it needs to perform according to the task scheduling result, and perform the corresponding task when it is determined that the task execution condition is currently met.

[0189] In implementation, different types of tasks that need to be performed by the first device require different task execution conditions. As an example, if the task that the first device needs to perform is a data collection task, then the task execution condition is determined to be met when the data collection condition is met; as another example, if the task that the first device needs to perform is a data analysis task, then the task execution condition is determined to be met when the collected data is obtained; as another example, if the task that the first device needs to perform is a data interception task, then the task execution condition is determined to be met when the data analysis result is obtained and the data analysis result indicates the existence of threat data.

[0190] In one embodiment, the first device may also generate a first orchestration result identifier for identifying the task orchestration result. In this case, after the first device executes the task that needs to be executed, if it is determined based on the task orchestration result that the task execution result of the first device needs to be sent to the second device, the task execution result of the first device and the first orchestration result identifier are sent to the second device. The second device is a device other than the first device among all devices with threat processing capabilities in a distributed scenario.

[0191] As an example, after the orchestrator in the first device executes task orchestration, a coding sequence may be generated, and then a first orchestration result identifier may be generated for the coding sequence. The first orchestration result identifier may be used to uniquely identify the task orchestration result obtained after the first device executes task orchestration. Exemplarily, the first orchestration result identifier may be recorded as a first ID (Identity).

[0192] Based on the above description, it can be known that if it is determined according to the task scheduling result that the task of the first device is a data collection task, then since the data needs to be analyzed after the data is collected, the first device determines that the collected data (task execution result) needs to be sent to the second device with the data analysis task, and the first device can determine the second device that needs to perform the data analysis task according to the task scheduling result. Alternatively, if it is determined according to the task scheduling result that the task of the first device is a data analysis task, then since it may be necessary to intercept the threat data if it is determined after the data analysis that there is threat data, the first device determines that the data analysis result (and task execution result) needs to be sent to the second device with the data interception task, and the first device can determine the second device that needs to perform the data interception task according to the task scheduling result.

[0193] Under normal communication conditions, the task scheduling results determined between various devices should be consistent. However, in implementation, since devices with threat handling capabilities in distributed scenarios may have abnormalities in obtaining information capability sets, for example, since the capability information of some devices is dynamically changing, if the distributed database does not synchronize data in a timely manner, the information capability set obtained by the first device may not include the latest capability information of all devices with threat handling capabilities. Therefore, if it is determined based on the task scheduling results that the task execution result of the first device needs to be sent to the second device, in order to ensure that the task scheduling results determined between various devices are consistent, the first device can send the first scheduling result identifier together with the task execution result of the first device to the second device.

[0194] As an example, if it is determined based on the task scheduling result that the task execution result of the third device needs to be used as a task execution condition, then when the task execution result of the third device and the second orchestration result identifier sent by the third device are received, the first orchestration result identifier is compared with the second orchestration result identifier. The third device is a device other than the first device among all devices with threat processing capabilities in a distributed scenario. The second orchestration result identifier is used to identify the task scheduling result obtained by the third device through task scheduling. If the first orchestration result identifier is the same as the second orchestration result identifier, it is determined that the task execution condition is currently met.

[0195] In one embodiment, the third device may be the same device as the second device.

[0196] Similar to the first device, after performing task orchestration, the scheduler of the third device may generate a coding sequence, and then generate a second orchestration result identifier for identifying the task orchestration result of the third device based on the coding sequence. Exemplarily, the second orchestration result identifier may be recorded as the second ID. Further, after the third device completes the task, if it is determined based on the task orchestration result of the third device that the task execution result of the third device needs to be sent to the first device, the task execution result of the third device and the second orchestration result identifier are sent to the first device together.

[0197] For the first device, the task execution result and the second orchestration result identifier of the third device are received. In addition, the first device can return the local first orchestration result identifier through an RPC call, and then compare the first orchestration result identifier with the second orchestration result identifier to determine whether the two are the same. If the first orchestration result identifier is the same as the second orchestration result identifier, it means that the task orchestration result of the first device is consistent with the task orchestration result of the third device, which can indicate that there is no abnormality in the first device's acquisition of the information capability set. At this time, the first device determines that the task execution condition is currently met. That is, when the first device receives the task execution result of the third device and determines that the first orchestration result identifier is the same as the second orchestration result identifier, it determines that the task execution condition is met.

[0198] As an example, in the above implementation, after determining that the task execution condition is currently met, the first device executes the task to be executed based on the task execution result of the third device. For example, if the task to be executed by the first device is a data interception task, and the task execution result of the third device indicates that there is threat data, the first device executes the data interception operation.

[0199] It should be noted that the above is an example of executing the data interception task when the task of the first device is a data interception task, when the first orchestration result identifier is the same as the second orchestration result identifier, and when the task execution result of the third device indicates that there is threat data. In another embodiment, if the task of the first device is a data interception task, when the first orchestration result identifier is the same as the second orchestration result identifier, and when the task execution result of the third device indicates that there is threat data, the first device can also combine the local security policy to decide whether to perform data interception, wherein the local security policy can be set by the user according to actual needs, and the embodiment of the present application does not limit this.

[0200] As an example, if the first orchestration result identifier is different from the second orchestration result identifier, the process returns to the step of acquiring the capability information set and subsequent steps.

[0201] If the first orchestration result identifier is different from the second orchestration result identifier, it means that the task orchestration result of the first device is inconsistent with the task orchestration result of the third device. In this case, it may be caused by an abnormality in the first device obtaining the information capability set. Therefore, in order to ensure that the task orchestration results obtained by subsequent re-task orchestration are consistent, the first device can re-acquire the capability information set and perform task orchestration based on the re-acquired information capability set according to the above implementation process to re-obtain the task orchestration result and the orchestration result identifier used to identify the task orchestration result.

[0202] As another example, if the first orchestration result identifier is different from the second orchestration result identifier, the capability information of the first device is written into the distributed database, and the step of obtaining the capability information set and subsequent steps are returned to execute.

[0203] In one possible implementation, if the first orchestration result identifier is different from the second orchestration result identifier, it means that the task execution result of the first device is different from the task execution result of the third device. In this case, the first device may fail to write its own capability information. Therefore, in order to ensure that the task orchestration results obtained by subsequent re-task orchestration are consistent, the first device can re-write its own capability information to the distributed database, and then re-acquire the capability information set, and perform task orchestration based on the re-acquired information capability set according to the above implementation process, so as to re-obtain the task orchestration result and the orchestration result identifier used to identify the task orchestration result.

[0204] Furthermore, if the first orchestration result identifier is different from the second orchestration result identifier, the first device can send a match failure message to the third device. Accordingly, after receiving the match failure message, the third device can re-write the capability information of the third device into the distributed database, and then re-acquire the capability information set, and perform task orchestration based on the re-acquired information capability set, that is, the third device also re-arranges tasks and executes the tasks that need to be executed according to the task orchestration results obtained by the re-task orchestration.

[0205] Of course, for the first device, it is also possible to receive a matching failure message from the second device. For example, in the above implementation, if the first device sends its task execution result and the first orchestration result identifier to the second device, and then receives a matching failure message from the second device, it means that the second device matches the first orchestration result identifier with its own third orchestration result identifier and determines that the two are different. At this time, it means that the task orchestration result of the first device is different from the orchestration result of the second device. In this case, in one possible implementation, it may be caused by the failure of the first device to write capability information, so the first device rewrites its own capability information, then reacquires the information capability set, and performs tasks and other operations based on the reacquired information capability set; in another possible implementation, it may also be caused by the abnormality of the first device reading the information capability set. At this time, the first device reacquires the information capability set, and performs tasks and other operations based on the reacquired information capability set.

[0206] It is worth mentioning that the above-mentioned first device also generates a first scheduling result identifier for identifying its task scheduling result, so that the first device and other devices with threat processing capabilities in a distributed scenario can determine whether the task scheduling results are consistent, which can avoid errors in the allocation of threat processing tasks as much as possible, thereby ensuring the effectiveness and accuracy of the first device in determining the task.

[0207] In an embodiment of the present application, the first device in a distributed scenario obtains a capability information set, and the first device has threat handling capabilities. The information capability set includes capability information of all devices with threat handling capabilities in the distributed scenario. Since each capability information indicates the threat handling capabilities of the corresponding device, the first device can perform task scheduling according to the capability information included in the information capability set, obtain a task scheduling result, and determine the task allocation of each device according to the task scheduling result. This avoids the need for communication negotiation between multiple devices, thereby saving communication overhead.

[0208] Based on the task determination method provided above, for ease of understanding, the implementation process of the method will be described in detail with several specific examples. The method may include some or all of the following contents:

[0209] Please refer to Figure 5 , Figure 5 This is a flowchart of a task determination method according to an exemplary embodiment. The method is applied in a distributed scenario. Here, the distributed scenario including a first device and a second device is used as an example for explanation. Please refer to Figure 6 The first device and the second device both include an application layer, a framework layer and a system layer, wherein the application layer of the first device includes a collector, and the application layer of the second device includes an analyzer. The framework layer includes an orchestrator, through which task orchestration can be implemented, and the system layer includes a distributed database, which can be used to store information capability sets.

[0210] Please continue to refer to Figure 5 Next, take the first device as an example and combine Figure 6 The various layers shown describe the execution process of task determination:

[0211] 501: The first device writes its own capability information into the distributed database.

[0212] As an example, after the first device is powered on, it writes its own capability information to the distributed database through the orchestrator.

[0213] As another example, the first device may also write its own capability information into the distributed database through the orchestrator under the triggering of the application layer. For example, the user may trigger the orchestrator to perform the write operation through the application software of the application layer.

[0214] Similarly, the second device will also write the capability information of the second device into the distributed database. The specific writing method can refer to the writing process of the first device, which will not be repeated here.

[0215] 502: The first device obtains an information capability set from a distributed database.

[0216] As an example, the information capability set includes capability information of the first device and capability information of the second device.

[0217] In implementation, the first device may obtain the information capability set from a distributed database in the distributed scenario through an orchestrator.

[0218] 503: The first device performs task scheduling based on the information capability set to obtain a task scheduling result.

[0219] As an example, the first device performs task orchestration through the orchestrator based on capability information of the first device and capability information of the second device included in the acquired information capability set.

[0220] 504: The first device generates a first ID for identifying the task scheduling result.

[0221] Exemplarily, the first device generates a coding sequence through an arranger, and then generates a unique first ID for the coding sequence.

[0222] 505: The first device executes the task to be executed when the task execution condition is met.

[0223] Assuming that the first device determines that a data collection task needs to be executed based on the task scheduling result, the first device performs data collection when it determines that the data collection conditions are currently met to obtain a task execution result. Exemplarily, the task execution result includes a target file, and the target file includes the collected data.

[0224] 506: The first device sends the task execution result and the first ID to the second device.

[0225] 507: The second device receives the task execution result and the first ID sent by the first device.

[0226] It should be noted that for the second device, the execution process is similar to that of the first device. Please refer to Figure 5, the second device writes its own capability information to the distributed database, then obtains the information capability set from the distributed device, performs task scheduling based on the acquired information capability set, obtains the task scheduling result, and generates a second ID for identifying the task scheduling result of the second device. The second device determines that the task to be executed is a data analysis task based on the task scheduling result, so the second device enters a waiting state, that is, waiting for the data sent by the first device.

[0227] 508: The second device determines whether the first ID is the same as the second ID.

[0228] The second ID is generated by the second device and is used to identify the task scheduling result of the second device.

[0229] 509: If the first ID is the same as the second ID, the second device executes the corresponding task based on the task execution result of the first device.

[0230] As an example, after receiving the data, the second device compares the first ID sent by the first device with the first ID generated by itself. If the first ID is the same as the second ID, it means that the task scheduling result of the first device is the same as the task scheduling result of the second device, which means that there is no abnormality in the information capability set obtained by the first device and the second device. At this time, the second device can perform data analysis based on the data collected by the first device.

[0231] As an example, if the first ID is different from the second ID, the second device returns to execute the step of writing the capability information of the second device into the distributed database to rewrite and read the capabilities and re-schedule the tasks.

[0232] Furthermore, if the first ID is different from the second ID, the second device may send a matching failure message to the first device. After receiving the matching failure message, the first device returns to execute the step of writing the capability information of the first device into the distributed database to rewrite and read the capability and re-schedule the task.

[0233] Next, we will take the distributed scenario of a home distributed scenario as an example. The home distributed scenario includes a router, a control center (such as a smart speaker), a smart TV, a portable Android device (PAD) and a mobile phone. Among them, the router has the ability to collect traffic, and the router also has the ability to intercept data; the control center can extract control instructions for the Internet of Things (IoT) devices, such as the HiLink instruction, and the control center also has the ability to intercept data; the mobile phone can be used to extract logs; in addition, the mobile phone and the smart TV may be equipped with a neural network processor (Neural network Processing Unit, NPU) chip, which can provide AI computing capabilities. In this distributed scenario, please refer to Figure 7 , the following methods can be used to determine which device or devices need to perform which tasks to collaborate in threat processing:

[0234] 701: The application layer of the router sends a notification instruction to the orchestrator.

[0235] This notification indication is used to instruct the orchestrator to write capability information to the distributed database.

[0236] 702: The router's orchestrator writes capability information into the distributed database.

[0237] 703: The router's orchestrator obtains the information capability set from the distributed database.

[0238] 704: The router's scheduler performs task scheduling based on the information capability set and a specified scheduling strategy to obtain a task scheduling result.

[0239] 705: The router generates a first ID for identifying the task scheduling result.

[0240] It should also be noted that the above is an example of a router. In implementation, other electronic devices in the distributed scenario (including a control center, a smart TV, and a mobile phone) will also perform corresponding operations according to the implementation methods of 701 to 705 above. Figure 7 and 8 shown.

[0241] Assume that the task allocation of threat processing indicated by the task scheduling result includes: the router collects traffic and intercepts threatening traffic, the control center collects control instructions and intercepts threatening instructions, and the smart TV needs to perform data analysis tasks. For the router and the control center, the tasks to be performed are performed when it is determined that the task execution conditions are met, for example, the router collects traffic and the control center collects control instructions. In addition, for other electronic devices with tasks other than the router, they enter a waiting state, such as a smart TV entering a waiting state.

[0242] Please continue to refer to Figure 8 After collecting the traffic, the router sends the collected traffic and the first ID to the smart TV through the soft bus. In addition, after collecting the control instruction, the control center sends the control instruction and the second ID generated by the control center to the smart TV through the soft bus, wherein the second ID is used to identify the task scheduling result generated by the control center.

[0243] After receiving the data, the smart TV determines whether the first ID is the same as the third ID generated by the smart TV, and determines whether the first ID is the same as the third ID, wherein the third ID is used to identify the task scheduling result generated by the smart TV. If the first ID is the same as the third ID and the second ID is the same as the third ID, the smart TV determines that the task execution condition is met. In this case, the smart TV performs data analysis on the traffic and control instructions to determine whether the traffic and / or control instructions are threat data.

[0244] After the smart TV executes the data analysis task, it obtains the data analysis result (i.e., the task execution result). As an example, the data analysis result indicates that the traffic is threat data. At this time, the smart TV determines that the data analysis result needs to be sent to the router according to the task scheduling strategy, and then sends the data analysis result and the third ID to the router through the soft bus.

[0245] The router receives the data analysis result and the third ID sent by the smart TV, and determines whether the third ID is the same as the first ID. If they are the same, the router determines whether to perform the data interception task based on the data analysis result and the local security policy. Exemplarily, if it is determined that interception is required based on the data analysis result and the local security policy, the router intercepts the collected traffic.

[0246] It should be noted that the above is an example where the data analysis result indicates that the traffic is threat data. In another embodiment, if the data analysis result indicates that the control instruction is a threat instruction, the smart TV sends the data analysis result and the third ID to the control center. The control center receives the data analysis result and the third ID sent by the smart TV, and determines whether the third ID is the same as the second ID. If they are the same, the control center can determine whether to execute the data interception task based on the data analysis result and the local security policy.

[0247] It should also be noted that the above is explained by taking the case where the IDs of the various devices are the same as an example. In another embodiment, if the IDs are not the same, the above-mentioned multiple electronic devices stop executing the task. Exemplarily, the step of writing the capability information into the distributed database and the subsequent steps can be returned. For example, if the smart TV determines that the first ID is different from the third ID, and / or the second ID is different from the third ID, then rewrite its own capability information into the distributed database, reacquire the capability information set, and re-schedule the task. Furthermore, if the smart TV determines that the first ID is different from the third ID, and / or the second ID is different from the third ID, then the smart TV can also send a matching failure message to the router and the control center through the soft bus, respectively. In this way, for the router and the control center, after receiving the matching failure message, rewrite their own capability information into the distributed database, reacquire the capability information set, and re-schedule the task.

[0248] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0249] Corresponding to the task determination method described in the above embodiment, Fig. 9 This is a structural block diagram of a task determination device provided in an embodiment of the present application. For the sake of convenience of explanation, only the parts related to the embodiment of the present application are shown.

[0250] Reference Fig. 9 , the device comprises:

[0251] An acquisition module 910 is used to acquire a capability information set, where the capability information set includes capability information of all devices with threat handling capabilities in the distributed scenario, and each capability information is used to indicate the threat handling capability of the corresponding device;

[0252] The orchestration module 920 is used to perform task orchestration based on the capability information included in the capability information set to obtain a task orchestration result, where the task orchestration result is used to indicate the task allocation status of threat processing.

[0253] In a possible implementation of the present application, the device further includes:

[0254] A task execution module 930, configured to execute the task to be executed if it is determined according to the task scheduling result that the first device needs to execute a task and if a task execution condition is met;

[0255] The tasks include one or more of data collection tasks, data analysis tasks and data interception tasks.

[0256] In a possible implementation of the present application, the task execution module 930 is further used to:

[0257] generating a first scheduling result identifier for identifying the task scheduling result;

[0258] If it is determined according to the task scheduling result that the task execution result of the first device needs to be sent to the second device, the task execution result of the first device and the first scheduling result identifier are sent to the second device, and the second device is a device other than the first device among all devices with threat processing capabilities in the distributed scenario.

[0259] In a possible implementation of the present application, the task execution module 930 is further used to:

[0260] If it is determined according to the task scheduling result that the task execution result of the third device needs to be used as the task execution condition, then upon receiving the task execution result of the third device and the second scheduling result identifier sent by the third device, the first scheduling result identifier is compared with the second scheduling result identifier, the third device being a device other than the first device among all devices with threat processing capabilities in the distributed scenario, and the second scheduling result identifier is used to identify the task scheduling result obtained by the third device performing task scheduling;

[0261] If the first orchestration result identifier is the same as the second orchestration result identifier, determining that the task execution condition is currently met;

[0262] When the task execution condition is met, the task to be executed is executed based on the task execution result of the third device.

[0263] In a possible implementation of the present application, the task execution module 930 is further used to:

[0264] If the first orchestration result identifier is different from the second orchestration result identifier, the process returns to execute the step of acquiring the capability information set and subsequent steps.

[0265] In a possible implementation of the present application, the task execution module 930 is further used to:

[0266] If the first orchestration result identifier is different from the second orchestration result identifier, the capability information of the first device is written into the distributed database, and the process returns to execute the step of obtaining the capability information set and subsequent steps.

[0267] In a possible implementation of the present application, the acquisition module 910 is used to:

[0268] Obtain a capability information set stored in a distributed database in the distributed scenario.

[0269] In an embodiment of the present application, the first device in a distributed scenario obtains a capability information set, and the first device has threat handling capabilities. The information capability set includes capability information of all devices with threat handling capabilities in the distributed scenario. Since each capability information indicates the threat handling capabilities of the corresponding device, the first device can perform task scheduling according to the capability information included in the information capability set, obtain a task scheduling result, and determine the task allocation of each device according to the task scheduling result. This avoids the need for communication negotiation between multiple devices, thereby saving communication overhead.

[0270] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0271] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0272] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0273] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0274] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0275] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0276] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0277] Finally, it should be noted that the above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A task determination method, characterized in that: A first device applied in a distributed scenario, wherein the first device refers to any device with threat processing capability, including: Acquire a capability information set, the capability information set including capability information of all devices with threat handling capabilities in the distributed scenario, each capability information being used to indicate the threat handling capability of the corresponding device; Performing task scheduling based on the capability information included in the capability information set to obtain a task scheduling result, wherein the task scheduling result is used to indicate a task allocation situation for threat processing; If it is determined according to the task scheduling result that the task execution result of the third device needs to be used as the task execution condition, then upon receiving the task execution result of the third device and the second scheduling result identifier sent by the third device, the first scheduling result identifier is compared with the second scheduling result identifier, the third device being a device other than the first device among all devices with threat processing capabilities in the distributed scenario, and the second scheduling result identifier is used to identify the task scheduling result obtained by the third device performing task scheduling; If the first orchestration result identifier is the same as the second orchestration result identifier, determining that the task execution condition is currently met; If it is determined according to the task scheduling result that the first device needs to execute a task, then if a task execution condition is met, the task to be executed is executed based on the task execution result of the third device; The tasks include one or more of data collection tasks, data analysis tasks and data interception tasks.

2. The method according to claim 1, characterized in that The method further comprises: generating a first scheduling result identifier for identifying the task scheduling result; After the execution of the tasks required to be performed, it also includes: If it is determined according to the task scheduling result that the task execution result of the first device needs to be sent to the second device, the task execution result of the first device and the first scheduling result identifier are sent to the second device, and the second device is a device other than the first device among all devices with threat processing capabilities in the distributed scenario.

3. The method according to claim 1, characterized in that The method further comprises: If the first orchestration result identifier is different from the second orchestration result identifier, the process returns to execute the step of acquiring the capability information set and subsequent steps.

4. The method according to claim 1, characterized in that The acquisition capability information set includes: Obtaining a capability information set stored in a distributed database in the distributed scenario; The method further comprises: If the first orchestration result identifier is different from the second orchestration result identifier, the capability information of the first device is written into the distributed database, and the process returns to execute the step of obtaining the capability information set and subsequent steps.

5. A task determination device, characterized in that: A first device configured in a distributed scenario, wherein the first device refers to any device having threat processing capability, including: An acquisition module, used to acquire a capability information set, wherein the capability information set includes capability information of all devices with threat handling capabilities in the distributed scenario, and each capability information is used to indicate the threat handling capability of the corresponding device; An orchestration module, configured to perform task orchestration based on the capability information included in the capability information set to obtain a task orchestration result, wherein the task orchestration result is used to indicate a task allocation status of threat processing; A task execution module, configured to execute the task to be executed if it is determined according to the task scheduling result that the first device needs to execute a task and if a task execution condition is met; Wherein, the tasks include one or more of data collection tasks, data analysis tasks and data interception tasks; The task execution module is also used for: If it is determined according to the task scheduling result that the task execution result of the third device needs to be used as the task execution condition, then upon receiving the task execution result of the third device and the second scheduling result identifier sent by the third device, the first scheduling result identifier is compared with the second scheduling result identifier, the third device being a device other than the first device among all devices with threat processing capabilities in the distributed scenario, and the second scheduling result identifier is used to identify the task scheduling result obtained by the third device performing task scheduling; If the first orchestration result identifier is the same as the second orchestration result identifier, determining that the task execution condition is currently met; When the task execution condition is met, the task to be executed is executed based on the task execution result of the third device.

6. The device according to claim 5, characterized in that The task execution module is also used for: generating a first scheduling result identifier for identifying the task scheduling result; If it is determined according to the task scheduling result that the task execution result of the first device needs to be sent to the second device, the task execution result of the first device and the first scheduling result identifier are sent to the second device, and the second device is a device other than the first device among all devices with threat processing capabilities in the distributed scenario.

7. The device according to claim 5, characterized in that The task execution module is also used for: If the first orchestration result identifier is different from the second orchestration result identifier, the process returns to execute the step of acquiring the capability information set and subsequent steps.

8. The device according to claim 5, characterized in that The acquisition module is used for: Obtaining a capability information set stored in a distributed database in the distributed scenario; The task execution module is also used for: If the first orchestration result identifier is different from the second orchestration result identifier, the capability information of the first device is written into the distributed database, and the process returns to execute the step of obtaining the capability information set and subsequent steps.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor; The memory is used to store a program that supports the electronic device to execute the method described in any one of claims 1-4, and to store data involved in implementing the method described in any one of claims 1-4; the processor is configured to execute the program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 4.

Images