Resource allocation method and device in security protection process of intranet host node

Abstract

The application relates to a resource allocation method and device in an intranet host node security defense process, computer equipment and a storage medium, and belongs to the technical field of information security. The method comprises the following steps: obtaining a communication relationship between host nodes in a target period, constructing a communication relationship graph corresponding to each host node in a current defense period based on the communication relationship; constructing an adjacency matrix corresponding to the communication relationship graph, an expected state vector corresponding to each host node and a resource allocation matrix; constructing a target constraint condition based on the adjacency matrix and the expected state vector; constructing an expected loss function according to the resource allocation matrix and the expected state vector; and iteratively solving the minimum expected loss function according to the target constraint condition, so as to obtain an optimal solution of the resource allocation matrix, wherein the optimal solution is used for describing a resource allocation result of each host node in the current defense period. The method can guarantee a good defense effect and improve the utilization rate of server resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a resource allocation method and device in a security defense process of an intranet host node, a computer device, a storage medium and a computer program product. BACKGROUND

[0002] Network attacks mainly penetrate into computer systems by exploiting software vulnerabilities in the system. Nowadays, most enterprises establish their own intranet systems by using cloud desktops and other methods. In order to better defend against network attacks, enterprises often consume server resources to conduct centralized killing and resource shuffling at spare time nodes.

[0003] In the process of centralized defense in an intranet system, more server resources invested in a certain host node often result in better defense effects. However, at the same time, the total amount of server resources is often limited. If more server resources are invested in each host node, it will result in serious waste of server resources, i.e., low utilization of server resources. SUMMARY

[0004] Therefore, it is necessary to provide a resource allocation method, device, computer device and storage medium in a security defense process of an intranet host node, which can provide better defense effects while improving the utilization of server resources.

[0005] In a first aspect, the present application provides a resource allocation method in a security defense process of an intranet host node, which comprises:

[0006] obtaining a communication relationship between host nodes in a target period, and constructing a communication relationship diagram corresponding to each host node in a current defense period based on the communication relationship;

[0007] constructing an adjacency matrix corresponding to the communication relationship diagram, an expected state vector corresponding to each host node, and a resource allocation matrix;

[0008] constructing a target constraint condition based on the adjacency matrix and the expected state vector;

[0009] constructing an expected loss function based on the resource allocation matrix and the expected state vector;

[0010] iteratively solving the expected loss function based on the target constraint condition, obtaining an optimal solution of the resource allocation matrix, and using the optimal solution to describe the resource allocation results for each host node in the current defense period.

[0011] In one of the embodiments, the expected loss function comprises a first function term and a second function term, the first function term is used to represent the loss caused by the host node being compromised in the current defense period, and the second function term is used to represent the resource investment in the current defense period.

[0012] In one of the embodiments, the target constraint condition comprises a first constraint term, and the target constraint condition is constructed based on the adjacency matrix and the expected state vector, which comprises:

[0013] The penetration rate, the lateral movement rate and the automatic repair rate of the host node in the current defense period are obtained.

[0014] The first constraint term is constructed according to the penetration rate, the lateral movement rate, the automatic repair rate, the adjacency matrix and the expected state vector,

[0015] The first constraint term is used to constrain the expected loss at the time point other than the defense time point in the current defense period.

[0016] In one of the embodiments, the target constraint condition comprises a second constraint term, and the target constraint condition is constructed based on the adjacency matrix and the expected state vector, which comprises:

[0017] The repair probability of the host node is obtained, and the repair probability is used to represent the probability that the host node in the compromised state becomes the un-compromised state when the target number of resources is invested;

[0018] The second constraint term is constructed according to the repair probability of the host node and the expected state matrix,

[0019] The second constraint term is used to constrain the expected loss at the defense time point in the current defense period.

[0020] In one of the embodiments, the optimal solution of the resource allocation matrix is obtained by iteratively solving the target constraint condition with the minimum expected loss function as the target, which comprises:

[0021] In the current iteration round, the solution of the resource allocation matrix in the current iteration round is obtained by solving the target constraint condition with the minimum expected loss function as the target.

[0022] When the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is less than the convergence error, the solution in the current iteration round is taken as the optimal solution.

[0023] When the difference between the solution of the current iteration round and the solution of the previous iteration round of the resource allocation matrix is greater than or equal to the convergence error, a next iteration round is calculated.

[0024] In one of the embodiments, the communication relationship between the host nodes in the target period is obtained, including:

[0025] A communication relationship obtaining request is sent to each of the host nodes;

[0026] Communication data fed back by each of the host nodes in response to the communication relationship obtaining request is received, and the communication data includes adjacent host nodes that have communicated with the host node in the target period;

[0027] The communication relationship between the host nodes in the target period is determined according to the communication data fed back by each of the host nodes.

[0028] In one of the embodiments, the penetration rate, the horizontal movement rate and the automatic repair rate of the host nodes in the current defense period are obtained, including:

[0029] First historical state distribution data of the host nodes at the beginning of the previous defense period is obtained, and second historical state distribution data of the host nodes at the end of the previous defense period is obtained;

[0030] The first host nodes changed from a damaged state to an undamaged state and the second host nodes changed from the undamaged state to the damaged state are determined according to the first historical state distribution data and the second historical state distribution data;

[0031] The automatic repair rate of the host nodes in the current defense period is determined according to the number of the first host nodes, the total number of the host nodes and the length of the defense period;

[0032] The penetration rate and the horizontal movement rate of the host nodes in the current defense period are respectively determined according to the number of the second host nodes, the total number of the host nodes and the length of the defense period.

[0033] In one of the embodiments, the penetration rate and the horizontal movement rate of the host nodes in the current defense period are respectively determined according to the number of the second host nodes, the total number of the host nodes and the length of the defense period, including:

[0034] The first type of host nodes and the second type of host nodes are determined from the second host nodes according to the damaged types of the second host nodes, wherein the first type is a network attack type, and the second type is a propagation attack type;

[0035] determine a penetration rate of the host nodes in the current defense period according to the number of the host nodes of the first type, the total number of the host nodes and the defense period length;

[0036] determine a lateral movement rate of the host nodes in the current defense period according to the number of the host nodes of the second type, the total number of the host nodes and the defense period length.

[0037] In a second aspect, the present application further provides a resource allocation device in a security defense process of an intranet host node, the device comprising:

[0038] a obtaining module, configured to obtain a communication relationship between host nodes in a target period, and construct a communication relationship diagram corresponding to each of the host nodes in a current defense period based on the communication relationship;

[0039] a first constructing module, configured to construct an adjacency matrix corresponding to the communication relationship diagram, an expected state vector corresponding to each of the host nodes and a resource allocation matrix;

[0040] a second constructing module, configured to construct a target constraint condition based on the adjacency matrix and the expected state vector;

[0041] a third constructing module, configured to construct an expected loss function according to the resource allocation matrix and the expected state vector;

[0042] a processing module, configured to perform iterative solving according to the target constraint condition, with the minimum of the expected loss function as a target, to obtain an optimal solution of the resource allocation matrix, the optimal solution being used to describe a resource allocation result for each of the host nodes in the current defense period.

[0043] In one of the embodiments, the expected loss function comprises a first function item and a second function item, the first function item being used to represent a loss caused by the host nodes being damaged in the current defense period, and the second function item being used to represent a resource input in the current defense period.

[0044] In one of the embodiments, the target constraint condition comprises a first constraint item, and the second constructing module is further configured to:

[0045] obtain a penetration rate, a lateral movement rate and an automatic repair rate of the host nodes in the current defense period;

[0046] construct the first constraint item according to the penetration rate, the lateral movement rate, the automatic repair rate, the adjacency matrix and the expected state vector,

[0047] The first constraint term is used to constrain the expected loss at time points other than the defense time points in the current defense period.

[0048] In one of the embodiments, the target constraint condition includes a second constraint term, and the second constructing module is further configured to:

[0049] obtain a repair probability of the host node, the repair probability being used to represent a probability that the host node in the damaged state becomes in the undamaged state when the target number of resources is put in;

[0050] construct the second constraint term according to the repair probability of the host node and the expected state matrix,

[0051] The second constraint term is used to constrain the expected loss at the defense time points in the current defense period.

[0052] In one of the embodiments, the processing module is further configured to:

[0053] In the current iteration round, the resource allocation matrix in the current iteration round is obtained by solving the target constraint condition with the minimum expected loss function as the target;

[0054] When the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is less than the convergence error, the solution in the current iteration round is taken as the optimal solution;

[0055] When the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is greater than or equal to the convergence error, the calculation of the next iteration round is performed.

[0056] In one of the embodiments, the obtaining module is further configured to:

[0057] send a communication relationship obtaining request to each of the host nodes;

[0058] receive communication data fed back by each of the host nodes in response to the communication relationship obtaining request, the communication data including adjacent host nodes that have communicated with the host node in a target period;

[0059] determine the communication relationship between the host nodes in the target period according to the communication data fed back by each of the host nodes.

[0060] In one of the embodiments, the second constructing module is further configured to:

[0061] acquire first historical state distribution data of the host nodes at the beginning of a previous defense period, and acquire second historical state distribution data of the host nodes at the end of the previous defense period;

[0062] determine, according to the first historical state distribution data and the second historical state distribution data, first host nodes changed from a compromised state to an uncompromised state, and second host nodes changed from the uncompromised state to the compromised state;

[0063] determine, according to the number of the first host nodes, the total number of the host nodes, and the defense period length, an automatic repair rate of the host nodes in a current defense period;

[0064] determine, according to the number of the second host nodes, the total number of the host nodes, and the defense period length, a penetration rate and a lateral movement rate of the host nodes in the current defense period, respectively.

[0065] In one of the embodiments, the second constructing module is further configured to:

[0066] determine, according to the compromised types of the second host nodes, first type host nodes and second type host nodes from the second host nodes, wherein the first type is a network attack type, and the second type is a propagation attack type;

[0067] determine, according to the number of the first type host nodes, the total number of the host nodes, and the defense period length, a penetration rate of the host nodes in a current defense period;

[0068] determine, according to the number of the second type host nodes, the total number of the host nodes, and the defense period length, a lateral movement rate of the host nodes in the current defense period.

[0069] In a third aspect, the present application provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the resource allocation method in the process of the security defense of the internal network host nodes according to the computer program.

[0070] In a fourth aspect, the present application provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the resource allocation method in the process of the security defense of the internal network host nodes.

[0071] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and the computer program is executed by a processor to implement the resource allocation method in the process of the security defense of the internal network host nodes.

[0072] The resource allocation method, device, computer device and storage medium in the internal network host node security defense process provided in the embodiments of the present disclosure can fully consider internal network information for resource allocation, fully consider the communication conditions between the host nodes in the process of resource allocation, accurately perform targeted resource allocation for each host node, can reduce the waste of server resources while ensuring good defense effect, and improve the utilization rate of server resources. BRIEF DESCRIPTION OF DRAWINGS

[0073] Figure 1 A flowchart of a resource allocation method in an internal network host node security defense process in an embodiment;

[0074] Figure 2 A schematic diagram of a resource allocation method in an internal network host node security defense process in an embodiment;

[0075] Figure 3 A flowchart of step 102 in an embodiment;

[0076] Figure 4 A flowchart of step 106 in an embodiment;

[0077] Figure 5 A flowchart of step 106 in an embodiment;

[0078] Figure 6 A flowchart of step 110 in an embodiment;

[0079] Figure 7 A flowchart of step 402 in an embodiment;

[0080] Figure 8 A flowchart of step 708 in an embodiment;

[0081] Figure 9A structural block diagram of a resource allocation device in a security defense process of an intranet host node in an embodiment;

[0082] Figure 10 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0083] For the purpose, technical solutions and advantages of the present application to be more clear, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0084] In an embodiment, as shown in Figure 1 , a resource allocation method in a security defense process of an intranet host node is provided. The embodiment is exemplified by the method applied to a terminal. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is realized through the interaction of the terminal and the server. In the embodiment, the method includes the following steps:

[0085] Step 102, obtaining the communication relationship between the host nodes in the target period, and constructing a communication relationship graph corresponding to each host node in the current defense period based on the communication relationship.

[0086] In the embodiment of the present disclosure, at the beginning of the current defense period, the communication relationship between each host node in the intranet in the target period is obtained. The communication relationship is used to describe the communication between the host devices in the intranet. The target period can be a preset time range, for example, the past week before the current time. After obtaining the communication relationship, a corresponding communication relationship graph can be constructed based on the communication relationship. For example, the communication relationship includes (host node A, host node B), (host node A, host node C), and (host node B, host node D). The obtained communication relationship graph can be referred to Figure 2 .

[0087] In an exemplary embodiment, as shown in Figure 3 , in step 102, obtaining the communication relationship between the host nodes in the target period can include:

[0088] Step 302, sending a communication relationship acquisition request to each host node;

[0089] Step 304, receiving communication data fed back by each host node in response to the communication relationship acquisition request, the communication data including adjacent host nodes that have communicated with the host node in the target period;

[0090] Step 306, determining the communication relationship between the host nodes in the target period according to the communication data fed back by each host node.

[0091] In the embodiments of the present disclosure, after generating a communication behavior, each host node can record a communication object corresponding to the communication behavior locally, for example, after sending information, the host node receiving the information is recorded as a communication object, or after receiving information, the host node sending the information can be recorded as a communication object.

[0092] When the current defense period starts, a communication relationship acquisition request can be sent to each host node. After receiving the communication relationship acquisition request, each host node sorts the communication objects recorded locally in the target period as adjacent host nodes, and feeds back communication data including the adjacent host nodes, for example, the host node currently receiving the communication relationship acquisition request is A, and the feedback communication data can include adjacent host node B and adjacent host node C.

[0093] The communication relationship between the host nodes can be constructed according to the communication data fed back by each host node. For example, the communication relationship (host node A, host node B), (host node A, host node C) is constructed according to the communication data sent by the host node A, and the corresponding communication relationship is constructed according to the communication data sent by other host nodes. After deduplication, the communication relationship between the host nodes in the target period is obtained.

[0094] In this way, in the embodiments of the present disclosure, the real-time communication relationship can be acquired when the current defense period starts, and the real-time communication relationship is used to accurately allocate resources to each host node, so that the waste of server resources is reduced and the utilization rate of server resources is improved while ensuring good defense effect.

[0095] Step 104, constructing an adjacent matrix corresponding to the communication relationship graph, an expected state vector corresponding to each host node, and a resource allocation matrix.

[0096] In the embodiments of the present disclosure, after obtaining the communication relationship, the corresponding adjacent matrix can be constructed based on the communication relationship. For example, it is assumed that an enterprise intends to use the centralized defense method at specific time nodes in the future period to deal with potential network attacks, and the time range is defined as [0, T], where T represents the current defense period, the number of host nodes of the enterprise is N, and a set of defense time point sequences is set in advance, represented as , wherein, centralized investigation and repair will be performed at each defense time point. For convenience, let , wherein, is the set of defense time points, is the vector of defense time points.

[0097] Let denotes the total server resources that can be allocated at the th defense time node, denotes the total server resources that can be allocated at the th defense time node, denotes the server resources allocated to the th host node at the th defense time node, then wherein is the th defense time node, the resource allocation matrix can be expressed as: wherein the feasible set is The total number of host nodes is The communication relationship graph is represented by a graph , wherein denotes the set of host nodes, denotes the set of edges. , denotes the th host node, and each edge denotes that the host nodes have communicated with each other in the internal network. The adjacency matrix A of the communication relationship graph is expressed by the following formula (I):

[0098] Formula (I)

[0099] wherein = 1 or 0 respectively indicates that the edge belongs to and the edge does not belong to .

[0100] It is assumed that the host nodes in the internal network can only be in one of the following two states: uncompromised state and compromised state. The uncompromised state indicates that the node has not been attacked and invaded by the network, and the compromised state indicates that the node has been invaded. Let and denote the probabilities of the uncompromised state and the compromised state of the host node at time . Since , the expected state vector at time can be expressed as . It is assumed that the entire internal network has not been attacked at the initial time, i.e. .

[0101] In step 106, based on the adjacency matrix and the expected state vector, a target constraint condition is constructed.

[0102] In the embodiments of the present disclosure, when constructing the target constraint condition, the expected state change of the internal network at different time points needs to be considered, for example, the expected state at the initial moment, the expected state at the non-defense time point, and the expected state at the defense time point, so as to construct the constraint condition based on the adjacency matrix and the expected state vector, and obtain the target constraint condition.

[0103] In an exemplary embodiment, the target constraint condition includes a first constraint term, referring to Figure 4 As shown in FIG. 1, in step 106, the target constraint condition is constructed based on the adjacency matrix and the expected state vector, including:

[0104] In step 402, the penetration rate, the horizontal movement rate and the automatic repair rate of the host node in the current defense period are obtained.

[0105] In step 404, the first constraint term is constructed according to the penetration rate, the horizontal movement rate, the automatic repair rate, the adjacency matrix and the expected state vector,

[0106] The first constraint term is used to constrain the expected loss at the time point outside the defense time point in the current defense period.

[0107] In the embodiments of the present disclosure, the case of is considered, in which the expected state of the entire internal network is gradually changed. The penetration rate is used to represent the average rate of the change of the non-affected host into the affected host at the time point due to the network attack, the horizontal movement rate is used to represent the average rate of the change of the non-affected host into the affected host at the time point due to the horizontal movement of the adjacent affected host node, the automatic repair rate is used to represent the average rate of the change of the affected host into the non-affected host under the influence of the automatically running network defense software accumulated in the host node. Then the first constraint term in the case of is expressed as formula (2).

[0108] Formula (2)

[0109] wherein, P (t, t) represents the probability of the affected state of the host node at the time t, P (t, t) represents the probability of the affected state of the host node at the time t.

[0110] In an exemplary embodiment, the target constraint condition comprises a second constraint term, referring to Figure 5 As shown, in step 106, the target constraint condition is constructed based on the adjacency matrix and the expected state vector, comprising:

[0111] In step 502, the repair probability of the host node is obtained, the repair probability being used to represent the probability that the host node in the damaged state becomes the undamaged state when the target number of resources is put in;

[0112] In step 504, the second constraint term is constructed according to the repair probability of the host node and the expected state matrix,

[0113] The second constraint term is used to constrain the expected loss at the defense time point in the current defense period.

[0114] In the embodiments of the present disclosure, the situation of is considered. In this situation, the expected state of the intranet will be mutated due to the defense control. Without loss of generality, let , wherein , let represent the probability (i.e., the repair probability) that a damaged host becomes an undamaged host when the target number of server resources is put in. For each , the second constraint term is constructed, and the second constraint term is represented as formula (three).

[0115] Formula (three)

[0116] , wherein represents the probability that the host node is damaged at the defense time point .

[0117] According to the first constraint term and the second constraint term, the target constraint term F can be obtained. The target constraint term F can be represented as formula (four).

[0118] Formula (four)

[0119] In step 108, the expected loss function is constructed according to the resource allocation matrix and the expected state vector.

[0120] In the embodiments of the present disclosure, the expected loss function can be further constructed according to the resource allocation matrix and the expected state vector. In an exemplary embodiment, the expected loss function comprises a first function term and a second function term, the first function term being used to represent the loss caused by the damaged host in the current defense period, and the second function term being used to represent the resource input in the current defense period.

[0121] Considering that each compromised host node can incur a certain degree of security loss in the whole control process, let be the security loss per unit time, which is used to represent the average loss per unit time caused by a compromised host node. Then, the expected loss function of the resource allocation matrix can be expressed as formula (5).

[0122] Formula (5)

[0123] wherein the first function item can be , which represents the loss caused by the compromise of the host node in the current defense period, and the second function item can be , which represents the resource investment in the current defense period.

[0124] In step 110, the optimal solution of the resource allocation matrix is obtained by iteratively solving the target constraint condition with the minimum expected loss function as the target, and the optimal solution is used to describe the resource allocation result for each host node in the current defense period.

[0125] In the embodiments of the present disclosure, after the target constraint condition and the expected loss function are constructed, the resource allocation matrix can be solved with the minimum expected loss function as the target, and the optimal solution obtained is used as the final resource allocation result, that is, the optimal solution of the resource allocation matrix is used to describe the server resource allocation of each host node at each defense time point in the current defense period.

[0126] The resource allocation method in the internal network host node security defense process described above can obtain the communication relationship between the host nodes in the target period, construct the communication relationship graph corresponding to each host node in the current defense period based on the communication relationship, and construct the adjacency matrix corresponding to the communication relationship graph, the expected state vector corresponding to each host node, and the resource allocation matrix. Further, the target constraint condition can be constructed based on the adjacency matrix and the expected state vector, and the expected loss function can be constructed according to the resource allocation matrix and the expected state vector. The optimal solution of the resource allocation matrix is obtained by iteratively solving the target constraint condition with the minimum expected loss function as the target, and the optimal solution is used to describe the resource allocation result for each host node in the current defense period. Based on the resource allocation method, device, computer equipment and storage medium provided in the internal network host node security defense process of the embodiments of the present disclosure, the resource allocation can be fully considered based on the internal network information, the communication between the host nodes is fully considered in the process of resource allocation, and the targeted resource allocation is accurately performed for each host node. The waste of server resources can be reduced while ensuring good defense effect, and the utilization rate of server resources can be improved.

[0127] In an exemplary embodiment, refer to Figure 6As shown, in step 110, an optimal solution of the resource allocation matrix is obtained by iterative solving according to the target constraint condition with the minimum expected loss function as the target.

[0128] In step 602, a solution of the resource allocation matrix in the current iteration round is obtained by solving according to the target constraint condition with the minimum expected loss function as the target.

[0129] In step 604, when the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is less than the convergence error, the solution in the current iteration round is taken as the optimal solution.

[0130] In step 606, when the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is greater than or equal to the convergence error, the calculation of the next iteration round is performed.

[0131] In the embodiments of the present disclosure, the expected loss of the resource allocation strategy can be taken as the optimization target, and the original problem can be reduced to the following optimal pulse control problem, as shown in formula (six).

[0132] Formula (six)

[0133] The solving process of the optimal pulse control problem can include: according to the maximum value principle of pulse control, the Hamilton function of formula (six) is formula (seven), and the pulse Hamilton function is formula (eight).

[0134] Formula (seven)

[0135] Formula (eight)

[0136] Wherein, is the corresponding adjoint function.

[0137] Wherein, the constraint of formula (seven) and formula (eight) can refer to the following formula (nine).

[0138] Formula (nine)

[0139] If formula (six) has an optimal solution According to the maximum value principle of pulse control, there is an adjoint function Satisfying the constraint conditions represented by the following formula (ten) and formula (eleven).

[0140] Formula (ten)

[0141] Formula (eleven)

[0142] Using the above solving process, the solution of the current iteration round can be obtained, but only when the calculation converges can it be said that the algorithm has a solution. The convergence condition can include the difference between the solution of the current iteration round and the solution of the last iteration round, and the difference is less than the convergence error, that is, the solution of the current iteration round is the optimal solution, otherwise the calculation process of the next iteration round is continued until the convergence error is satisfied.

[0143] For example, the iteration process is as follows:

[0144] Input: An example of formula (six), the convergence error is . Output: A resource allocation strategy .

[0145] 1: ; ;

[0146] 2: repeat;

[0147] 3: ;

[0148] 4: Forward calculation according to formula (four) : ; ;

[0149] 5: Backward calculation according to formula (seven) : ; ; ;

[0150] 6: Calculation according to formula (eight) : ; ; ;

[0151] 7: until ;

[0152] 8: return .

[0153] Wherein, k represents the kth iteration round.

[0154] Using the resource allocation method in the security defense process of the intranet host node provided by the embodiment of the disclosure, the optimal solution of the resource allocation matrix is determined through the multi-iteration solving method, which can accurately allocate resources to each host node, can reduce the waste of server resources while ensuring good defense effect, and improve the utilization rate of server resources.

[0155] In an exemplary embodiment, refer to Figure 7As shown, in step 402, the penetration rate, the horizontal movement rate and the automatic repair rate of the host nodes in the current defense period are obtained, including:

[0156] In step 702, the first historical state distribution data of the host nodes at the beginning of the previous defense period is obtained, and the second historical state distribution data of the host nodes at the end of the previous defense period is obtained.

[0157] In step 704, the first host nodes changed from the compromised state to the uncompromised state and the second host nodes changed from the uncompromised state to the compromised state are determined according to the first historical state distribution data and the second historical state distribution data.

[0158] In step 706, the automatic repair rate of the host nodes in the current defense period is determined according to the number of the first host nodes, the total number of the host nodes and the length of the defense period.

[0159] In step 708, the penetration rate and the horizontal movement rate of the host nodes in the current defense period are respectively determined according to the number of the second host nodes, the total number of the host nodes and the length of the defense period.

[0160] In the embodiments of the present disclosure, at the beginning of the current defense period, the historical state distribution data of the host nodes recorded at the beginning of the previous defense period can be obtained as the first historical state distribution data, and the historical state distribution data of the host nodes recorded at the end of the previous defense period can be obtained as the second historical state distribution data. The host nodes in the first historical state distribution data with the state of the compromised state but in the second historical state distribution data with the state of the uncompromised state are taken as the first host nodes, and the host nodes in the first historical state distribution data with the state of the uncompromised state but in the second historical state distribution data with the state of the compromised state are taken as the second host nodes.

[0161] The number of the first host nodes is counted, and the automatic repair rate of the host nodes in the current defense period is determined based on the number of the first host nodes, the total number of the host nodes and the length of the defense period corresponding thereto, wherein the automatic repair rate is positively correlated with the number of the first host nodes, and is negatively correlated with the total number of the host nodes and the length of the defense period corresponding thereto. For example, if the number of the first host nodes is 20, the total number of the host nodes is 100, and the defense period is 5 days, then the automatic repair rate is 20 / (100*5)=0.04.

[0162] Similarly, the number of the second host nodes can be counted, and the penetration rate and the horizontal movement rate of the host nodes in the current defense period can be determined according to the number of the second host nodes, the total number of the host nodes and the length of the defense period corresponding thereto.

[0163] In an exemplary embodiment, refer to Figure 8As shown, in step 708, the penetration rate and the lateral movement rate of the host nodes in the current defense period are respectively determined according to the number of the second host nodes, the total number of the host nodes and the length of the defense period, including:

[0164] In step 802, the first type of host nodes and the second type of host nodes are determined from the second host nodes according to the damage type of the second host nodes, wherein the first type is the network attack type and the second type is the propagation attack type.

[0165] In step 804, the penetration rate of the host nodes in the current defense period is determined according to the number of the first type of host nodes, the total number of the host nodes and the length of the defense period.

[0166] In step 806, the lateral movement rate of the host nodes in the current defense period is determined according to the number of the second type of host nodes, the total number of the host nodes and the length of the defense period.

[0167] In the embodiments of the present disclosure, the reason for the damage of the second host nodes can be that the second host nodes are attacked by the network or that the second host nodes are damaged by the lateral propagation of the adjacent host nodes with which the second host nodes have a communication relationship. Therefore, the damage type of the second host nodes can be determined by checking the log, and the first type of host nodes and the second type of host nodes can be determined from the second host nodes according to the damage type.

[0168] The first type of host nodes are the host nodes damaged by the network attack, and the number of the first type of host nodes can be counted. The penetration rate of the host nodes in the current defense period can be determined according to the number of the first type of host nodes, the total number of the host nodes and the length of the defense period. The penetration rate is positively correlated with the number of the first type of host nodes, and is negatively correlated with the total number of the host nodes and the length of the defense period. For example, the number of the first type of host nodes is 100, the total number of the host nodes is 100, and the defense period is 5 days. Therefore, the penetration rate is 100 / (100*5)=0.02.

[0169] The second type of host nodes are the host nodes damaged by the propagation attack, and the number of the second type of host nodes can be counted. The lateral movement rate of the host nodes in the current defense period can be determined according to the number of the second type of host nodes, the total number of the host nodes and the length of the defense period. The lateral movement rate is positively correlated with the number of the second type of host nodes, and is negatively correlated with the total number of the host nodes and the length of the defense period. For example, the number of the second type of host nodes is 100, the total number of the host nodes is 100, and the defense period is 5 days. Therefore, the lateral movement rate is 100 / (100*5)=0.02.

[0170] By adopting the resource allocation method in the internal network host node security defense process provided in the embodiments of the present disclosure, the penetration rate, the horizontal movement rate and the automatic repair rate can be dynamically determined periodically, the target constraint condition constructed based on the dynamically determined penetration rate, the horizontal movement rate and the automatic repair rate is used to solve the expected loss, and the accuracy of the final resource allocation result can be greatly improved, so that the server resource utilization rate is improved while the defense effect is ensured.

[0171] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the order of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or steps or stages in other steps.

[0172] Based on the same inventive concept, the embodiments of the present disclosure also provide a resource allocation device in an internal network host node security defense process for implementing the above-mentioned resource allocation method in the internal network host node security defense process. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more resource allocation device embodiments in the internal network host node security defense process provided below can refer to the limitations of the resource allocation method in the internal network host node security defense process described above, which will not be repeated here.

[0173] In one embodiment, as shown in Figure 9 a resource allocation device in an internal network host node security defense process is provided, comprising: an acquisition module 902, a first construction module 904, a second construction module 906, a third construction module 908 and a processing module 910, wherein:

[0174] The acquisition module 902 is configured to acquire a communication relationship between host nodes in a target period, and construct a communication relationship diagram corresponding to each host node in a current defense period based on the communication relationship;

[0175] The first construction module 904 is configured to construct an adjacency matrix corresponding to the communication relationship diagram, an expected state vector corresponding to each host node, and a resource allocation matrix;

[0176] The second construction module 906 is configured to construct a target constraint condition based on the adjacency matrix and the expected state vector;

[0177] The third construction module 908 is configured to construct an expected loss function according to the resource allocation matrix and the expected state vector.

[0178] The processing module 910 is configured to iteratively solve, according to the target constraint condition, a minimum of the expected loss function, to obtain an optimal solution of the resource allocation matrix, where the optimal solution is used to describe a resource allocation result of each host node in the current defense period.

[0179] The resource allocation apparatus in the process of security defense of the internal network host node provided in the embodiments of the present disclosure can fully consider the internal network information for resource allocation, fully consider the communication conditions between the host nodes in the process of resource allocation, accurately perform targeted resource allocation for each host node, and can reduce the waste of server resources while ensuring good defense effect, and improve the utilization rate of server resources.

[0180] In one of the embodiments, the expected loss function includes a first function item and a second function item, the first function item is used to represent a loss caused by the host node being damaged in the current defense period, and the second function item is used to represent resource investment in the current defense period.

[0181] In one of the embodiments, the target constraint condition includes a first constraint item, and the second construction module 906 is further configured to:

[0182] obtain a penetration rate, a horizontal movement rate and an automatic repair rate of the host node in the current defense period;

[0183] construct the first constraint item according to the penetration rate, the horizontal movement rate, the automatic repair rate, the adjacency matrix and the expected state vector,

[0184] The first constraint item is used to constrain the expected loss at a time point outside the defense time point in the current defense period.

[0185] In one of the embodiments, the target constraint condition includes a second constraint item, and the second construction module 906 is further configured to:

[0186] obtain a repair probability of the host node, where the repair probability is used to represent a probability that the host node in the damaged state becomes the undamaged state when a target amount of resources is invested;

[0187] construct the second constraint item according to the repair probability of the host node and the expected state matrix.

[0188] wherein the second constraint term is used to constrain the expected loss at the defense time point within the current defense period.

[0189] In one of the embodiments, the processing module 910 is further configured to:

[0190] solving, according to the target constraint condition, the resource allocation matrix in the current iteration round with the minimum expected loss function as the target, to obtain a solution of the resource allocation matrix in the current iteration round;

[0191] when the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is less than the convergence error, taking the solution in the current iteration round as the optimal solution;

[0192] when the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the last iteration round is greater than or equal to the convergence error, performing the calculation of the next iteration round.

[0193] In one of the embodiments, the obtaining module 902 is further configured to:

[0194] sending a communication relationship obtaining request to each of the host nodes;

[0195] receiving communication data fed back by each of the host nodes in response to the communication relationship obtaining request, wherein the communication data includes adjacent host nodes that have communicated with the host node within a target period;

[0196] determining the communication relationship between the host nodes within the target period according to the communication data fed back by each of the host nodes.

[0197] In one of the embodiments, the second constructing module 906 is further configured to:

[0198] obtaining first historical state distribution data of the host nodes at the beginning of the last defense period, and obtaining second historical state distribution data of the host nodes at the end of the last defense period;

[0199] determining first host nodes that change from the compromised state to the uncompromised state and second host nodes that change from the uncompromised state to the compromised state according to the first historical state distribution data and the second historical state distribution data;

[0200] determining an automatic repair rate of the host nodes within the current defense period according to the number of the first host nodes, the total number of the host nodes, and the length of the defense period;

[0201] According to the number of the second host nodes, the total number of the host nodes and the defense cycle length, a penetration rate of the host nodes in the current defense cycle and a lateral movement rate of the host nodes in the current defense cycle are determined respectively.

[0202] In one of the embodiments, the second construction module 906 is further configured to:

[0203] According to the damage type of the second host nodes, first type host nodes and second type host nodes are determined from the second host nodes, wherein the first type is a network attack type and the second type is a propagation attack type;

[0204] According to the number of the first type host nodes, the total number of the host nodes and the defense cycle length, the penetration rate of the host nodes in the current defense cycle is determined.

[0205] According to the number of the second type host nodes, the total number of the host nodes and the defense cycle length, the lateral movement rate of the host nodes in the current defense cycle is determined.

[0206] The modules in the resource allocation apparatus in the internal network host node security defense process can be realized by software, hardware and combinations thereof in whole or in part. The modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the modules.

[0207] In one embodiment, a computer device, which can be a terminal, has an internal structure as shown in Figure 10 The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by the processor to implement a resource allocation method in an internal network host node security defense process.

[0208] Those skilled in the art can understand that, Figure 10The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0209] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps of any one of the above code specification detection methods when executing the computer program.

[0210] In one embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implementing the steps of any one of the above code specification detection methods when executed by a processor.

[0211] In one embodiment, a computer program product is provided, comprising a computer program, and the computer program implementing the steps of any one of the above code specification detection methods when executed by a processor.

[0212] The resource allocation method and device in the security defense process of the intranet host node provided by the present application can be used in the financial field, and can also be used in any field other than the financial field, such as big data, cloud computing, blockchain, artificial intelligence, information security, Internet of Things, 5G technology field, and the application field of the resource allocation method and device in the security defense process of the intranet host node is not limited by the present application.

[0213] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0214] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0215] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method for resource allocation in an Intranet host node security defense process, characterized in that, The method comprises: obtaining a communication relationship between host nodes in a target period, and constructing a communication relationship diagram corresponding to each host node in a current defense period based on the communication relationship; constructing an adjacency matrix corresponding to the communication relationship diagram, an expected state vector corresponding to each host node, and a resource allocation matrix; constructing a target constraint condition based on the adjacency matrix and the expected state vector; constructing an expected loss function according to the resource allocation matrix and the expected state vector; iteratively solving the expected loss function to obtain an optimal solution of the resource allocation matrix according to the target constraint condition, wherein the optimal solution is used to describe a resource allocation result for each host node in the current defense period.

2. The method of claim 1, wherein, The expected loss function comprises a first function item and a second function item, the first function item is used to represent a loss caused by the host nodes being damaged in the current defense period, and the second function item is used to represent a resource input in the current defense period.

3. The method of claim 1, wherein, The target constraint condition comprises a first constraint item, and the construction of the target constraint condition based on the adjacency matrix and the expected state vector comprises: obtaining a penetration rate, a horizontal movement rate and an automatic repair rate of the host nodes in the current defense period; constructing the first constraint item according to the penetration rate, the horizontal movement rate, the automatic repair rate, the adjacency matrix and the expected state vector, wherein the first constraint item is used to constrain an expected loss at a time point other than a defense time point in the current defense period.

4. The method according to claim 1 or 3, characterized in that, The target constraint condition comprises a second constraint item, and the construction of the target constraint condition based on the adjacency matrix and the expected state vector comprises: obtaining a repair probability of the host nodes, wherein the repair probability is used to represent a probability that a host node in a damaged state becomes an undamaged state when a target amount of resources is input; constructing the second constraint item according to the repair probability of the host nodes and the expected state vector, wherein the second constraint item is used to constrain an expected loss at a defense time point in the current defense period.

5. The method of claim 1, wherein, The iterative solving of the expected loss function to obtain the optimal solution of the resource allocation matrix according to the target constraint condition comprises: solving the expected loss function to obtain a solution of the resource allocation matrix in a current iteration round according to the target constraint condition; when a difference between the solution of the resource allocation matrix in the current iteration round and a solution in a previous iteration round is less than a convergence error, taking the solution in the current iteration round as the optimal solution; when the difference between the solution of the resource allocation matrix in the current iteration round and the solution in the previous iteration round is greater than or equal to the convergence error, performing calculation in a next iteration round.

6. The method of claim 1, wherein, The obtaining of the communication relationship between the host nodes in the target period comprises: sending a communication relationship obtaining request to each host node; receive communication data fed back by each of the host nodes in response to the communication relationship acquisition request, the communication data including adjacent host nodes that have communicated with the host nodes in a target period; determine a communication relationship between the host nodes in the target period according to the communication data fed back by each of the host nodes.

7. The method of claim 3, wherein, the acquisition of the penetration rate, the horizontal movement rate and the automatic repair rate of the host nodes in the current defense period includes: acquire first historical state distribution data of the host nodes at the beginning of the previous defense period, and acquire second historical state distribution data of the host nodes at the end of the previous defense period; determine first host nodes changed from a damaged state to an undamaged state and second host nodes changed from the undamaged state to the damaged state according to the first historical state distribution data and the second historical state distribution data; determine the automatic repair rate of the host nodes in the current defense period according to the number of the first host nodes, the total number of the host nodes and the length of the defense period; determine the penetration rate and the horizontal movement rate of the host nodes in the current defense period according to the number of the second host nodes, the total number of the host nodes and the length of the defense period, respectively.

8. The method of claim 7, wherein, the determination of the penetration rate and the horizontal movement rate of the host nodes in the current defense period according to the number of the second host nodes, the total number of the host nodes and the length of the defense period, respectively, includes: determine first type host nodes and second type host nodes from the second host nodes according to the damaged types of the second host nodes, wherein the first type is a network attack type and the second type is a propagation attack type; determine the penetration rate of the host nodes in the current defense period according to the number of the first type host nodes, the total number of the host nodes and the length of the defense period; determine the horizontal movement rate of the host nodes in the current defense period according to the number of the second type host nodes, the total number of the host nodes and the length of the defense period.

9. A device for resource allocation in an Intranet host node security defense process, characterized in that, the device includes: an acquisition module configured to acquire a communication relationship between host nodes in a target period, and construct a communication relationship graph corresponding to each of the host nodes in a current defense period based on the communication relationship; a first construction module configured to construct an adjacent matrix corresponding to the communication relationship graph, an expected state vector corresponding to each of the host nodes and a resource allocation matrix; a second construction module configured to construct a target constraint condition based on the adjacent matrix and the expected state vector; a third construction module configured to construct an expected loss function according to the resource allocation matrix and the expected state vector; a processing module configured to perform iterative solving with the target constraint condition and the expected loss function as the target, to obtain an optimal solution of the resource allocation matrix, and the optimal solution is used to describe a resource allocation result for each of the host nodes in the current defense period.

10. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, the processor implements the steps of the method of any one of claims 1 to 8 when executing the computer program. the processor implements the steps of the method of any one of claims 1 to 8 when executing the computer program.

11. A computer readable storage medium having stored thereon a computer program, characterized in that The computer program, which when executed by a processor, implements the steps of the method of any one of claims 1 to 8.

12. A computer program product comprising a computer program, characterized in that, The computer program, which when executed by a processor, implements the steps of the method of any one of claims 1 to 8.

Images