Service traffic scheduling method in network security resource pool based on hybrid frog leaping algorithm

Abstract

The present invention relates to a method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm. The software-defined network can obtain the characteristic of a complete network topology structure, and the objective function is constructed by combining the network topology structure, the network security resource usage status and the link load status. First, the service traffic is analyzed by using security hardware to plan the network security resources required for this traffic processing. Secondly, according to conditions such as the source address and destination address of the service traffic, a set of service traffic processing paths is obtained; finally, a hybrid frog leaping service traffic scheduling algorithm is proposed to screen out the optimal scheduling path for service traffic from the processing path set. The present invention can reasonably plan the processing path of service traffic according to the usage of security resources and the type of service traffic, and make full use of the security resources in the network.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm. Background Art

[0002] Traditional network security architectures provide security services through a primary-backup deployment model, typically orchestrating security devices through physical or logical cascading, with traffic routed and processed along a single path. This network security architecture is highly fragile. A failure at any node in a link can paralyze the entire link, blocking traffic flow. Furthermore, all traffic must pass through every device, resulting in unnecessary resource redundancy and time inefficiency. Furthermore, this chained architecture makes devices difficult to scale and maintain. Software-defined networking (SDN) and network function virtualization (NFV) technologies are being combined to design a new network security architecture. Unlike traditional computer networks, SDN separates the data and control planes, managing traffic scheduling between physical devices through a logical remote controller. This remote controller can access the entire network topology and resource usage, and calculate the optimal path for traffic transmission based on built-in traffic scheduling policies. Network Function Virtualization (NFV) is a concept proposed as a network architecture. Unlike the traditional requirement that the software and hardware of physical devices must be bound together, in the NFV architecture, one physical device can integrate multiple standardized software to implement network functions. Through NFV, the functions of security hardware can be uniformly planned to build a network security resource pool, and the deployment and call of network security functions in software form can be provided. Summary of the Invention

[0003] The purpose of the present invention is to solve the problems of security resource waste and link load imbalance in the network security resource pool, and to provide a service traffic scheduling method in the network security resource pool based on the hybrid frog leaping algorithm. The hybrid frog leaping algorithm is designed for service traffic scheduling in the network security resource pool, which can reasonably plan the processing path of the service traffic according to the usage of security resources and the type of service traffic, and make full use of the security resources in the network.

[0004] To achieve the above objectives, the technical solution of the present invention is: a method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm. First, security hardware is used to analyze service traffic and plan the network security resources required for this traffic processing. Second, based on the condition that the service traffic includes source and destination addresses, a set of service traffic processing paths is obtained. Finally, a hybrid frog leaping-service traffic scheduling algorithm is proposed to screen the optimal scheduling path for service traffic from the set of processing paths. The specific implementation steps of this method are as follows:

[0005] S1. Business traffic type analysis phase: Analyze business traffic through security hardware to determine the business type of business traffic. Based on different business traffic and security logs, plan the required network security resource type and scale.

[0006] S2, business traffic processing path set acquisition stage: The controller obtains the business traffic processing path set by combining the network topology and the necessary network security resources required;

[0007] S3. Design a hybrid frog leaping-business traffic scheduling algorithm to select the optimal business traffic processing path: Design a fitness function to evaluate the priority of each path in the business traffic processing path set, and select the optimal path through the hybrid frog leaping-business traffic scheduling algorithm.

[0008] In one embodiment of the present invention, step S2 is specifically implemented as follows:

[0009] S201. Use a deep traversal algorithm to obtain the paths from the source nodes of all service traffic to the destination host;

[0010] S202. Filter out applicable service traffic processing paths based on the required network security resource types and scales;

[0011] S203. Based on the result of the screening in step S202, paths with shorter distances are preferentially selected to form a service traffic processing path set;

[0012] In one embodiment of the present invention, in step S203 , the retained quantity is set to 50% of the screening results.

[0013] In one embodiment of the present invention, step S3 is specifically implemented as follows:

[0014] S301. Each path x in the service traffic processing path set is located in a three-dimensional solution space composed of link transmission distance, network security resource usage, and link traffic load. To balance the resources required by these factors in the path, a fitness function F(x) is proposed to calculate the fitness value of each path to evaluate the quality of the path and sort the paths according to the fitness value.

[0015] S302, all solutions of the fitness function F(x) are distributed in order and initialized into several populations;

[0016] S303, designing a dynamic threshold function θ to adjust the jump distance of the individual during each optimization, and designing a jump distance formula D1 within the population and a global jump distance formula D2;

[0017] S304, obtaining the optimal solution and the worst solution in each population and the global optimal solution, and performing the update according to the hybrid frog leaping algorithm until the algorithm termination condition is met;

[0018] S305 : Select the solution vector with the highest fitness among all the final solutions, calculate the vector distance between each solution in the service traffic processing path set and the solution vector with the highest fitness, and select the path with the shortest distance as the optimal path.

[0019] In one embodiment of the present invention, in step S301, the fitness function F(x) is expressed as follows:

[0020]

[0021] in, The paths x i path length, network security resources occupied, and link load level, d min 、S min 、T min They represent the minimum resource scale required to process the corresponding business traffic, d max 、S max 、T max They respectively represent the maximum value of various resources occupied in the business traffic processing path set.

[0022] In one embodiment of the present invention, in step S303, the dynamic threshold function θ is expressed as follows:

[0023]

[0024] Among them, Iter max Indicates the maximum number of iterations set during the entire algorithm search process. rand(0, 1) refers to generating a random number between 0 and 1.

[0025] In one embodiment of the present invention, in step S303, the intra-population jump distance formula D1 and the global jump distance formula D2 are set as follows:

[0026] 1) For the worst solution x in each community lw Towards the optimal solution x in this community lb Update and set the optimized jump distance to D1. The update steps are as follows:

[0027] D1=rand(0,1)×(θ×x lb -x lw ) (3)

[0028] x′ lw =x lw +D1 (4)

[0029] If the new fitness of the updated solution is greater than the original fitness, the update is successful and the iterative calculation continues. If it is less than the fitness of the original solution, continue to step 2);

[0030] 2) For the worst solution x in the community lw , to the optimal solution x among all solutions hb Update and set the optimized jump distance to D2. The update steps are as follows:

[0031] D2=rand(0,1)×(θ×x hb -x lw ) (5)

[0032] x′ lw =x lw +D2 (6)

[0033] If the new fitness of the updated solution is greater than the original fitness, the update is successful and the iterative calculation continues. If it is less than the fitness of the original solution, continue to step 3);

[0034] 3) Since the first two updates failed, a new solution is randomly generated in the solution space to replace the worst solution vector. The formula is as follows:

[0035] x′ lw =rand(3, a, b) (7)

[0036] Formula (7) represents the generation of a 3-dimensional solution vector, where the upper limit of the vector value is a and the lower limit is b.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1. Business traffic scheduling strategy proposed for the new network security architecture;

[0039] 2. Ability to more effectively select business traffic processing paths and fully utilize network security resources;

[0040] 3. Solve the problems of security resource waste and link load imbalance in the network security resource pool.

[0041] The analysis shows that the service traffic scheduling strategy in the network security resource pool based on the hybrid frog leaping algorithm provided by the present invention has good application and promotion effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a diagram of a new network security architecture targeted by the present invention;

[0043] Figure 2 This is a flow chart of a method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm according to the present invention. DETAILED DESCRIPTION

[0044] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

[0045] The present invention provides a method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm. Software-defined networking (SDN) allows for the acquisition of a complete network topology, and an objective function is constructed by combining the network topology, network security resource usage, and link load. First, security hardware is used to analyze service traffic and plan the network security resources required for this traffic processing. Second, based on conditions such as the source and destination addresses of the service traffic, a set of service traffic processing paths is obtained. Finally, a hybrid frog leaping-service traffic scheduling algorithm is proposed to select the optimal scheduling path for service traffic from the set of processing paths.

[0046] The following is a specific implementation process of the present invention.

[0047] Figure 1 This is a diagram of a new network security architecture targeted by the present invention, in which software-defined network (SDN) and network function virtualization (NFV) technologies are combined to design a new network security architecture. Software-defined network isolates the data layer and the control layer, and manages the scheduling of traffic between physical devices through a logical remote controller. The remote controller can obtain the topology of the entire network device and the usage of network resources, and calculate the best path to complete the transmission of traffic based on the built-in traffic scheduling strategy. Network function virtualization is proposed as a concept of network architecture. Different from the traditional requirement that the hardware and software of physical devices must be bound to each other, in the NFV architecture, a physical device can integrate multiple standardized software that realize network functions. Through NFV, the functions of security hardware can be uniformly planned to build a network security resource pool, and the deployment and call of network security functions in software form can be provided.

[0048] The present invention proposes a service traffic scheduling method based on a hybrid frog leaping algorithm for a new security architecture network. From the three perspectives of link transmission distance, network security resource occupancy, and link traffic load, the optimal traffic transmission path is selected in the network security resource pool according to the type of service traffic. In order to better utilize network security resources and improve the processing and scheduling of service traffic, the present invention proposes a service traffic scheduling method based on a hybrid frog leaping algorithm for a network security resource pool. Figure 2 shown.

[0049] The method is divided into three parts: business traffic type analysis, acquisition of business traffic processing path set, and calculation and selection of the optimal traffic processing path.

[0050] 1. Business traffic type analysis

[0051] During the business traffic type analysis phase, security hardware analyzes business traffic to determine whether the traffic belongs to HTTP, non-HTTP, or general business, and plans the required security resource type and scale based on different business traffic and security logs.

[0052] 2. Obtaining a set of business traffic processing paths

[0053] During the service traffic processing path set acquisition phase, because the SDN architecture can obtain the complete network topology, and NFV technology enables the controller to understand the resource usage of all security hardware, the controller combines the network topology and the necessary security resources to obtain the service traffic processing path set. The complete path set acquisition algorithm is shown in Algorithm 1 below:

[0054]

[0055] 3. Service traffic scheduling algorithm based on hybrid frog leaping algorithm

[0056] In order to select the optimal service traffic processing path from the processing path set, a service traffic scheduling algorithm for network security resource pool is proposed: Shuffled Frog Leaping Algorithm-Traffic Scheduling (SFLA-TS).

[0057] In the SFLA algorithm, the location and status of each frog are calculated by the fitness function. i They are all in the three-dimensional solution space composed of link transmission distance, network security resource usage, and link traffic load. In order to balance the resources required by these factors in the path, this paper proposes a fitness function to calculate the fitness value of each path to evaluate the quality of the path:

[0058]

[0059] in, The paths x i path length, occupied security resources, and link load level, d min 、S min 、T min Indicates the minimum resource size required to process the traffic, d max 、S max 、T max Indicates the maximum value of various resources in the path collection.

[0060] During each search for the optimal solution, the SFLA algorithm calculates the fitness values ​​of all solutions, selects the solutions with the best and worst fitness values ​​in each population, and selects the best individual from all solutions. The worst individual in each population is then updated according to the update rule. During the update process, the SFLA algorithm may become trapped in a local optimal solution. To reduce the possibility of this, this paper proposes a dynamic threshold θ that is updated with the number of algorithm iterations to adjust the distance that an individual jumps during each optimization:

[0061]

[0062] Among them, Iter max Indicates the maximum number of iterations set during the entire algorithm search process. rand(0, 1) refers to generating a random number between 0 and 1.

[0063] Based on formula (2), the worst solution update rule and related formulas for each community in the search process are defined:

[0064] 1) For the worst solution x in each community lw Towards the optimal solution x in this community lb Update and set the optimized jump distance to D1. The update steps are as follows:

[0065] D1=rand(0,1)×(θ×x lb -x lw ) (3)

[0066] x′ lw =x lw +D1 (4)

[0067] If the new fitness of the updated solution is greater than the original fitness, the update is successful and the iterative calculation continues. If it is less than the fitness of the original solution, continue to step 2);

[0068] 2) For the worst solution x in the communitylw , to the optimal solution x among all solutions hb Update and set the optimized jump distance to D2. The update steps are as follows:

[0069] D2=rand(0,1)×(θ×x hb -x lw ) (5)

[0070] x′ lw =x lw +D2 (6)

[0071] If the new fitness of the updated solution is greater than the original fitness, the update is successful and the iterative calculation continues. If it is less than the fitness of the original solution, continue to step 3);

[0072] 3) Since the first two updates failed, a new solution is randomly generated in the solution space to replace the worst solution vector. The formula is as follows:

[0073] x′ lw =rand(3, a, b) (7)

[0074] The above formula represents the generation of a 3-dimensional solution vector, where the upper limit of the vector value is a and the lower limit is b.

[0075] To summarize, the complete algorithm of SFLA-TS is shown in Algorithm 2 below:

[0076]

[0077]

[0078] The present invention adopts the above technical solution and proposes a business traffic scheduling method for a network security resource pool based on a hybrid frog leaping algorithm in the field of computer network security. The method analyzes the traffic type flowing into the network security resource pool and plans the required security resource type and scale based on the security log. The controller obtains a set of business traffic processing paths by combining the network topology and the necessary security resources required, and designs a hybrid frog leaping-business traffic scheduling algorithm to select the optimal business traffic processing path. The beneficial effects of the present invention are: 1. A business traffic scheduling strategy is proposed for a new network security architecture; 2. It can more effectively select business traffic processing paths to achieve full utilization of network security resources; 3. It solves the problems of security resource waste and link load imbalance in the network security resource pool.

[0079] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions and effects do not exceed the scope of the technical solution of the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm, characterized in that: include: S1. Business traffic type analysis phase: Analyze business traffic through security hardware to determine the business type of business traffic. Based on different business traffic and security logs, plan the required network security resource type and scale. S2, business traffic processing path set acquisition stage: The controller obtains the business traffic processing path set by combining the network topology and the necessary network security resources required; S3. Design a hybrid frog-leaping-service traffic scheduling algorithm to select the optimal service traffic processing path: Design a fitness function to evaluate the priority of each path in the service traffic processing path set, and select the optimal path using the hybrid frog-leaping-service traffic scheduling algorithm. The specific implementation is as follows: S301. Each path x in the service traffic processing path set is located in a three-dimensional solution space composed of link transmission distance, network security resource usage, and link traffic load. To balance the resources required by these factors in the path, a fitness function F(x) is proposed to calculate the fitness value of each path to evaluate the quality of the path and sort the paths according to the fitness value. S302, all solutions of the fitness function F(x) are distributed in order and initialized into several populations; S303, designing a dynamic threshold function θ to adjust the jump distance of the individual during each optimization, and designing a jump distance formula D1 within the population and a global jump distance formula D2; S304, obtaining the optimal solution and the worst solution in each population and the global optimal solution, and performing the update according to the hybrid frog leaping algorithm until the algorithm termination condition is met; S305: Select the solution vector with the highest fitness among all the final solutions, calculate the vector distance between each solution in the service traffic processing path set and the solution vector with the highest fitness, and select the path with the shortest distance as the optimal path; In step S301, the fitness function F(x) is expressed as follows: in, The paths x i path length, network security resources occupied, and link load level, d min 、S min 、T min They represent the minimum resource scale required to process the corresponding business traffic, d max 、S max 、T max They respectively represent the maximum value of various resources occupied in the service traffic processing path set; In step S303, the dynamic threshold function θ is expressed as follows: Among them, Iter max Indicates the maximum number of iterations set during the entire algorithm search process. rand(0, 1) refers to generating a random number between 0 and 1. In step S303, the intra-population jump distance formula D1 and the global jump distance formula D2 are set as follows: 1) For the worst solution x in each community lw Towards the optimal solution x in this community lb Update and set the optimized jump distance to D1. The update steps are as follows: D1=rand(0,1)×(θ×x lb -x lw ) (3) x′ lw =x lw +D1 (4) If the new fitness of the updated solution is greater than the original fitness, the update is successful and the iterative calculation continues. If it is less than the fitness of the original solution, continue to step 2); 2) For the worst solution x in the community lw , to the optimal solution x among all solutions hb Update and set the optimized jump distance to D2. The update steps are as follows: D2=rand(0,1)×(θ×x hb -x lw ) (5) x′ lw =x lw +D2 (6) If the new fitness of the updated solution is greater than the original fitness, the update is successful and the iterative calculation continues. If it is less than the fitness of the original solution, continue to step 3); 3) Since the first two updates failed, a new solution is randomly generated in the solution space to replace the worst solution vector. The formula is as follows: x′ lw =rand(3,a,b)) (7) Formula (7) represents the generation of a 3-dimensional solution vector, where the upper limit of the vector value is a and the lower limit is b.

2. The method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm according to claim 1, characterized in that: Step S2 is specifically implemented as follows: S201. Use a deep traversal algorithm to obtain the paths from the source nodes of all service traffic to the destination host; S202. Filter out applicable service traffic processing paths based on the required network security resource types and scales; S203 . Based on the result of the screening in step S202 , paths with shorter distances are preferentially selected to form a service traffic processing path set.

3. The method for scheduling service traffic in a network security resource pool based on a hybrid frog leaping algorithm according to claim 2, characterized in that: In step S203, the retention quantity is set to 50% of the screening results.

Images