Active defense method for low-rate distributed denial of service attacks in containerized edge scenarios

Abstract

The present invention discloses an active defense method for low-rate distributed denial of service attacks in containerized edge scenarios, the method comprising: state collection based on container introspection, intelligent decision-making based on deep reinforcement learning, and container orchestration based on mobile target defense. The state collection based on container introspection aims to provide data for model establishment and analysis for the subsequent formulation of defense strategies. The intelligent decision-making based on deep reinforcement learning is oriented to the edge service state, and its purpose is to provide and issue the most efficient defense strategy to drive the implementation of defense. The container orchestration based on mobile target defense is oriented to the containerized web service in edge scenarios, and its purpose is to perform attack mitigation and defense through dynamic container orchestration based on defense decisions. Through the technical solution of the disclosed example, it is possible to effectively alleviate the problem of service quality degradation when the edge is subjected to low-rate distributed denial of service attacks, thereby improving the security of edge scenario web services.

Description

Technical Field

[0001] The present invention relates to an active defense method for low-rate distributed denial of service attacks in containerized edge scenarios, belonging to the technical field of denial of service attack defense. Background Art

[0002] With the rapid development of edge computing, container technology, and Internet of Things technology, latency-sensitive network services (such as web services) are deployed in lightweight containers and migrated from remote cloud computing centers to edge clouds closer to users. This can effectively reduce service latency while avoiding large amounts of data interaction.

[0003] However, as edge cloud services continue to expand and scale, they have become one of the main targets of cyber attackers. The first to bear the brunt is the Distributed Denial-of-Service (DDoS) attack. Since a large number of IoT devices are connected to the network, and most of them lack the necessary security protection, it is easy for attackers to hijack related devices to form a botnet and launch large-scale DDoS attacks, causing a significant decline in service quality or even network paralysis, resulting in serious economic and property losses.

[0004] At present, there are several mainstream defense methods for DDoS attacks, mainly including designing firewall rules, deploying intrusion detection systems, and traffic traction and requests. The above methods are all static and deterministic DDoS defense methods, which require the defender to have certain prior knowledge before deploying the defense, that is, to have a certain understanding of the attack behavior, traffic characteristics, and attack effects. Studies have shown that this type of defense method has a certain defense effect on traditional high-rate DDoS attacks. However, in recent years, with the continuous development of attack technology, more advanced attackers have imitated legitimate user access forms and covertly constructed malicious attack requests to achieve the effect of denial of service attacks. This attack is also called low-rate distributed denial of service (LDDoS) attack. Due to its strong concealment and deception, existing defenses cannot effectively detect and deal with it. Therefore, how to effectively prevent LDDoS attacks in edge scenarios has become a difficult task and challenge.

[0005] In the past few years, some studies have proposed the use of active defense methods including IP address change and container migration to introduce uncertainty and variability on the attack side, thereby reducing the attacker's detection of the real network configuration information of the protected network, so as to alleviate the effect of DDoS attacks and achieve the defense goal. However, at this stage, this type of defense method still has the following defects. First, this type of active defense method currently only has a certain defense effect on traditional high-speed DDoS attacks, and due to the difference in attack mechanism between high-speed DDoS and LDDoS, it cannot be directly applied to LDDoS defense; secondly, the existing method lacks intelligent decision-making guidance, so that the attacker may obtain real network information in the long-term detection, thereby breaking the current defense; finally, the frequent address change or migration in the existing method will inevitably cause a large amount of resource overhead, and will also bring about a certain degree of service quality degradation, affecting the use of normal services. Summary of the invention

[0006] In response to the above problems, the present invention proposes an active defense method for low-rate distributed denial of service attacks in containerized edge scenarios. First, the network status information of edge cloud servers and web containers is collected based on container introspection technology. Secondly, an intelligent decision model is built based on a deep reinforcement learning algorithm. Finally, according to the content of the defense strategy, dynamic container orchestration is implemented based on mobile target defense technology, thereby achieving efficient and active protection against low-rate distributed denial of service attacks. Through the technical solution disclosed in the present invention, low-rate distributed denial of service attacks can be resisted with high energy efficiency, thereby effectively improving the security of the edge cloud platform.

[0007] The present invention adopts the following technical solution: an active defense method for low-rate distributed denial of service attacks in containerized edge scenarios, the method comprising the following steps:

[0008] Step (1): State collection method based on container introspection,

[0009] Step (2): Intelligent decision-making method based on deep reinforcement learning,

[0010] Step (3): Container orchestration method based on mobile target defense.

[0011] The specific contents of the steps are as follows:

[0012] Step (1): A state collection method based on container introspection is specifically as follows: deploy a state collection probe on the edge cloud environment to obtain the real-time system occupancy, memory usage, and number of online containers of the edge cloud server; for the web container deployed on it, a container-oriented network state meter is constructed based on introspection technology to obtain the real-time network connection number, access latency, and resource overhead of each containerized service;

[0013] Step (2): An intelligent decision-making method based on deep reinforcement learning is as follows: the edge cloud server state and container service state information obtained in step (1) are used as input to construct a state space matrix; the defense actions that can be taken are constructed as an action space matrix, and combined with the state space matrix to obtain an action-state transfer function; a reward function is constructed for the defense goal of high energy efficiency, a deep reinforcement learning model is trained, and a decision is made to output the optimal defense action sequence under the current state;

[0014] Step (3): The container orchestration method based on mobile target defense is as follows: according to the defense action sequence formed in step (2), a defense strategy parsing executor is constructed to process and respond to the action sequence, and the container orchestration technology is used to send it to the corresponding web service container in turn to execute the corresponding mobile target defense action; when the last defense action of the action sequence is executed, the current round of defense is ended; and according to the state after the defense is executed, it is determined whether to repeat steps (1) to (2).

[0015] Among them, the step (1): based on the state collection method of container introspection, the present invention provides a state collection method for edge cloud platform and its deployed container service, which is specifically as follows:

[0016] Step (1.1) Deploy a network system status collection probe on the physical server where the edge cloud environment is located based on the management interface provided by the Linux system status process monitoring management service htop;

[0017] Step (1.2) uses keyword filtering, user filtering, time matching and process screening to remove irrelevant status information from the edge cloud server status collection probe deployed in step (1.1), and retains the real-time network system CPU occupancy, memory usage, and number of online web page containers of the current edge cloud server;

[0018] Step (1.3) For the N containerized web services deployed on the edge cloud server, a container-oriented network status meter is built based on the API interface provided by the Metrics-Server, a resource management service built into the container management platform Kubernetes;

[0019] Step (1.4) measures the network status of a web page container deployed on the edge cloud service based on the container network status meter constructed in step (1.3), and obtains the real-time network connection number, user access delay, and resource overhead information of the web page container;

[0020] Step (1.5) repeats step (1.4) N times to obtain the real-time network connection number, user access latency, and resource overhead information of all N containerized web services at the current moment.

[0021] The step (2): intelligent decision-making method based on deep reinforcement learning. This paper provides a defense strategy decision-making method based on a deep reinforcement learning model, which is as follows:

[0022] Step (2.1) combines the real-time system occupancy, memory usage, number of online containers obtained in step (1.2) and the real-time network connection number, user access latency, and resource overhead information of all containers obtained in step (1.5) to form a state space matrix of the edge cloud environment, which can be expressed as S = {s1, s2, ..., s N};

[0023] Step (2.2) combines five dynamic defense actions, including container expansion and contraction, container replica creation and deletion, and container external port transformation, for the edge cloud environment to deal with low-rate distributed denial of service attacks, with static defense actions that remain static to form an action space matrix, which can be expressed as A = {a1, a2, …, a N};

[0024] Step (2.3) constructs a deterministic action-state transfer function based on the network state space matrix obtained in step (2.1) and the action space matrix obtained in step (2.2), combining the transfer relationship between action and status, which can be expressed as Where P(s ′ |s,a) means that after executing action a in state s, the system state is transferred to s ′ The probability of, and this value is a deterministic probability, that is, P = 0 or 1;

[0025] Step (2.4) is based on the network state space matrix obtained in step (2.1), the action space matrix obtained in step (2.2), and the action-state transfer function obtained in step (2.3). It is aimed at the low-rate distributed denial of service attack defense demand with high energy efficiency ratio. Based on security benefits, service quality benefits, resource overhead, and time overhead, a total of 4 items are assigned different weights to construct a reward function, which can be expressed as:

[0026] R=ω1r s +ω2r q +ω3r e +ω4r t

[0027] Among them, ω1, ω2, ω3, ω4 represent the weights of security benefit, service quality benefit, resource cost, and time cost in the reward function respectively; rs It represents the safety benefit, which is calculated by the ratio of the number of containers in a safe state to the total number of containers N. s ∈[0,1]; r q represents the service quality benefit, which is calculated by the ratio of the average number of connections of all web containers to the maximum threshold. q ∈[0.5,1]; r e represents resource overhead, which is calculated by the ratio of additional physical resources used for defense to the total resources of the edge cloud. e ∈[0,0.5]; r t represents the time overhead, which is calculated by the ratio of the average user access delay of the container implementing external port adjustment at this moment to the maximum accessible delay, r t ∈[0,1];

[0028] Step (2.5) uses the Deep Q-Network algorithm of deep reinforcement learning to construct the training network and the target network respectively for the network state space matrix S obtained in step (2.1), the action space matrix A obtained in step (2.2), the action-state transfer function P obtained in step (2.3), and the reward function R obtained in step (2.4); and adopts the greedy mechanism and the experience replay mechanism to train the decision model; in the process of model training, the mean square error value between the target network and the training network is used as the loss function. When the loss function value reaches the optimal value, the model training reaches convergence and generates the optimal energy-efficient defense strategy decision model;

[0029] Step (2.6) inputs the network state space matrix obtained in step (2.1) into the defense strategy decision model obtained in step (2.5), and outputs the optimal defense action sequence of length M under the current system state, which can be expressed as in represents the optimal set of defense actions that should be implemented on all N containers at time m.

[0030] The step (3): a container orchestration method based on mobile target defense, this method provides a defense strategy parsing executor capable of parsing defense strategies and executing dynamic container orchestration, specifically as follows:

[0031] Step (3.1) is based on the defensive action sequence obtained in step (2.6) The format and the built-in control service Scale command, KubectlDelete command, ReplicaSet interface, and Kube-ApiServer interface of the container management platform Kubernetes are used to build a defense strategy parsing executor on the edge cloud server;

[0032] Step (3.2) uses the defense strategy parsing executor generated in step (3.1) to parse the optimal defense action sequence obtained in step (2.6) to obtain the defense actions at M consecutive moments and the container objects executed by the corresponding defense actions, with a dimension of M*N.

[0033] Step (3.3) determines the N-dimensional defense action decision at the next moment based on the defense action obtained in step (3.2) and the corresponding execution container. Send to all N web page containers;

[0034] Step (3.4) is for the defense action decision sent to the web container in step (3.3). If the defense action decision is to expand the container, call the Scale command on the target container to increase the set container Pod resources; if the defense action decision is to shrink the container, call the Scale command on the target container to reduce the set container Pod resources; if the defense action decision is to create a container replica, use the ReplicaSet interface to create container resources for the target container with the same configuration; if the defense action decision is to delete the container replica, use the KubectlDelete command to delete the target container and release the underlying physical resources; if the defense action decision is to change the container's external service port, use the Kube-ApiServer interface to modify the target container's external port; repeatedly call the defense policy parsing executor N times until the defense actions on N web containers are executed;

[0035] Step (3.5) repeats steps (3.3) and (3.4) M times to complete the execution of the defense actions obtained by parsing in step (3.2) at M consecutive moments;

[0036] Step (3.6) uses the Ping command to test the access connection of the N web containers deployed on the edge cloud server based on the website domain name provided to the outside world; if the N web services can be connected normally, the defense strategy parsing executor will subsequently suspend its work and will continue to remain stationary; otherwise, return to step (1.1).

[0037] Compared with the prior art, the present invention has the following advantages:

[0038] (1) The present invention proposes an active defense method for low-rate distributed denial of service attacks in containerized edge scenarios. The present invention is proposed for containerized edge cloud platforms and has the advantages of transparent methods, high scalability, and easy deployment. It forms an efficient and complete multi-level active defense closed loop through state collection of edge cloud environments, intelligent policy formulation and distribution, and dynamic defense scheduling. This method will greatly weaken the advantages of malicious attackers in reconnaissance time and attack costs, prompting them to constantly pursue real attack targets and waste their attack resources, which is of great significance for active protection against low-rate distributed denial of service attacks.

[0039] (2) The present invention adopts a container introspection mechanism to effectively supervise containerized services. Based on the corresponding interface of the container management platform, the status monitoring and information collection of all containers on the entire edge cloud node can be realized. The collection method is simple and the user's perceptibility is low. Only key information such as container load, service connection number occupancy, and external open ports are monitored and collected to reduce unnecessary defense overhead as much as possible. The status information collected in real time is summarized and reported as data support and decision-making basis for subsequent intelligent decision-making.

[0040] (3) The present invention adopts deep reinforcement learning method to formulate defense strategy. In each attack and defense interaction stage, the defense reward is evaluated and predicted according to the current collected system status and the defense actions that can be taken, and the optimal selection is made to screen out the staged defense strategy with the best energy efficiency ratio, and continuously evaluate and make decisions in the subsequent attack and defense process. This method makes full use of the characteristics of deep reinforcement learning to solve optimization problems and improves the defense effectiveness against low-rate distributed denial of service attacks.

[0041] (4) The present invention uses a variety of mobile target defense mechanisms to handle low-speed distributed denial of service attacks. By dynamically scaling containers, creating and deleting container copies, and adjusting the container's external ports, a container dynamic orchestration method is constructed, thereby specifically changing the external presentation of the web service, causing the attack target to undergo changes in network configuration or network attributes, thereby improving the defender's initiative in handling the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A framework diagram for designing an active defense method for low-rate distributed denial of service attacks in containerized edge scenarios. DETAILED DESCRIPTION

[0043] In combination with the above-described steps, this section implements some cases in combination with the description of the relevant technical solution steps in the specification.

[0044] Embodiment 1:

[0045] An active defense approach against low-rate distributed denial-of-service attacks on edge cloud servers hosting multiple Apache web containers.

[0046] Wherein, the method comprises the following steps:

[0047] Step (1): State collection method based on container introspection,

[0048] Step (2): Intelligent decision-making method based on deep reinforcement learning,

[0049] Step (3): Container orchestration method based on mobile target defense;

[0050] Among them, step (1): a state collection method based on container introspection is specifically as follows: on the edge cloud server, based on the management interface provided by the Linux system state process monitoring management service htop, a network system state collection probe is deployed to obtain the real-time system CPU occupancy, memory usage and number of online running containers of the edge cloud server; for the 10 Apache web containers deployed on it, based on the API interface provided by the resource management service Metrics-Server built-in in the container management platform Kubernetes, a container network state meter based on introspection technology is constructed to measure and obtain the real-time network connection number, user access delay and Pod resource overhead of each containerized service;

[0051] Step (2): An intelligent decision-making method based on deep reinforcement learning is as follows: the edge cloud server status and container service status information obtained in step (1) are used as input to construct a state space matrix S; the available defense actions are constructed as an action space matrix A, and combined with the state space matrix to obtain an action-state transfer function P; a reward function R is constructed for the defense goal of high energy efficiency, and a defense decision model based on deep reinforcement learning is formed based on Deep Q-Network algorithm training, and the optimal defense action sequence for the next 20 time steps is output.

[0052] Step (3): The container orchestration method based on mobile target defense is as follows: according to the defense action sequence formed in step (2), based on the built-in control service Scale command, KubectlDelete command, ReplicaSet interface and Kube-ApiServer interface of the container management platform Kubernetes, a defense strategy parsing executor is constructed to process and respond to the action sequence, and then the container orchestration technology is used to send it to the corresponding Apache web service container in turn to execute the corresponding mobile target defense action; when the last defense action of the action sequence is executed, the current round of defense is ended; and according to the connectivity status of the website service after the defense is executed, it is determined whether to repeat steps (1) to (2).

[0053] Among them, for step (1): the state collection method based on container introspection is as follows:

[0054] Step (1.1) Deploy a network system status collection probe on a physical server with 12 cores, 64GB memory, and Ubuntu 18.04 operating system where the edge cloud environment is located, based on the management interface provided by the Linux system status process monitoring management service htop;

[0055] Step (1.2) uses keyword filtering, user filtering, time matching and process screening to remove irrelevant status information from the edge cloud server status collection probe deployed in step (1.1), and retains the real-time network system CPU occupancy, memory usage, and number of online web page containers of the current edge cloud server;

[0056] Step (1.3) For the 10 containerized Apache web services deployed on the edge cloud server, a container-oriented network status meter is built based on the API interface provided by the Metrics-Server, a resource management service built into the container management platform Kubernetes;

[0057] Step (1.4) measures the network status of an Apache web container instance deployed on the edge cloud service based on the container network status meter constructed in step (1.3), and obtains the real-time network connection number of the web container, user access latency, and the number of Pods consumed by deploying the instance;

[0058] Step (1.5) repeats step (1.4) 10 times to obtain the real-time network connection number, user access latency, and number of Pods consumed by all 10 containerized Apache web service instances at the current moment.

[0059] Regarding step (2): the intelligent decision-making method based on deep reinforcement learning is as follows:

[0060] Step (2.1) combines the real-time system occupancy, memory usage, number of online containers obtained in step (1.2) and the real-time network connection number, user access latency, and number of Pods consumed by the instance of all containers obtained in step (1.5) to form a state space matrix of the edge cloud environment, which can be expressed as S = {s1, s2, ..., s 10};

[0061] Step (2.2) combines five dynamic defense actions, including container expansion and contraction, container replica creation and deletion, and container external port transformation, for the edge cloud environment to deal with low-rate distributed denial of service attacks, with static defense actions that remain static to form an action space matrix, which can be expressed as A = {a1, a2, …, a 10};

[0062] Step (2.3) constructs a deterministic action-state transfer function based on the network state space matrix obtained in step (2.1) and the action space matrix obtained in step (2.2), combining the transfer relationship between action and status, which can be expressed as Where P(s ′ |s,a) means that after executing action a in state s, the system state is transferred to s ′ The probability of, and this value is a deterministic probability, that is, P = 0 or 1;

[0063] Step (2.4) is based on the network state space matrix obtained in step (2.1), the action space matrix obtained in step (2.2), and the action-state transfer function obtained in step (2.3). It is aimed at the low-rate distributed denial of service attack defense demand with high energy efficiency ratio. Based on security benefits, service quality benefits, resource overhead, and time overhead, a total of 4 items are assigned different weights to construct a reward function, which can be expressed as:

[0064] R=ω1r s +ω2r q +ω3r e +ω4r t

[0065] Wherein, ω1, ω2, ω3, ω4 represent the weights of security benefit, service quality benefit, resource cost, and time cost in the reward function respectively. In this embodiment, ω1=1, ω2=8, ω3=-0.02, ω4=-0.05; s represents the safety benefit, which is calculated by the ratio of the number of containers in a safe state to the total number of containers 10, r s ∈[0,1]; r qrepresents the service quality benefit, which is calculated by the ratio of the average number of connections of all web containers to the maximum threshold. q ∈[0.5,1], in this embodiment, the maximum number of connections supported by a single Pod is set to 256; r e represents resource overhead, which is calculated by the ratio of additional physical resources used for defense to the total resources of the edge cloud. e ∈[0,0.5], in this embodiment, the resource usage of the container service (i.e., the resource overhead used by a single Pod) is minimized to 0.1 core and 512MB memory, and a maximum of 100 Pod instances can be deployed on the edge cloud server; r t represents the time overhead, which is calculated by the ratio of the average user access delay of the container implementing external port adjustment at this moment to the maximum accessible delay, r t ∈[0,1], in this embodiment, the maximum accessible delay is set to 200 milliseconds, and the external port range available for the web service is 30000 to 32767;

[0066] Step (2.5) uses the Deep Q-Network algorithm of deep reinforcement learning to construct training networks Q respectively based on the network state space matrix S obtained in step (2.1), the action space matrix A obtained in step (2.2), the action-state transfer function P obtained in step (2.3), and the reward function R obtained in step (2.4). w (s,a) and the target network Q w- (s′, a′), where w and w- represent the parameters of the model, and w=w- is set in the initial state; and the greedy mechanism and experience replay mechanism are adopted to train the decision model. In this embodiment, the maximum number of training rounds is set to 15000, the decay factor γ is set to 0.98, the Q-Network hidden layer is set to [1024, 128], the initial learning rate of the Adam optimization algorithm is set to 0.001, and it is decayed by a factor of 0.2 every 40000 steps, ReLu is used as the activation function, the cache size B of the experience replay is set to 10000, the greedy probability is set to [0.01, 1], and the target network is updated every 500 steps; in the model training process, the mean square error value between the target network and the training network is used as the loss function, where the target network value can be expressed as y=R+γmaxQ w- (s′,a′), the training network value can be expressed as Q w (s,a), the loss function L can be expressed as When the loss function value reaches the optimal value, that is, the gap between the two networks is the smallest and the mean square error value is the smallest, the model training reaches convergence and generates the optimal energy-efficient defense strategy decision model Q w*(s,a), where w* represents the optimal Deep Q-Network model parameters;

[0067] Step (2.6) inputs the network state space matrix S obtained in step (2.1) into the defense strategy decision model Q obtained in step (2.5) w* (s, a), the output is the optimal defense action sequence in the next 20 time steps, that is, the length of the optimal defense action sequence is set to 20, which can be expressed as in represents the optimal set of defense actions that should be implemented on all 10 Apache web containers at time m, 1≤m≤20.

[0068] Regarding step (3): the container orchestration method based on mobile target defense is as follows:

[0069] Step (3.1) is based on the defensive action sequence obtained in step (2.6) The format and the built-in management service Scale command, Kubectl Delete command, ReplicaSet interface, and Kube-ApiServer interface of the container management platform Kubernetes are used to build a defense strategy parsing executor on the edge cloud server;

[0070] Step (3.2) uses the defense strategy parsing executor generated in step (3.1) to parse the optimal defense action sequence obtained in step (2.6) to obtain the defense actions at 20 consecutive moments and the container objects executed by the corresponding defense actions, with a dimension of 20*10;

[0071] Step (3.3) determines the 10-dimensional defense action decision at the next moment based on the defense action and the corresponding execution container obtained in step (3.2). Send it to all 10 Apache web containers;

[0072] Step (3.4) is for the defense action decision sent to the web container in step (3.3). If the defense action decision is to expand the container, call the Scale command on the target container to add 1 Pod resource to the target container; if the defense action decision is to shrink the container, call the Scale command on the target container to reduce 1 Pod resource for the target container; if the defense action decision is to create a container replica, use the ReplicaSet interface to create container resources for the target container with the same configuration and Pod resource quantity; if the defense action decision is to delete the container replica, use the Kubectl Delete command to delete the target container and release the underlying physical resources; if the defense action decision is to change the container's external service port, use the Kube-ApiServer interface to modify the target container's external port, and the modification range is [30000,32767]; repeatedly call the defense policy parsing executor 10 times until the defense actions on 10 Apache web containers are executed;

[0073] Step (3.5) repeats steps (3.3) and (3.4) 20 times to complete the execution of the defense action obtained by parsing in step (3.2) for 20 consecutive time steps;

[0074] In step (3.6), for the 10 Apache web containers deployed on the edge cloud server, based on the website domain name provided to the outside world, the Ping command is used to perform an access connection test; if the Ping values ​​of the 10 Apache web services are all less than 200 milliseconds, indicating that they can be connected normally, the defense strategy parsing executor will subsequently suspend its work and will continue to remain stationary; otherwise, return to step (1.1).

[0075] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. An active defense method for low-rate distributed denial of service attacks in containerized edge scenarios, characterized by: The defense method comprises the following steps: Step (1): State collection method based on container introspection, Step (2): Intelligent decision-making method based on deep reinforcement learning, Step (3): Container orchestration method based on mobile target defense, Among them, step (1): a state collection method based on container introspection is specifically as follows: deploy a state collection probe on the edge cloud environment to obtain the real-time system occupancy, memory usage and number of online containers of the edge cloud server; for the web container deployed on it, a container-oriented network state meter is constructed based on the introspection technology to obtain the real-time network connection number, access delay and resource overhead of each containerized service; Step (2): An intelligent decision-making method based on deep reinforcement learning is as follows: the edge cloud server state and container service state information obtained in step (1) are used as input to construct a state space matrix; the defense actions that can be taken are constructed as an action space matrix, and combined with the state space matrix to obtain an action-state transfer function; a reward function is constructed for the defense goal of high energy efficiency, a deep reinforcement learning model is trained, and a decision is made to output the optimal defense action sequence under the current state; Step (3): The container orchestration method based on mobile target defense is as follows: according to the defense action sequence formed in step (2), a defense strategy parsing executor is constructed to process and respond to the action sequence, and the container orchestration technology is used to send it to the corresponding web service container in turn to execute the corresponding mobile target defense action; when the last defense action of the action sequence is executed, the current round of defense is ended; and according to the state after the defense is executed, it is determined whether to repeat steps (1) to (2). The step (1): a state collection method based on container introspection, the specific process is as follows: Step (1.1) deploys an edge cloud server status collection probe on the physical server where the edge cloud environment is located based on the interface provided by the system status monitoring service; Step (1.2) filters out irrelevant status information for the edge cloud server status collection probe deployed in step (1.1), retaining real-time system occupancy, memory usage, and number of online containers; Step (1.3) For the N containerized web services deployed on the edge cloud server, a container-oriented network status meter is built based on the built-in control service interface of the container management platform; Step (1.4) obtains the real-time network connection number, user access latency, and resource overhead information of the container currently deployed on the edge cloud service based on the container network status meter constructed in step (1.3); Step (1.5) repeats step (1.4) N times to obtain the real-time network connection number, user access latency, and resource overhead information of all N containerized web services at the current moment. The step (2): intelligent decision-making method based on deep reinforcement learning, the specific process is as follows: Step (2.1) combines the real-time system occupancy, memory usage, number of online containers obtained in step (1.2) and the real-time network connection number, user access latency, and resource overhead information of all containers obtained in step (1.5) to form a state space matrix of the edge cloud environment; Step (2.2) combines a total of five dynamic defense actions, including container expansion and contraction, container copy creation and deletion, and container external port transformation, with static defense actions to build an action space matrix for edge cloud environments to deal with low-rate distributed denial of service attacks; Step (2.3) constructs an action-state transfer function based on the network state space matrix obtained in step (2.1) and the action space matrix obtained in step (2.2) by combining the transfer relationship between action and status; Step (2.4) is based on the network state space matrix obtained in step (2.1), the action space matrix obtained in step (2.2), and the action-state transfer function obtained in step (2.3), and is aimed at the low-rate distributed denial of service attack defense requirements with high energy efficiency. Based on security benefits, service quality benefits, resource overhead, and time overhead, a total of four items are allocated with different weights to construct a reward function; Step (2.5) uses a deep reinforcement learning algorithm to train the model based on the network state space matrix obtained in step (2.1), the action space matrix obtained in step (2.2), the action-state transfer function obtained in step (2.3), and the reward function obtained in step (2.4) to generate a defense strategy decision model with optimal energy efficiency; Step (2.6) inputs the network state space matrix obtained in step (2.1) into the defense strategy decision model obtained in step (2.5), and outputs the optimal defense action sequence of length M under the current system state. The step (3): container orchestration method based on mobile target defense, the specific process is as follows: Step (3.1) builds a defense strategy parsing executor on the edge cloud server based on the format of the defense action sequence obtained in step (2.6) and the built-in control service interface of the container management platform; Step (3.2) uses the defense strategy parsing executor generated in step (3.1) to parse the optimal defense action sequence obtained in step (2.6) to obtain the defense actions at M consecutive moments and the container objects executed by the corresponding defense actions, with a dimension of M*N. Step (3.3) sends the N-dimensional defense action decision at the next moment to all N web page containers for the defense action and the corresponding execution container obtained in step (3.2); Step (3.4) is to repeatedly call the defense strategy parsing executor N times for the defense action decision sent to the web page container in step (3.3), and execute the defense actions on N web page containers; Step (3.5) repeats steps (3.3) and (3.4) M times to complete the execution of the defense actions obtained by parsing in step (3.2) at M consecutive moments; Step (3.6) performs an access connection test on the N web containers deployed on the edge cloud server. If the N web services can be connected normally, the defense strategy parsing executor will continue to perform the static action; otherwise, return to step (1.1).

Images