Method, apparatus and device for determining resource allocation strategy

Abstract

The application discloses a method, device and equipment for determining a resource allocation strategy. The method comprises the following steps: in the case that N alarms are received, M safety resources corresponding to the N alarms are determined, the safety resources are used for processing the alarms; a processing success rate function corresponding to the N alarms and a processing capacity corresponding to each of the M safety resources are obtained, the processing capacity is the maximum number of alarms that can be simultaneously processed by the safety resource; a resource allocation model is constructed by taking the processing success rate function as an objective function and taking the number of alarms simultaneously processed by the safety resource as a constraint condition; and an optimization algorithm is used to solve the maximization problem of the resource allocation model, and the optimal solution is determined as the allocation strategy of the M safety resources. According to the method for determining the resource allocation strategy, the safety resources can be dynamically configured, the utilization rate of the safety resources and the alarm processing efficiency are improved, and the reliability of SOAR is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a method and device for determining a resource allocation strategy. BACKGROUND

[0002] Security Orchestration, Automation and Response (SOAR) is a combination of security orchestration and automation, a security event response platform and a threat intelligence platform. In the execution engine of SOAR, a process handling model for a certain threat scenario is first defined through visual process orchestration, and when the model is hit, automated research and evidence collection are started, and a series of automated responses are performed according to the results of the evidence collection data. Although the series of response actions are different for different threat scenarios, the overall device linkage-oriented response actions mainly include four types of global blocking, host isolation, host cleaning and host reinforcement, and are matched with other auxiliary responses such as creating a work order, pre-warning notification and manual review. The above is the known implementation mode and model in the SOAR solution.

[0003] At present, the response mode and response device of SOAR are fixed in the process, and the security resources cannot be dynamically configured. Therefore, in the case of changes in security resources and / or a sharp increase in the number of alarms, there may be a situation that the existing security resources are idle and the alarms cannot be processed in time, resulting in low resource utilization and alarm processing efficiency, and reducing the reliability of SOAR. SUMMARY

[0004] The embodiments of the application provide a method and device for determining a resource allocation strategy, a computer readable storage medium and a computer program product, which can dynamically configure security resources, improve the utilization of security resources and the efficiency of alarm processing, and improve the reliability of SOAR.

[0005] In a first aspect, the embodiments of the application provide a method for determining a resource allocation strategy, which comprises:

[0006] In the case of receiving N alarms, M security resources corresponding to the N alarms are determined, the security resources are used to process the alarms, M and N are positive integers;

[0007] A processing success rate function corresponding to the N alarms and a processing capacity corresponding to each of the M security resources are obtained, the processing success rate function is used to determine the processing success rate of the M security resources on the N alarms, and the processing capacity is the maximum number of alarms that can be processed by the security resource at the same time;

[0008] A resource allocation model is constructed with the processing success rate function as a target function and with the constraint condition that the number of alarms simultaneously processed by the safety resource is not greater than the processing capacity.

[0009] The maximum problem of the resource allocation model is solved by using an optimization algorithm, and an optimal solution is determined as the allocation strategy of the M safety resources.

[0010] In a possible implementation, the processing success rate function corresponding to the N alarms is obtained by:

[0011] A processing result function corresponding to the alarm is obtained, and the processing result function is used to determine the processing result of the safety resource on the alarm.

[0012] The processing success rate function is constructed based on the processing result function and N.

[0013] In a possible implementation, the processing result function corresponding to the alarm is obtained by:

[0014] A stay time function corresponding to the alarm and a stay time threshold are obtained, and the stay time function is used to determine the stay time of the alarm in the safety resource.

[0015] The processing result function is constructed based on the stay time function and the stay time threshold.

[0016] In a possible implementation, the stay time function corresponding to the alarm is obtained by:

[0017] In a case where the processing manner of the safety resource on the alarm is first-come-first-processed, and the arrival of the alarm at the safety resource obeys a negative exponential distribution, an average processing rate of the safety resource, an average arrival rate of the alarm, and a processing capacity are obtained.

[0018] Based on an M / M / S queue model, the average stay time function corresponding to the safety resource is constructed according to the average processing rate, the average arrival rate of the alarm, and the processing capacity.

[0019] The average stay time function corresponding to the safety resource is determined as the stay time function of the alarm corresponding to the safety resource.

[0020] In a possible implementation, the target function is a fitness function, and the optimization algorithm is a genetic algorithm.

[0021] In a possible implementation, the maximum problem of the resource allocation model is solved by using an optimization algorithm, and an optimal solution is determined as the allocation strategy of the M safety resources, including:

[0022] randomly generate a first population, wherein the first population comprises a plurality of individuals, each of the individuals corresponding to a resource allocation strategy;

[0023] substitute the a% of the second individuals in the second population with the a% of the first individuals to obtain a third population;

[0024] determine the first individuals corresponding to the first a% of the first fitness values with the largest numerical values in the plurality of the first fitness values;

[0025] perform crossover and mutation on the first population to obtain a second population;

[0026] substitute the a% of the second individuals in the second population with the a% of the first individuals to obtain a third population;

[0027] determine the second individuals corresponding to the first a% of the second fitness values with the smallest numerical values in the plurality of the second fitness values;

[0028] substitute the a% of the second individuals in the second population with the a% of the first individuals to obtain a third population;

[0029] take the third population as the first population, and return to perform the substituting the plurality of individuals in the first population into the fitness function until the number of iterations reaches a preset iteration threshold to obtain a target population;

[0030] determine the individual with the largest fitness value in the target population as the allocation strategy of the M safe resources.

[0031] In a possible implementation, the determining the M safe resources corresponding to the N alarms in the case of receiving the N alarms comprises:

[0032] In the case of receiving the alarm information, determining the N alarms in the alarm information, and state information and attribute information corresponding to a plurality of safe resources in a safe resource set;

[0033] For each of the safe resources, matching the alarm information and the attribute information based on the state information;

[0034] determining the safe resources corresponding to the M attribute information matched with the alarm information as the M safe resources corresponding to the N alarms.

[0035] In a second aspect, an embodiment of the present application provides a resource allocation strategy determination apparatus, which comprises:

[0036] The first determining module is configured to determine M safety resources corresponding to N alarms in a case where the N alarms are received, the safety resources being used for processing the alarms, M and N being positive integers;

[0037] The obtaining module is configured to obtain a processing success rate function corresponding to the N alarms and a processing capacity corresponding to each of the M safety resources, the processing success rate function being used for determining a processing success rate of the M safety resources on the N alarms, and the processing capacity being a maximum number of alarms that can be simultaneously processed by the safety resource;

[0038] The constructing module is configured to construct a resource allocation model with the processing success rate function as a target function and with a number of alarms simultaneously processed by the safety resource being not greater than the processing capacity as a constraint condition;

[0039] The second determining module is configured to solve a maximization problem of the resource allocation model by using an optimization algorithm, and determine an optimal solution as an allocation strategy of the M safety resources.

[0040] In a third aspect, an electronic device is provided, and the device includes a processor and a memory storing computer program instructions;

[0041] The processor implements the method in any possible implementation method of the first aspect when executing the computer program instructions.

[0042] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores computer program instructions, and the computer program instructions are executed by a processor to implement the method in any possible implementation method of the first aspect.

[0043] In a fifth aspect, a computer program product is provided, and instructions in the computer program product are executed by a processor of an electronic device to enable the electronic device to perform the method in any possible implementation method of the first aspect.

[0044] The method, device, equipment, computer readable storage medium and computer program product for determining a resource allocation strategy provided in the embodiments of the present application can obtain a processing success rate function corresponding to N alarms and a processing capacity corresponding to each of M security resources, construct a resource allocation model by taking the processing success rate function as an objective function and taking the number of alarms processed by the security resources at the same time as not greater than the processing capacity as a constraint condition, and then solve the maximization problem of the resource allocation model by using an optimization algorithm, so as to determine the optimal solution as the allocation strategy of the M security resources, thereby enabling dynamic configuration of the security resources. Since the optimal matching between the alarms and the security resources is performed after receiving the alarms each time, even in the case of changes in the security resources and / or a sharp increase in the number of alarms, the timeliness of alarm processing and the rationality of resource utilization can be ensured, thereby improving the utilization rate of the security resources and the efficiency of alarm processing and improving the reliability of SOAR. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required to be used in the embodiments of the present application will be briefly introduced. Those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0046] Figure 1 is a whole structure schematic diagram of a resource allocation algorithm based on a security orchestration engine provided by the embodiments of the present application;

[0047] Figure 2 is a structure schematic diagram of a resource allocation engine provided by the embodiments of the present application;

[0048] Figure 3 is a flow schematic diagram of a method for determining a resource allocation strategy provided by the embodiments of the present application;

[0049] Figure 4 is a structure schematic diagram of a device for determining a resource allocation strategy provided by the embodiments of the present application;

[0050] Figure 5 is a structure schematic diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0051] The features and exemplary embodiments of the various aspects of the present application will be described in detail below with reference to the drawings. The following detailed description is merely intended to explain the present application, and is not intended to limit the present application. The present application can be implemented without some of the specific details, which are described below. The following description of the embodiments is merely provided to give a better understanding of the present application by showing examples of the present application.

[0052] It should be noted that the relational terms herein, such as first and second, and the like, are used solely to distinguish one from another entity or action, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element preceded by "comprises... " does not exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the stated elements.

[0053] As described in the background section, at present, the response mode and response device of SOAR are fixed in the process, and the availability of security resources, load balancing, response time, and the like are less considered. Specifically, in the planning process definition stage, the security operation personnel need to first confirm whether the security device is available, and have a deep understanding of the security device function, device interface, and the like; the premise for smooth execution of the process is that the device is online and available, and the security operation personnel need to monitor whether the alarm device is available.

[0054] The main problems are as follows:

[0055] 1) The security device configuration lacks flexibility. New security devices are online, and old devices are offline, which need to be manually configured in the process (script). On the one hand, the security operation personnel need to understand the functions and interfaces of the historical script and new and old devices, and the attention of the security operation personnel is generally focused on the formulation of security rules, and the understanding of the alarm device needs to spend extra time. On the other hand, manual configuration requires changes to the script, which is easy to be wrong and cause problems in the operation of the script and the processing of alarms in a timely manner.

[0056] 2) The surge request cannot be dynamically allocated. In the case of a small amount of alarm to be processed, the fixed security device calling scheme can be well coped with, but in the case of a surge of security processing requests, the alarm processing will become a bottleneck. Because of the designated security processing device, the surge of security requests may be concentrated on a certain security device, causing poor real-time performance, and even device downtime. For example, in the scenario of a ddos attack, the request to block the source ip surges, and because the alarm device calling scheme is fixed in the script, these requests are concentrated on a specific processing device, which will cause a serious decline in the timeliness of processing, and even crash.

[0057] Therefore, in order to solve the problems in the prior art, the embodiments of the present application provide a method, device, equipment, computer readable storage medium and computer program product for determining a resource allocation strategy. The method for determining a resource allocation strategy can be implemented based on a resource allocation engine. The resource allocation engine can be arranged in a security orchestration engine.

[0058] The overall structure diagram of the resource allocation algorithm based on the security orchestration engine can be as shown in Figure 1 From Figure 1 It can be known that, compared with the prior art, the embodiments of the present application add a resource allocation engine to manage security resources. When the process (script) executes to the "issue processing command" link, the prior art directly calls the security resources specified in the script to process the alarm. The scheme in the embodiments of the present application adds a "resource allocation engine" to manage the security resources, so as to realize automatic allocation of the security resources.

[0059] In addition, the structure diagram of the resource allocation engine can be as shown in Figure 2 The explanation of each module in Figure 2 is as follows.

[0060] Resource set: The resource set is a set of security resources, which is a combination of various security devices (blocking devices, cleaning devices, etc.). The security resources have the following attributes: maximum connection number (processing capacity), alarm processing type, processing speed, processing parameters, etc.

[0061] Resource management module: managing the resource set and pushing the resource state to the resource adapter. The following functions are included: (1) resource registration, managing the addition or deletion of alarm devices, managing the interface changes of alarm devices, etc.; (2) survival check, periodically checking the state of each security device (whether online, whether the maximum capacity has been reached, etc.), confirming whether the device is available; (3) state management, updating the security device state according to the survival check; (4) pushing the security device state to the resource adapter.

[0062] An alarm management module: collects alarm information to be processed, including alarm type, processing measures, processing requirements, etc., and pushes the collected alarm information to a resource adapter.

[0063] A resource adapter: processes information pushed by the resource management module and the alarm management module, and matches a subset of resources for the alarm according to alarm processing requirements (processing measures to be taken, timeliness of processing, etc.).

[0064] A resource scheduler: according to the matching result pushed by the resource adapter, the alarm is allocated to a specific alarm device according to a certain safe resource allocation algorithm.

[0065] The following describes a method for determining a resource allocation strategy provided by an embodiment of the present application.

[0066] Figure 3 A flowchart of a method for determining a resource allocation strategy provided by an embodiment of the present application is shown. As shown in Figure 3 The method for determining a resource allocation strategy provided by the embodiment of the present application includes the following steps:

[0067] S310, in the case of receiving N alarms, determining M safety resources corresponding to the N alarms, the safety resources being used for processing the alarms, M and N being positive integers;

[0068] S320, obtaining a processing success rate function corresponding to the N alarms and a processing capacity corresponding to each of the M safety resources, the processing success rate function being used to determine the processing success rate of the M safety resources on the N alarms, and the processing capacity being the maximum number of alarms that can be simultaneously processed by the safety resource;

[0069] S330, constructing a resource allocation model with the processing success rate function as an objective function and with the number of alarms simultaneously processed by the safety resource being not greater than the processing capacity as a constraint condition;

[0070] S340, solving the maximization problem of the resource allocation model by using an optimization algorithm, and determining the optimal solution as the allocation strategy of the M safety resources.

[0071] The method for determining the resource allocation strategy of the embodiment of the application can obtain the processing success rate function corresponding to the N alarms and the processing capacity corresponding to each of the M security resources, take the processing success rate function as a target function, take the number of alarms processed by the security resources at the same time as a constraint condition, construct a resource allocation model, and then solve the maximization problem of the resource allocation model by using an optimization algorithm, and determine the optimal solution as the allocation strategy of the M security resources, so that the security resources can be dynamically configured. Since the optimization matching between the alarms and the security resources is performed after receiving the alarms each time, even in the case of security resource changes and / or a sharp increase in the number of alarms, the timeliness of alarm processing and the rationality of resource utilization can be ensured, and thus the utilization rate of the security resources and the alarm processing efficiency can be improved, and the reliability of the SOAR can be improved.

[0072] The specific implementation of each of the above steps will be described below.

[0073] In some embodiments, in S310, the security resources can be used to process the alarms. The security resources can include security devices (i.e., alarm processing devices).

[0074] As an example, the alarm management module can receive the alarm information and push the alarm information to the resource adapter. After receiving the alarm information, the resource adapter can first determine N alarms in the alarm information, and then determine M security resources corresponding to the N alarms in the security resource set. The relationship between the alarms and the security resources can be one-to-one, one-to-many, many-to-one, or many-to-many, which is not limited herein. That is, one alarm can be processed by one security resource, or can be processed by multiple security resources. One security resource can process one alarm, or can process multiple alarms.

[0075] Based on this, in order to determine the accuracy of the security resources, in some embodiments, S310 can specifically include:

[0076] In the case of receiving the alarm information, determining N alarms in the alarm information and state information and attribute information corresponding to each of the multiple security resources in the security resource set;

[0077] For each security resource, matching the alarm information and the attribute information based on the state information;

[0078] Determining the security resources corresponding to the M attribute information matched with the alarm information as the M security resources corresponding to the N alarms.

[0079] Here, the security resource set can include a plurality of security resources, and each of the plurality of security resources corresponds to attribute information. The attribute information can include static information such as a maximum number of connections (processing capacity) of the security resource, an alarm type handled by the security resource, a processing speed, and a processing parameter. The maximum number of connections (processing capacity) of the security resource can be the maximum number of alarms that can be simultaneously processed by the security resource. In addition, the alarm information can further include an alarm type, a processing measure, a processing requirement, and the like corresponding to each of the N alarms. In addition, the state information can be dynamic information determined by the resource management module, such as whether the security resource is online or whether the maximum number of connections has been reached.

[0080] As an example, the resource management module can manage the state of each of the plurality of security resources in the security resource set, determine the state information, and push the state information of the security resource set to the resource adapter. The resource adapter can determine the state of each of the plurality of security resources in the security resource set according to the state information. In the case where the state is an available state, the alarm information and the attribute information are matched. The matching of the alarm information and the attribute information can be that the security resource corresponding to the attribute information can process one of the alarms in the alarm information.

[0081] In this way, by matching the alarm information and the attribute information based on the state information for each security resource, that is, by considering not only the static attribute information of the security resource but also the dynamic state information of the security resource when determining the M security resources corresponding to the N alarms, it can be ensured that the M security resources are all available and can process the alarm information, and the accuracy of determining the security resource is improved.

[0082] In some embodiments, in S320, if the number of alarms b corresponding to a security resource is less than or equal to the processing capacity c of the security resource, the security resource can simultaneously process the b alarms. If the number of alarms b corresponding to the security resource is greater than the processing capacity c of the security resource, the security resource can process the first c alarms in the order of arrival of the b alarms.

[0083] In addition, the processing result of the security resource for the alarm can be a processing success or a processing failure. After determining the processing result of each alarm, the processing success rate of the M security resources for the N alarms can be determined. Before the security resource actually processes the alarm, the processing result of the security resource for the alarm can be uncertain, and therefore the processing success rate corresponding to the N alarms can be uncertain. Therefore, in order to determine the processing success rate of the M security resources for the N alarms, the processing success rate function can be obtained first, and then the processing success rate function can be solved.

[0084] Based on this, in some embodiments, the above-mentioned obtaining of the processing success rate function corresponding to the N alarms can specifically include:

[0085] obtain a processing result function corresponding to the alarm, the processing result function being used to determine a processing result of the alarm by the safety resource;

[0086] construct a processing success rate function based on the processing result function and N.

[0087] Here, if N alarms are coded as an alarm set N={1,2,...,n,...,N}, and the processing result function is denoted as A(n), then the processing success rate function η(n) can be represented by the following formula (1):

[0088]

[0089] In actual situations, in order to ensure the safety of the system, the timeliness of alarm processing is usually required. That is, the processing of the alarm by the safety resource should be completed within a specified time. Therefore, if the actual processing time of the alarm by the safety resource is greater than the processing time threshold corresponding to the alarm, it can be determined that the processing result of the alarm is processing failure. If the actual processing time of the alarm by the safety resource is less than or equal to the processing time threshold corresponding to the alarm, it can be determined that the processing result of the alarm is processing success.

[0090] Based on this, for alarm n, n∈N, if the actual processing time of the alarm n by the safety resource is denoted as t n , and the processing time threshold corresponding to the alarm n is denoted as , then the processing result function A(n) can be represented by the following formula (2):

[0091]

[0092] In formula (2), if the function value is 0, it can be determined that the processing result is processing failure, and if the function value is 1, it can be determined that the processing result is processing success.

[0093] Based on this, the processing success rate function η(n) can also be represented by the following formula (3):

[0094]

[0095] In addition, the safety resource can process the alarms according to the arrival order of the alarms. That is, if the alarm has arrived at the safety resource, but the safety resource is processing other alarms and cannot process the alarm, the alarm can wait until the previous alarm is processed.

[0096] Based on this, in order to improve the accuracy of the processing result function, in some embodiments, the above-mentioned obtaining a processing result function corresponding to the alarm can specifically include:

[0097] obtain a sojourn time function corresponding to the alarm and a sojourn time threshold, the sojourn time function being used to determine a sojourn time of the alarm in the security resource;

[0098] construct a processing result function based on the sojourn time function and the sojourn time threshold.

[0099] Here, the sojourn time can include a waiting processing time and a processing time. Therefore, by constructing the processing result function based on the sojourn time function and the sojourn time threshold, the accuracy of the processing result function can be improved.

[0100] Based on this, in some embodiments, the above-mentioned obtaining the sojourn time function corresponding to the alarm can specifically include:

[0101] In the case that the processing manner of the security resource to the alarm is first-come-first-processed, and the arrival of the alarm to the security resource obeys a negative exponential distribution, obtaining an average processing rate of the security resource, an average arrival rate of the alarm, and a processing capacity;

[0102] Based on an M / M / S queue model, constructing an average sojourn time function corresponding to the security resource according to the average processing rate, the average arrival rate of the alarm, and the processing capacity;

[0103] Determining the average sojourn time function corresponding to the security resource as the sojourn time function of the alarm corresponding to the security resource.

[0104] Here, the M security resource encodings can be denoted as M={1, 2,..., m,..., M}. In the case that the alarm n is assigned to the security resource m, assuming that each alarm is parallel, the processing manner of the security resource m to the alarm adopts a first-come-first-processed manner, and the average processing rate of the security resource is μ m , the average arrival rate of the alarm is λ m , the processing capacity (maximum connection number) of the security resource is , and the arrival of the alarm obeys a negative exponential distribution, then based on the M / M / S queue model, the average sojourn time function T m of the alarm in the security resource m can be represented by the following formula (4):

[0105]

[0106] In the formula (4),

[0107] In some embodiments, if the alarm n needs to be connected to multiple security resources for simultaneous processing, the time required for processing the alarm n can be represented by If c n,m represents the association between the alarm n and the security resource m, then in the case that the alarm n is assigned to the security resource m, cn,m = 1, otherwise c n,m = 0. Based on this, the residence time of the alarm n in the security resource m can be expressed as: T n,m = c n,m T m , and then there can be

[0108] Based on this, the processing success rate function can also be expressed by the following formula (5):

[0109]

[0110] In some embodiments, in S330, the constraint condition can be expressed by the following formula (6):

[0111]

[0112] Based on this, the resource allocation model can be expressed by the following formula (7):

[0113]

[0114] In some embodiments, in S340, the optimization algorithm can include a simulated annealing algorithm, a genetic algorithm, an ant colony algorithm, etc. Since the genetic algorithm generally uses a fitness function to measure the pros and cons of each scheme, in the case where the optimization algorithm is a genetic algorithm, the objective function can be determined as the fitness function. Specifically, the fitness function can be expressed by the following formula (8):

[0115]

[0116] Based on this, the resource allocation model can also be expressed by the following formula (9):

[0117]

[0118] Since the fitness function value can change with the resource allocation strategy, solving the maximization problem of the fitness function under the constraint condition by the genetic algorithm can determine the optimal resource allocation strategy.

[0119] Based on this, in some embodiments, the above S340 can specifically include:

[0120] Randomly generate a first population, the first population including a plurality of individuals, each individual corresponding to a resource allocation strategy;

[0121] Substitute the plurality of individuals in the first population into the fitness function to calculate a plurality of first fitness values;

[0122] Determine the first individual corresponding to each of the top a% of the first fitness values with the largest value among the plurality of first fitness values;

[0123] By performing crossover and mutation on the first population, a second population is obtained;

[0124] Substitute multiple individuals from the second population into the fitness function to calculate multiple second fitness values;

[0125] Among multiple second fitness values, determine the second individual corresponding to each of the first a% of the smallest second fitness values;

[0126] Replace a% of the second individuals in the second population with a% of the first individuals to obtain the third population;

[0127] The third population is used as the first population, and the process is repeated to substitute multiple individuals from the first population into the fitness function until the number of iterations reaches the preset iteration threshold, thus obtaining the target population.

[0128] The strategy is to determine the individual with the highest fitness value in the target population as one of the M safe resources.

[0129] Here, the specific solution steps can be as follows:

[0130] Step 1: Encoding and Population Initialization. Security resources are encoded using a decimal system. There are M security devices, corresponding to codes 1 to M. Let the population size be s, then the population P = [P1, P2, ..., P...]. s ] T P k =[p k,1 ,p k,2 ,...,p k,N ], 1≤k≤s,p k,n ∈[0,M]. Where, p k,n =m indicates that alarm n is assigned to security resource m, corresponding to c n,m =1,c n,m' =0, m≠m'. p k,n =0 can indicate that alarm n has not been assigned to any security resource, corresponding to Additionally, set the maximum number of iterations i. max Let i = 0, and randomly generate a population P(i). Each individual in the population represents one possible allocation scheme, and the mutation probability and crossover probability of the population are assigned p. mu and p cr .

[0131] Step 2: Calculate the fitness value of each individual in the population using the fitness function, and sort the fitness values ​​of multiple individuals in descending order. Select the individuals with fitness values ​​in the top a% as elite individuals. The set of elite individuals is E(i).

[0132] Step 3, the population P(i) is crossed according to the following formula (10) and formula (11):

[0133]

[0134]

[0135] In formula (10) and formula (11), rand(*) is a random number generated in [0, 1]; cp is a crossover position, which is a random integer in [1, N].

[0136] Step 4, the population P(i) is mutated according to the following formula (12):

[0137]

[0138] In formula (12), rand(*) is a random number generated in [0, 1]; mp is a mutation position, which is a random integer in [1, N]; the mutation result is b, and b≠p k,mu .

[0139] Step 5, the population after crossing and mutation is Q(i), the fitness value of Q(i) is calculated and sorted in descending order of fitness value, the individuals in the last a% of P(i) are replaced by E(i) to form a new population Q'.

[0140] Step 6, let i=i+1, P(i)=Q', if i≤i max , return to step 2; otherwise, select the individual with the maximum fitness value from P(i), determine the resource allocation strategy corresponding to the individual with the maximum fitness value as the allocation strategy corresponding to the M safe resources, and the algorithm ends.

[0141] Based on the resource allocation strategy determination method provided in the above embodiment, the application also provides a specific implementation of a resource allocation strategy determination device. Please refer to the following embodiments.

[0142] As shown in Figure 4 , the resource allocation strategy determination device 400 provided by the embodiment of the application includes the following modules:

[0143] The first determination module 410 is configured to determine M safe resources corresponding to N alarms when receiving the N alarms, the safe resources being used for processing the alarms, M and N being positive integers;

[0144] The acquisition module 420 is configured to acquire a processing success rate function corresponding to the N alarms and processing capacities of the M security resources respectively, the processing success rate function being used to determine a processing success rate of the M security resources to the N alarms, and the processing capacity being a maximum number of alarms that can be processed by the security resource at the same time;

[0145] The construction module 430 is configured to construct a resource allocation model with the processing success rate function as a target function and with the number of alarms processed by the security resource at the same time being not greater than the processing capacity as a constraint condition.

[0146] The second determination module 440 is configured to solve a maximization problem of the resource allocation model by using an optimization algorithm, and determine an optimal solution as the allocation strategy of the M security resources.

[0147] The following describes the determination apparatus 400 of the resource allocation strategy in detail as follows.

[0148] In some embodiments, the acquisition module 420 can specifically include:

[0149] The acquisition submodule is configured to acquire a processing result function corresponding to the alarm, the processing result function being used to determine a processing result of the security resource to the alarm.

[0150] The construction submodule is configured to construct the processing success rate function based on the processing result function and N.

[0151] In some embodiments, the acquisition submodule can specifically include:

[0152] The acquisition unit is configured to acquire a sojourn time function corresponding to the alarm and a sojourn time threshold, the sojourn time function being used to determine a sojourn time of the alarm in the security resource.

[0153] The construction unit is configured to construct the processing result function based on the sojourn time function and the sojourn time threshold.

[0154] In some embodiments, the acquisition unit can specifically include:

[0155] The acquisition subunit is configured to acquire an average processing rate of the security resource, an average arrival rate of the alarm, and the processing capacity in a case where a processing manner of the security resource to the alarm is first-come-first-processed and the arrival of the alarm to the security resource obeys a negative exponential distribution.

[0156] The construction subunit is configured to construct an average sojourn time function corresponding to the security resource based on an M / M / S queue model and according to the average processing rate, the average arrival rate of the alarm, and the processing capacity.

[0157] The determination subunit is configured to determine the average sojourn time function corresponding to the security resource as the sojourn time function of the alarm corresponding to the security resource.

[0158] In some embodiments, the objective function is a fitness function, and the optimization algorithm is a genetic algorithm.

[0159] In some embodiments, the second determining module 440 can specifically include:

[0160] A generating sub-module, configured to randomly generate a first population, the first population including a plurality of individuals, each individual corresponding to a resource allocation strategy;

[0161] A first calculating sub-module, configured to substitute the plurality of individuals in the first population into the fitness function to calculate a plurality of first fitness values;

[0162] A first determining sub-module, configured to determine, in the plurality of first fitness values, a first individual corresponding to each of a first a% of first fitness values with the largest numerical value;

[0163] A processing sub-module, configured to perform crossover and mutation on the first population to obtain a second population;

[0164] A second calculating sub-module, configured to substitute the plurality of individuals in the second population into the fitness function to calculate a plurality of second fitness values;

[0165] A second determining sub-module, configured to determine, in the plurality of second fitness values, a second individual corresponding to each of a second a% of second fitness values with the smallest numerical value;

[0166] A replacing sub-module, configured to replace the second a% of individuals in the second population with the first a% of individuals to obtain a third population;

[0167] An executing sub-module, configured to take the third population as the first population, and return to substitute the plurality of individuals in the first population into the fitness function until the number of iterations reaches a preset iteration threshold to obtain a target population;

[0168] A third determining sub-module, configured to determine, as the allocation strategy of the M safe resources, an individual with the largest fitness value in the target population.

[0169] In some embodiments, the first determining module 410 can specifically include:

[0170] A fourth determining sub-module, configured to, in a case where the alarm information is received, determine N alarms in the alarm information, and state information and attribute information corresponding to each of a plurality of safe resources in the set of safe resources;

[0171] A matching sub-module, configured to, for each safe resource, match the alarm information and the attribute information based on the state information;

[0172] The fifth determining sub-module determines the M safety resources corresponding to the M attribute information matched with the alarm information as the M safety resources corresponding to the N alarms.

[0173] The resource allocation strategy determination apparatus provided in the embodiments of the present application can dynamically configure the safety resources. Since the optimal matching between the alarms and the safety resources is performed each time after receiving the alarms, even in the case that the safety resources change and / or the number of alarms increases rapidly, the timeliness of the alarm processing and the rationality of the resource utilization can be ensured, and thus the utilization rate of the safety resources and the alarm processing efficiency can be improved, and the reliability of the SOAR can be improved.

[0174] Based on the resource allocation strategy determination method provided in the above embodiments, the present application further provides a specific implementation of an electronic device. Figure 5 A schematic diagram of an electronic device 500 provided in the embodiments of the present application is shown.

[0175] The electronic device 500 can include a processor 510 and a memory 520 storing computer program instructions.

[0176] Specifically, the processor 510 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or can be configured as one or more integrated circuits implementing the embodiments of the present application.

[0177] The memory 520 can include a mass storage for data or instructions. By way of example and not limitation, the memory 520 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. The memory 520 can include removable or non-removable (or fixed) media, as appropriate. The memory 520 can be internal or external to the integrated gateway disaster recovery device, as appropriate. In a particular embodiment, the memory 520 is a non-volatile solid-state memory.

[0178] The memory can include read-only memory (ROM), random-access memory (RAM), magnetic disk storage mediums devices, optical storage mediums devices, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software that, when executed (e.g., by one or more processors), is operable to perform the operations described with reference to the method according to the first aspect of the present application.

[0179] The processor 510 implements the determination method of any one of the resource allocation strategies in the above embodiments by reading and executing the computer program instructions stored in the memory 520.

[0180] In one example, the electronic device 500 can further include a communication interface 530 and a bus 540. Wherein, as shown in the figure, the processor 510, the memory 520, the communication interface 530 are connected through the bus 540 and complete the communication between each other. Figure 5

[0181] The communication interface 530 is mainly used to realize the communication between each module, device, unit and / or equipment in the embodiments of the present application.

[0182] The bus 540 includes hardware, software or both to couple the components of the electronic device to each other. By way of example, and not limitation, the bus can include an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front-side bus (FSB), a HyperTransport (HT) interconnect, an industry standard architecture (ISA) bus, an infiniband interconnect, a low pin count (LPC) bus, a memory bus, a microchannel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (SATA) bus, a video electronics standards association local (VLB) bus, or another suitable bus or combination of two or more of these. Where appropriate, the bus 540 can include one or more buses. Although the present embodiments describe and show a particular bus, the present application contemplates any suitable bus or interconnect.

[0183] For example, the electronic device 500 can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc.

[0184] ​The electronic device can perform the method for determining the resource allocation strategy in the embodiments of the present application, thereby realizing the method and apparatus for determining the resource allocation strategy described in combination Figure 3 and Figure 4 with the method for determining the resource allocation strategy in the embodiments described above.

[0185] In addition, in combination with the method for determining the resource allocation strategy in the embodiments described above, the embodiments of the present application can provide a computer readable storage medium to realize. The computer readable storage medium has computer program instructions stored thereon; the computer program instructions are executed by a processor to realize any one of the methods for determining the resource allocation strategy in the embodiments described above.

[0186] It needs to be made clear that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted here. In the embodiments described above, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0187] The functional blocks shown in the structural block diagrams described above can be realized as hardware, software, firmware or a combination thereof. When realized in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When realized in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted on a transmission medium or communication link through a data signal carried in a carrier wave. The "machine readable medium" can include any medium capable of storing or transmitting information. Examples of the machine readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segments can be downloaded via a computer network such as the Internet, an intranet, etc.

[0188] It also needs to be made clear that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or apparatuses. However, the present application is not limited to the order of the steps described above, that is, the steps can be executed in the order mentioned in the embodiments, or in an order different from the embodiments, or several steps can be executed simultaneously.

[0189] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0190] The above description is only specific implementation of the present application. For the convenience and brevity of description, the specific working process of the above-described system, module and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described herein. It should be understood that the protection scope of the present application is not limited in this way. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A method for determining a resource allocation strategy, characterized in that, The method comprises the following steps: In the case of receiving N alarms, M safety resources corresponding to the N alarms are determined, the safety resources being used for processing the alarms, M and N being positive integers; A processing success rate function corresponding to the N alarms and a processing capacity of each of the M safety resources are obtained, the processing success rate function being used for determining a processing success rate of the M safety resources on the N alarms, and the processing capacity being a maximum number of alarms that can be simultaneously processed by the safety resource; A resource allocation model is constructed with the processing success rate function as an objective function and the number of alarms simultaneously processed by the safety resource being not greater than the processing capacity as a constraint condition; An optimization algorithm is used to solve a maximization problem of the resource allocation model, and an optimal solution is determined as an allocation strategy of the M safety resources.

2. The method of claim 1, wherein, The processing success rate function corresponding to the N alarms is obtained by: Obtaining a processing result function corresponding to the alarms, the processing result function being used for determining a processing result of the safety resource on the alarms; The processing success rate function is constructed based on the processing result function and N.

3. The method of claim 2, wherein, The processing result function corresponding to the alarms is obtained by: Obtaining a sojourn time function corresponding to the alarms and a sojourn time threshold, the sojourn time function being used for determining a sojourn time of the alarms in the safety resource; The processing result function is constructed based on the sojourn time function and the sojourn time threshold.

4. The method of claim 3, wherein, The sojourn time function corresponding to the alarms is obtained by: In the case that a processing manner of the safety resource on the alarms is first-come-first-processed, and the arrival of the alarms at the safety resource obeys a negative exponential distribution, an average processing rate of the safety resource, an average arrival rate of the alarms and a processing capacity are obtained; Based on an M / M / S queue model, an average sojourn time function corresponding to the safety resource is constructed according to the average processing rate, the average arrival rate of the alarms and the processing capacity; The average sojourn time function corresponding to the safety resource is determined as the sojourn time function corresponding to the safety resource on the alarms.

5. The method of claim 1, wherein, The objective function is a fitness function, and the optimization algorithm is a genetic algorithm.

6. The method of claim 5, wherein, The optimization algorithm is used to solve the maximization problem of the resource allocation model, and the optimal solution is determined as the allocation strategy of the M safety resources, comprising: A first population is randomly generated, the first population comprising a plurality of individuals, each individual corresponding to a resource allocation strategy; The plurality of individuals in the first population are substituted into the fitness function, and a plurality of first fitness values are calculated; The first individuals corresponding to the first a% of the first fitness values with the largest values in the plurality of first fitness values are determined; The first population is crossed and mutated to obtain a second population; The plurality of individuals in the second population are substituted into the fitness function, and a plurality of second fitness values are calculated; The second individuals corresponding to the first a% of the second fitness values with the smallest values in the plurality of second fitness values are determined; The first a% of the second individuals in the second population are replaced by the first a% of the first individuals to obtain a third population; The third population is taken as the first population, and the step of substituting the multiple individuals in the first population into the fitness function is performed until the number of iterations reaches a preset iteration threshold, to obtain a target population; An individual with the largest fitness value in the target population is determined as the allocation strategy of the M safe resources.

7. The method of claim 1, wherein, The M safe resources corresponding to the N alarms are determined in a case where N alarms are received, and the M safe resources are used for processing the alarms. In a case where alarm information is received, N alarms in the alarm information and state information and attribute information corresponding to multiple safe resources in a safe resource set are determined; For each safe resource, the alarm information and the attribute information are matched based on the state information; Safe resources corresponding to M attribute information matched with the alarm information are determined as the M safe resources corresponding to the N alarms.

8. A device for determining a resource allocation strategy, characterized in that The apparatus comprises: A first determination module is configured to determine M safe resources corresponding to N alarms in a case where the N alarms are received, the safe resources being used for processing the alarms, M and N being positive integers; An acquisition module is configured to acquire a processing success rate function corresponding to the N alarms and processing capacities respectively corresponding to the M safe resources, the processing success rate function being used for determining processing success rates of the M safe resources on the N alarms, and the processing capacity being a maximum number of alarms that can be simultaneously processed by the safe resource; A construction module is configured to construct a resource allocation model by taking the processing success rate function as an objective function and taking the number of alarms simultaneously processed by the safe resource being not greater than the processing capacity as a constraint condition; A second determination module is configured to solve a maximization problem of the resource allocation model by using an optimization algorithm, and determine an optimal solution as an allocation strategy of the M safe resources.

9. An electronic device, comprising: The electronic device comprises a processor and a memory storing computer program instructions; The processor, when executing the computer program instructions, implements the method for determining the resource allocation strategy according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, and the computer program instructions, when executed by a processor, implement the method for determining the resource allocation strategy according to any one of claims 1-7.

Images