Executor scheduling method, device, electronic device and storage medium

Abstract

The present invention provides an executor scheduling method, device, electronic device, and storage medium, including: constructing a relational heterogeneous graph based on first nodes corresponding to each of multiple threat flows, second nodes corresponding to each of multiple executors, and a set of edge relationships; using a graph attention network to determine first eigenvectors of each of the multiple first nodes and second eigenvectors of each of the multiple second nodes in the relational heterogeneous graph; constructing a relational isomorphic graph based on inter-node similarities of the multiple first nodes; using a graph attention network to determine third eigenvectors of each of the multiple first nodes in the relational isomorphic graph; for each first node and each second node, determining the attack probability of the threat flow of the first node on the executor of the second node based on the first eigenvector, third eigenvector of the first node, and second eigenvector of the second node; and determining a scheduling measure for the executor of the second node based on the attack probability. This effectively reduces resource loss caused by frequent scheduling.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an execution body scheduling method, device, electronic device and storage medium. Background Art

[0002] Existing executor scheduling methods for mimetic defense systems often start from the dynamic, redundancy, heterogeneity and other characteristics of mimetic defense systems, and combine negative feedback characteristics to achieve high robustness and security of mimetic defense systems, reduce the probability of common vulnerabilities and backdoors in the system, and thus increase the difficulty and cost of attackers' intrusion. However, as the number of heterogeneous executors increases, the mimetic defense system will become more complex. In addition, current executor scheduling methods are mostly based on the executor's own heterogeneity and confidence attributes for selection and scheduling. The entire scheduling process is relatively frequent and prone to resource loss. Summary of the Invention

[0003] The present invention provides an executor scheduling method, device, electronic device and storage medium to address the defect that the executor scheduling method of the existing mimetic defense system is prone to resource loss. It realizes the combined construction of a relational heterogeneous graph and a relational isomorphic graph, and uses a graph attention network to predict the probability of threat traffic in the current network breaking through the current working executor, so as to discover in advance the executors with a high probability of being broken through, and thus schedule and replace the corresponding executors in advance, thereby improving the defense capability of the mimetic defense against attacks and reducing the resource loss caused by frequent scheduling.

[0004] The present invention provides an execution body scheduling method, which includes the following steps.

[0005] A relational heterogeneous graph is constructed based on the first nodes corresponding to each of the plurality of threat flows, the second nodes corresponding to each of the plurality of execution bodies, and the set of edge relationships corresponding to the plurality of threat flows and the plurality of execution bodies; and a graph attention network is used to determine the first eigenvectors corresponding to each of the plurality of first nodes and the second eigenvectors corresponding to each of the plurality of second nodes in the relational heterogeneous graph.

[0006] A relational isomorphism graph is constructed based on the multiple first nodes and the node similarities between the multiple first nodes; and the graph attention network is used to determine the third eigenvectors corresponding to each of the multiple first nodes in the relational isomorphism graph.

[0007] For each first node among the multiple first nodes and each second node among the multiple second nodes, determine the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first feature vector and the third feature vector corresponding to the first node and the second feature vector corresponding to the second node; and determine the scheduling measures for the execution body corresponding to the second node based on the attack probability.

[0008] The present invention also provides an execution body scheduling device, which includes the following modules.

[0009] The data processing module is used to construct a relational heterogeneous graph based on the first nodes corresponding to each of the plurality of threat flows, the second nodes corresponding to each of the plurality of execution bodies, and the set of edge relationships corresponding to the plurality of threat flows and the plurality of execution bodies; and use a graph attention network to determine the first eigenvectors corresponding to each of the plurality of first nodes in the relational heterogeneous graph, and the second eigenvectors corresponding to each of the plurality of second nodes; construct a relational isomorphic graph based on the node similarity between the plurality of first nodes and the plurality of first nodes; and use the graph attention network to determine the third eigenvectors corresponding to each of the plurality of first nodes in the relational isomorphic graph.

[0010] A scheme determination module is used to determine, for each first node among the multiple first nodes and each second node among the multiple second nodes, the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first eigenvector and the third eigenvector corresponding to the first node and the second eigenvector corresponding to the second node; and determine the scheduling measures for the execution body corresponding to the second node based on the attack probability.

[0011] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-described execution body scheduling methods is implemented.

[0012] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the above-mentioned execution body scheduling methods when executed by a processor.

[0013] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned execution body scheduling methods.

[0014] The present invention provides an execution body scheduling method, device, electronic device and storage medium. This method combines the constructed relationship heterogeneous graph and relationship isomorphic graph, uses a graph attention network to predict the probability of threat traffic in the current network breaking through the current working execution body, and discovers the execution body with a high probability of being broken in advance, so as to schedule and replace the corresponding execution body in advance, thereby improving the defense capability of mimetic defense against attacks and reducing the resource loss caused by frequent scheduling. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 This is one of the flow charts of the execution body scheduling method provided by the present invention.

[0017] Figure 2 It is a schematic diagram of the relational heterogeneous graph provided by the present invention.

[0018] Figure 3 It is a schematic diagram of the relational isomorphism graph provided by the present invention.

[0019] Figure 4 This is the second flow chart of the execution body scheduling method provided by the present invention.

[0020] Figure 5 It is a structural diagram of the execution body scheduling device provided by the present invention.

[0021] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0023] In order to better understand the embodiments of the present invention, the background technology is first described in detail.

[0024] With the rapid development of industrial digitization, intelligence, and informatization, industrial control systems (ICSs) and information technology (IT) systems are becoming increasingly integrated. In particular, with the advancement of cloud computing and edge computing, IC systems are undergoing a digital transformation, gradually forming a cloud-edge collaborative technical architecture. However, while cloud-edge collaborative IC systems enable data, knowledge, and resource sharing, their security boundaries are becoming increasingly blurred. Due to a lack of security protection measures, IC systems are vulnerable to cyberattacks. First, the flat hybrid connectivity and ubiquitous access of cloud-edge devices increase attack surface exposure; the hybrid public and private network connectivity and blurred security boundaries lead to random and volatile attack paths; and the covert transmission across cyber-physical domains and unclear attack signatures make accurate attack identification and proactive mitigation extremely difficult. Second, in the context of cloud-edge collaboration, the increasing demand for process updates, continuous iterative configuration development of IC programs, and dynamic evolution of IC logic makes traditional passive defense measures such as firewalls and patching inadequate. To address these issues, innovative and integrated new active defense technologies are needed to protect against unknown vulnerabilities and attacks in the network.

[0025] Cyberspace Mimic Defense (CMD) technology is a novel active defense concept that relies less on prior information such as attack code and attack behavior characteristics. Instead, it constructs an uncertain operating environment based on dynamic, redundant, and heterogeneous techniques. This approach alters the static, deterministic, and similar nature of industrial control systems, disrupting the triggering mechanisms of vulnerability backdoors and making it impossible for attackers to determine the success or effectiveness of their attacks, thereby increasing the difficulty and cost of attacks. Compared to most traditional network defense technologies, CMD technology can address security threats without requiring knowledge of vulnerabilities or risks, nor does it require understanding the attacker's goals, characteristics, mechanisms, and methods. As the core technology of cyberspace mimic defense, employing appropriate defense methods to schedule mimic defense executors can further enhance the mimic defense system's defense capabilities against unknown vulnerabilities and attacks. Therefore, scheduling executors in mimic defense systems has been a key research focus.

[0026] Existing executor scheduling methods for mimetic defense systems often start from the dynamic, redundancy, heterogeneity and other characteristics of mimetic defense systems, and combine negative feedback characteristics to achieve high robustness and security of mimetic defense systems, reduce the probability of common vulnerabilities and backdoors in the system, and thus increase the difficulty and cost of attackers' intrusion. However, as the number of heterogeneous executors increases, the mimetic defense system will become more complex. In addition, current executor scheduling methods are mostly based on the executor's own heterogeneity and confidence attributes for selection and scheduling. The entire scheduling process lacks the ability to perceive the current network environment, cannot cope with the changing network environment, and cannot dynamically schedule executors according to changes in the network environment, resulting in resource loss.

[0027] In order to solve the above technical problems, an embodiment of the present invention provides an executor scheduling method. This method combines the constructed relationship heterogeneous graph and relationship isomorphic graph, and uses a graph attention network to predict the probability of threat traffic in the current network breaking through the current working executor, so as to discover the executors with a high probability of being broken in advance, and thus schedule and replace the corresponding executors in advance, thereby improving the defense capability of mimicry defense against attacks and reducing the resource loss caused by frequent scheduling.

[0028] The following is a detailed description of the execution body scheduling method provided by the embodiment of the present invention.

[0029] Figure 1 It is a flowchart of the execution body scheduling method provided by the present invention, such as Figure 1 As shown, the method includes the following: step 101 to step 103.

[0030] Step 101: Construct a relational heterogeneous graph based on the first nodes corresponding to each of the plurality of threat flows, the second nodes corresponding to each of the plurality of execution bodies, and the set of edge relationships corresponding to the plurality of threat flows and the plurality of execution bodies; and use a graph attention network to determine the first eigenvectors corresponding to each of the plurality of first nodes and the second eigenvectors corresponding to each of the plurality of second nodes in the relational heterogeneous graph.

[0031] Threat traffic usually refers to malicious traffic attacks against a network or system, which aims to exhaust bandwidth, system resources, or cause service unavailability. The number of threat traffic is p, where p is an integer greater than 1. In this case, the first nodes corresponding to each of the p threat traffics can constitute a first node set. The first node set can be represented by T={t1,t2,…,t α ,…,t p} indicates that, where t α It represents the αth threat traffic and the corresponding first statistical feature. Optionally, the first statistical feature may include: traffic size, traffic rate, traffic source and traffic distribution, etc.

[0032] The executor refers to various computing systems that perform specific tasks. In the mimic defense architecture, the executor is responsible for performing actual operations and computing tasks. Optionally, the executor may include: computers, servers, or network devices. The number of executors is q, where q is an integer greater than 1. In this case, the second nodes corresponding to each of the q executors can constitute a second node set. The second node set can be represented by E={e1,e2,…,e β ,…,e q} means, where e β It represents the βth execution body and the corresponding second statistical feature. Optionally, the second statistical feature may include: activity, communication feature, resource occupancy feature, etc.

[0033] An edge relationship set can include multiple edge relationships, each representing the attack relationship between a corresponding threat traffic flow and a corresponding executable. It should be noted that each edge relationship is established when the corresponding threat traffic flow is capable of breaching the corresponding executable. The fact that the threat traffic flow is capable of breaching the executable is determined by the record of the threat traffic breaching the executable.

[0034] A relational heterogeneous graph (abbreviated as: heterogeneous graph) refers to a graph structure with more than one node type or edge type in the graph. It is mainly used to model multiple types of objects (i.e., threat traffic and execution bodies) and the complex association relationships between these multiple objects (i.e., the attack relationship between threat traffic and execution bodies). Specifically, this relational heterogeneous graph can be used in G te =(V te ,E te ) represents, where V te represents a plurality of first nodes and a plurality of second nodes; E te Indicates the attack relationship between threat traffic and execution entities.

[0035] The graph attention network includes multiple network layers and is a deep learning method based on graph neural networks. It introduces an attention mechanism to process node data with complex relationships (such as the multiple first nodes and the multiple second nodes mentioned above). It can adaptively learn node features in heterogeneous graphs to achieve more accurate probability predictions. The above node features contain rich threat traffic feature information (i.e., the first feature vector) and execution body feature information (i.e., the second feature vector).

[0036] After determining multiple threat flows and multiple execution bodies, the electronic device can generate a first node corresponding to each of the multiple threat flows and a second node corresponding to each of the multiple execution bodies; then determine the attack relationship between all first nodes and all second nodes to construct a set of edge relationships; then, the electronic device constructs a relationship heterogeneous graph based on all first nodes, all second nodes and the set of edge relationships; since the advantage of the graph attention network in prediction tasks is that it can adaptively focus on the relationship between different nodes in the relationship heterogeneous graph and effectively capture the complex dependency relationship between nodes, the electronic device can use the graph attention network to extract features from all first nodes to obtain their corresponding first feature vectors, and extract features from all second nodes to obtain their corresponding second feature vectors, providing data support for subsequent probability prediction. In addition, the accuracy of all first feature vectors and all second feature vectors is also relatively high.

[0037] For example, Figure 2 is a schematic diagram of the relationship heterogeneous graph provided by the present invention, such as Figure 2 As shown, there are four threat flows, corresponding to the first node p1, the first node p2, the first node p3 and the first node p4 respectively; there are five execution bodies, corresponding to the second node q1, the second node q2, the second node q3, the second node q4 and the second node q5 respectively; since the first node p1 has an attack relationship with the second node q1 and the second node q2, the first node p1 and the second node q1 correspond to one edge relationship, the first node p1 and the second node q2 correspond to one edge relationship, and so on, the first node p2 and the second node q2, the second node q3 and the second node q4 each correspond to an edge relationship, the first node p3 and the second node q4 and the second node q5 each correspond to an edge relationship, and the first node p4 and the second node q4 correspond to one edge relationship. Based on this, there are a total of eight edge relationships.

[0038] The electronic device can construct a heterogeneous relationship graph based on the first nodes corresponding to the four threat flows, the second nodes corresponding to the five execution bodies, and the edge relationship sets corresponding to the four threat flows and the five execution bodies.

[0039] Step 102: construct a relational isomorphism graph based on the multiple first nodes and the node similarities between the multiple first nodes; and use a graph attention network to determine the third eigenvectors corresponding to each of the multiple first nodes in the relational isomorphism graph.

[0040] Among them, the similarity between nodes refers to the similarity between the corresponding features of the nodes in structure, attributes or functions.

[0041] A relational isomorphic graph (abbreviated as isomorphic graph) refers to a graph structure with only one node type and one relationship type. It is mainly used to model a type of object (i.e., threat traffic) and the complex association relationship between such objects (i.e., similarity between nodes). Specifically, the relational isomorphic graph can be used to t =(V t ,E t ) represents, where V t Represents multiple first nodes; E t Indicates the similarity relationship between threat traffic.

[0042] It should be noted that the similarity between threat flows is used as the edge weight to measure the adjacency relationship between nodes, that is, as an edge relationship. The edge relationship in the relationship isomorphism graph is established when the similarity between the corresponding threat flows is greater than a preset similarity threshold. The preset similarity threshold can be set before the electronic device leaves the factory or can be customized, and is not specifically limited here.

[0043] After determining the first nodes corresponding to each of the multiple threat flows, the electronic device can determine the node similarity between all the first nodes to combine all the first nodes to construct a relational isomorphism graph; since the advantage of the graph attention network in prediction tasks is that it can adaptively focus on the relationship between nodes in the relational isomorphism graph and effectively capture the complex dependencies between nodes, the electronic device can use the graph attention network to extract features from all the first nodes and obtain the corresponding third eigenvectors to provide data support for subsequent probability predictions. In addition, the accuracy of all third eigenvectors is also relatively high.

[0044] For example, Figure 3 is a schematic diagram of the relational isomorphism graph provided by the present invention, such as Figure 3 As shown, there are six threat flows, corresponding to the first node p1, the first node p2, the first node p3, the first node p4, the first node p5 and the first node p6 respectively; since there is inter-node similarity between the first node p1 and the first node p3, the first node p1 and the first node p3 correspond to an edge relationship, and so on, the first node p3 and the first node p5 correspond to an edge relationship, and the first node p4 corresponds to an edge relationship with the first node p2, the first node p5 and the first node p6 respectively. Based on this, there are five edge relationships in total.

[0045] The electronic device can construct a relational isomorphism graph based on the first nodes corresponding to the six threat flows and the similarities between the nodes of the six threat flows.

[0046] Step 103: For each first node among the multiple first nodes and each second node among the multiple second nodes, determine the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first eigenvector and the third eigenvector corresponding to the first node and the second eigenvector corresponding to the second node; and determine the scheduling measures for the execution body corresponding to the second node based on the attack probability.

[0047] Among them, the attack probability refers to the probability that the attack behavior threatening traffic successfully breaks through the execution body.

[0048] For any first node among multiple first nodes and any second node among multiple second nodes, the electronic device can determine the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first eigenvector and the third eigenvector of the first node, and the second eigenvector of the second node, and then determine the scheduling measures of the execution body. Since the accuracy of the first eigenvector, the second eigenvector and the third eigenvector is relatively high, the attack probability and scheduling measures determined thereby are also relatively accurate.

[0049] Based on this, for a certain first node, the electronic device can obtain the same number of attack probabilities corresponding to the first node as the number of second nodes.

[0050] In an embodiment of the present invention, by combining the constructed relationship heterogeneous graph and relationship isomorphic graph, a graph attention network is used to predict the probability of threat traffic in the current network breaking through the current working execution body, and the execution body with a high probability of being broken through is discovered in advance, so as to schedule and replace the corresponding execution body in advance, thereby improving the defense capability of mimicry defense against attacks and reducing the resource loss caused by frequent scheduling.

[0051] In order to better understand the embodiments of the present invention, the execution body scheduling method is described in detail below.

[0052] Optionally, the electronic device constructs a relational heterogeneous graph based on the first node corresponding to each of the multiple threat flows, the second node corresponding to each of the multiple execution bodies, and the set of edge relationships corresponding to the multiple threat flows and the multiple execution bodies, which may include: the electronic device determines the multiple threat flows and the multiple execution bodies based on the record information of the given threat flow breaking through the execution body; the electronic device constructs the relational heterogeneous graph based on the first node corresponding to each of the multiple threat flows, the second node corresponding to each of the multiple execution bodies, and the set of edge relationships corresponding to the multiple threat flows and the multiple execution bodies.

[0053] The record information of a given threat traffic breaking through an execution body mainly refers to the detailed data recorded when the threat traffic successfully attacks one or more execution bodies in a network environment.

[0054] After obtaining the record information of a given threat flow breaking through an execution body, the electronic device can parse the record information to obtain the first statistical characteristics corresponding to each of the multiple threat flows, the second statistical characteristics corresponding to each of the multiple execution bodies, and the attack relationship between the multiple threat flows and the multiple execution bodies; then, based on all the first statistical characteristics, determine the first node corresponding to each of the multiple threat flows, and based on all the second statistical characteristics, determine the second node corresponding to each of the multiple execution bodies; finally, the electronic device constructs a heterogeneous graph of the relationship between the threat flow and the execution body based on the set of edge relationships corresponding to all the first nodes, all the second nodes, and all the attack relationships, providing strong decision support for the subsequent determination of scheduling measures for the execution body, thereby effectively improving network security.

[0055] It should be noted that when the network environment changes, that is, when multiple threat flows and / or multiple execution bodies change, the above-mentioned relationship heterogeneous graph can be updated according to the nodes corresponding to the changed data; or, when multiple threat flows change, the above-mentioned relationship isomorphic graph can be updated according to the changed first node.

[0056] In some embodiments, the electronic device uses a graph attention network to determine the first eigenvector corresponding to each of multiple first nodes in a relational heterogeneous graph, which may include: performing the following operations for each first node: the electronic device determines the first neighborhood node set corresponding to the first node in the relational heterogeneous graph; the electronic device determines multiple first attention scores of the first node in the current network layer based on the first node, the first neighborhood node set and multiple second nodes; the electronic device determines the first eigenvector of the first node in the current network layer based on the multiple first attention scores and the first node.

[0057] The first neighboring node set may include at least one first neighboring node, including the first node itself, and each first neighboring node is a first node having a direct edge relationship with the first node. The first neighboring node set may be represented by Nt.

[0058] The current network layer refers to the layer of network where node features are being calculated. l Network layer representation.

[0059] The first attention score is used to represent the contribution degree of the first neighborhood node set to the first node, that is, the degree of attention of the first node to the first neighborhood node set.

[0060] For a first node among multiple first nodes, the electronic device may first determine the first neighboring node set corresponding to the first node in the relational heterogeneous graph; then, based on the first node, the first neighboring node set, and a second node, the electronic device determines a first attention score for the first node in the current network layer. Based on this, the electronic device obtains as many first attention scores as there are second nodes, and then calculates in combination with the first node to obtain a first eigenvector of the first node in the current network layer. In other words, the above-mentioned first eigenvector is related to all first nodes adjacent to the first node.

[0061] For example, in combination with the above Figure 2 In the relationship heterogeneous graph shown, for the first node p1, the corresponding first neighboring nodes include the first node p2; for the first node p2, the corresponding first neighboring nodes include the first node p1, the first node p3 and the first node p4; for the first node p3, the corresponding first neighboring nodes include the first node p2; for the first node p4, the corresponding first neighboring nodes include the first node p2.

[0062] In some embodiments, the first neighborhood node set includes at least one first neighborhood node, and the electronic device determines multiple first attention scores of the first node in the current network layer based on the first node, the first neighborhood node set and multiple second nodes, which may include: for each second node, the electronic device uses a graph attention network to determine the first attention score of the first node in the current network layer based on the first attribute feature vector of the first node in the previous network layer, the second attribute feature vector corresponding to each of the at least one first neighborhood node in the previous network layer, and the third attribute feature vector of the second node in the previous network layer.

[0063] The previous network layer refers to the network layer before the current network layer. l -1 network layer representation. That is, the node features output by the previous network layer are the node features input by the current network layer.

[0064] The first attribute feature vector refers to the feature information of the first node in the relational isomorphism graph after being processed in the previous network layer.

[0065] The second attribute feature vector refers to the feature information of the first neighboring node corresponding to the first node in the relationship isomorphism graph after being processed in the previous network layer.

[0066] The third attribute feature vector refers to the feature information of the second node in the relational isomorphism graph after being processed in the previous network layer.

[0067] For the above-mentioned second node, when the electronic device determines the first attention score of the above-mentioned first node in the current network layer, it can first use the graph attention network to parse the relational heterogeneous graph to obtain the first attribute feature vector of the first node in the previous network layer, the second attribute feature vector corresponding to at least one first neighboring node in the previous network layer, and the third attribute feature vector of a second node in the previous network layer; then, the first attribute feature vector, all second attribute feature vectors and the third attribute feature vector are calculated to obtain a first attention score with higher accuracy.

[0068] That is to say, combined with the above Figure 2 As can be seen from the relationship heterogeneous graph shown, the electronic device can determine 4 first attention scores.

[0069] Optionally, for the i-th first node among the multiple first nodes, the i-th first node is l -1The first attribute feature vector in the network layer, using the first vector to determine the formula Calculated.

[0070] in, Indicates that the first node of i is l -1 The first attribute feature vector in the network layer also represents the l -1 The embedding representation of the first node of the i-th network layer; represents the i-th first node; represents the first encoding matrix to be learned, , Indicates the number of rows , the number of columns is A real matrix of .

[0071] In addition, the first attribute feature vector of the first node i in the first network layer is available Indicates that the first attribute feature vector is the initial attribute feature vector corresponding to the first node i .

[0072] Optionally, for the i-th first node and the j-th second node among the plurality of second nodes, the i-th first node is l The first attention score in the network layer is calculated using the first score formula Calculated.

[0073] in, Indicates that the first node of i is l The first attention score in the network layer; represents the activation function; express l The first weight of the network layer, , Indicates the number of rows , a real matrix with 1 columns; Indicates l The first feature transformation weights shared in the network layer, , Indicates the number of rows , the number of columns is A real matrix of ; Indicates that the jth second node is l -1 The third attribute feature vector in the network layer; Indicates the first neighboring node set Nt x The first neighbor node is l -1 The second attribute feature vector in the network layer; Represents a matrix connection.

[0074] In some embodiments, the electronic device determines the first feature vector of the first node in the current network layer based on multiple first attention scores and the first node, which may include: the electronic device determines the first feature vector of the first node in the current network layer based on multiple first attention scores and the first attribute feature vector of the first node in the previous network layer.

[0075] In the process of determining the first eigenvector of the first node in the current network layer, the electronic device may calculate multiple first attention scores and the above-mentioned first attribute eigenvector to obtain a first eigenvector with higher accuracy.

[0076] Optionally, for the i-th first node, the i-th first node is l The first eigenvector in the network layer is generated using the first vector formula Calculated.

[0077] in, Indicates that the first node of i is l The first eigenvector in the network layer, , Indicates the number of rows , a real matrix with 1 columns; Represents a linear transformation function.

[0078] In some embodiments, the electronic device uses a graph attention network to determine the second eigenvector corresponding to each of multiple second nodes in a relational heterogeneous graph, which may include: performing the following operations for each second node: the electronic device determines the second neighborhood node set corresponding to the second node in the relational heterogeneous graph; the electronic device determines multiple second attention scores of the second node in the current network layer based on the second node, the second neighborhood node set and multiple first nodes; the electronic device determines the second eigenvector of the second node in the current network layer based on the multiple second attention scores and the second node.

[0079] The second neighboring node set may include at least one second neighboring node, the at least two first neighboring nodes include the second node itself, and each second neighboring node is a second node having a direct edge relationship with the second node. The second neighboring node set may be represented by Ne.

[0080] The second attention score is used to represent the contribution degree of the second neighborhood node set to the second node, that is, the degree of attention of the second node to the second neighborhood node set.

[0081] For a second node among multiple second nodes, the electronic device may first determine the second neighboring node set corresponding to the second node in the relational heterogeneous graph; then, based on the second node, the second neighboring node set, and a first node, the electronic device determines a second attention score for the second node in the current network layer. Based on this, the electronic device will obtain as many second attention scores as there are first nodes, and then calculates the second eigenvector of the second node in the current network layer in combination with the second node. In other words, the above second eigenvector is related to all second nodes adjacent to the second node.

[0082] For example, in combination with the above Figure 2 In the relationship heterogeneous graph shown, for the second node q1, the corresponding second neighboring nodes include the second node q2; for the second node q2, the corresponding second neighboring nodes include the second node q1, the second node q3 and the second node q4; for the second node q3, the corresponding second neighboring nodes include the second node q2 and the second node q4; for the second node q4, the corresponding second neighboring nodes include the second node q2, the second node q3 and the second node q5; for the second node q5, the corresponding second neighboring nodes include the second node q4.

[0083] In some embodiments, the second neighborhood node set includes at least one second neighborhood node, and the electronic device determines multiple second attention scores of the second node in the current network layer based on the second node, the second neighborhood node set and multiple first nodes, which may include: for each first node, the electronic device uses a graph attention network to determine the second attention score of the second node in the current network layer based on the third attribute feature vector of the second node in the previous network layer, the fourth attribute feature vector corresponding to at least one second neighborhood node in the previous network layer, and the first attribute feature vector of the first node in the previous network layer.

[0084] The third attribute feature vector refers to the feature information of the second node in the relational isomorphism graph after being processed in the previous network layer.

[0085] The fourth attribute feature vector refers to the feature information of the second neighboring node corresponding to the second node in the relationship isomorphism graph after being processed in the previous network layer.

[0086] The first attribute feature vector refers to the feature information of the first node in the relational isomorphism graph after being processed in the previous network layer.

[0087] For the above-mentioned first node, when determining the second attention score of the above-mentioned second node in the current network layer, the electronic device can first use the graph attention network to parse the relational heterogeneous graph to obtain the third attribute feature vector of the second node in the previous network layer, the fourth attribute feature vector corresponding to at least one second neighboring node in the previous network layer, and the first attribute feature vector of a first node in the previous network layer; then, the third attribute feature vector, all fourth attribute feature vectors and the first attribute feature vector are calculated to obtain a second attention score with higher accuracy.

[0088] That is to say, combined with the above Figure 2 As can be seen from the relationship heterogeneous graph shown, the electronic device can determine 5 second attention scores.

[0089] Optionally, for the mth second node among the multiple second nodes, the mth second node is l -1 The third attribute eigenvector in the network layer is determined by the second vector formula Calculated.

[0090] in, Indicates that the mth second node is l -1 The third attribute feature vector in the network layer also represents the l -1 The second node embedding representation of the mth node in the network layer; represents the mth second node; represents the second encoding matrix to be learned, , Indicates the number of rows , the number of columns is A real matrix of .

[0091] In addition, the third attribute feature vector of the mth second node in the first network layer is available Indicates that the third attribute feature vector is the initial attribute feature vector corresponding to the mth second node .

[0092] Optionally, for the mth second node and the nth first node among the plurality of first nodes, the mth second node is l The second attention score in the network layer is calculated using the second score formula Calculated.

[0093] in, The mth second node is l Second attention score in the network layer; express l The second weight of the network layer, , Indicates the number of rows , a real matrix with columns of 1, ; exist l The second feature transformation weights shared in the network layer, , Indicates the number of rows , the number of columns is A real matrix of ; Indicates that the nth first node is l -1 The first attribute feature vector in the network layer; Represents the first node in the second neighborhood node set Ne y The second neighbor node is l -1 corresponds to the fourth attribute eigenvector in the network layer.

[0094] In some embodiments, the electronic device determines the second feature vector of the second node in the current network layer based on multiple second attention scores and the second node, which may include: the electronic device determines the second feature vector of the second node in the current network layer based on multiple second attention scores and the third attribute feature vector of the second node in the previous network layer.

[0095] In the process of determining the second eigenvector of the second node in the current network layer, the electronic device can calculate multiple second attention scores and the above-mentioned third attribute eigenvector to obtain a second eigenvector with higher accuracy.

[0096] Optionally, for the mth second node, the mth second node is l The second eigenvector in the network layer is generated using the second vector formula Calculated.

[0097] in, Indicates that the mth second node is l The second eigenvector in the network layer, , Indicates the number of rows , the number of columns is A real matrix of .

[0098] In some embodiments, the electronic device uses a graph attention network to determine the third eigenvector corresponding to each of multiple first nodes in a relational isomorphism graph, which may include: performing the following operations for each first node: the electronic device determines at least one third neighboring node corresponding to the first node in the relational isomorphism graph; the electronic device determines at least one third attention score of the first node in the current network layer based on the first node and the at least one third neighboring node; the electronic device determines the third eigenvector of the first node in the current network layer based on the at least one third attention score and the first node.

[0099] The at least one third neighboring node includes the first node itself, and each third neighboring node is a third node that has a direct edge relationship with the third node. The set of third neighboring nodes can be represented by Nz.

[0100] The third attention score is used to represent the contribution degree of the third neighborhood node set to the third node, that is, the degree of attention of the third node to the third neighborhood node set.

[0101] For a first node among multiple first nodes, the electronic device may first determine at least one third neighboring node corresponding to the first node in the relational isomorphism graph; then, based on the first node, a third neighboring node, and a second node, the electronic device determines a third attention score for the first node in the current network layer. Based on this, the electronic device obtains as many third attention scores as there are third neighboring nodes, and then calculates the third eigenvector of the first node in the current network layer in combination with the first node. In other words, the third eigenvector is correlated with all third nodes adjacent to the third node.

[0102] For example, in combination with the above Figure 3In the relational isomorphism graph shown, for the first node p1, the corresponding third neighboring node includes the first node p3; for the first node p2, the corresponding third neighboring node includes the first node p4; for the first node p3, the corresponding third neighboring node includes the first node p1, the first node p4 and the first node p5; for the first node p4, the corresponding third neighboring node includes the first node p2, the first node p5 and the first node p6; for the first node p5, the corresponding third neighboring node includes the first node p3 and the first node p4; for the first node p6, the corresponding third neighboring node includes the first node p4.

[0103] In some embodiments, the electronic device determines at least one third attention score of the first node in the current network layer based on the first node and at least one third neighboring node, which may include: for each third neighboring node, the electronic device uses a graph attention network to determine the third attention score of the first node in the current network layer based on the fifth attribute feature vector of the first node in the previous network layer, the sixth attribute feature vector of the third neighboring node in the previous network layer, and the seventh attribute feature vector corresponding to at least one third neighboring node in the previous network layer.

[0104] The fifth attribute feature vector refers to the feature information of the first node in the relational isomorphism graph after being processed in the previous network layer.

[0105] The sixth attribute feature vector refers to the feature information of the third neighboring node corresponding to the first node in the relationship isomorphism graph after being processed in the previous network layer.

[0106] The seventh attribute feature vector refers to the feature information of the second node in the relational isomorphism graph after being processed in the previous network layer.

[0107] For a certain third-neighborhood node, when the electronic device determines the third attention score of a certain first node in the current network layer, it can first use the graph attention network to parse the relational isomorphism graph to obtain the fifth attribute feature vector of the first node in the previous network layer, the sixth attribute feature vector of the third-neighborhood node in the previous network layer, and the seventh attribute feature vector corresponding to at least one third-neighborhood node in the previous network layer; then, the fifth attribute feature vector, the sixth attribute feature vector and all seventh attribute feature vectors are calculated to obtain a third attention score with higher accuracy.

[0108] Optionally, for the first of the multiple first nodes k The first node, k The first node is l -1 The fifth attribute eigenvector in the network layer is determined by the third vector formula Calculated.

[0109] in, No. k The first node is l -1 The fifth attribute eigenvector in the network layer; Indicates the k First node; represents the third encoding matrix to be learned, , Indicates the number of rows , the number of columns is The real matrix of .

[0110] In addition, k The fifth attribute feature vector of the first node in the first network layer is available Indicates that the first attribute feature vector is the k The initial attribute feature vector corresponding to the first node .

[0111] Optionally, for at least one third neighboring node v The third neighbor node, v The third neighbor node is l -1 The sixth attribute eigenvector in the network layer is determined by the fourth vector formula Calculated.

[0112] in, No. v The third neighbor node is l -1 The sixth attribute eigenvector in the network layer; Indicates the v third neighbor nodes; represents the fourth encoding matrix to be learned, , Indicates the number of rows , the number of columns is The real matrix of .

[0113] Optional, for k The first node and the v The third neighbor node, k The first node is l The third attention score in the network layer is calculated using the third score formula Calculated.

[0114] in, Indicates the k The first node is l The third attention score in the network layer; expressl The third weight of the network layer, , Indicates the number of rows , a real matrix with columns of 1, ; exist l The third feature transformation weights shared in the network layer, , Indicates the number of rows , the number of columns is A real matrix of ; Indicates the v The third neighbor node is l -1 The sixth attribute eigenvector in the network layer; Indicates the z The third neighbor node is l -1 corresponds to the seventh attribute eigenvector in the network layer.

[0115] In some embodiments, the electronic device determines the third eigenvector of the first node in the current network layer based on at least one third attention score and the first node, which may include: the electronic device determines the third eigenvector of the first node in the current network layer based on at least one third attention score and the fifth attribute eigenvector of the first node in the previous network layer.

[0116] In the process of determining the third eigenvector of the first node in the current network layer, the electronic device may calculate at least one third attention score and the fifth attribute eigenvector to obtain a third eigenvector with higher accuracy.

[0117] Optional, for k The first node, k The first node is l The third eigenvector in the network layer is generated using the third vector formula Calculated.

[0118] also, Indicates the k The first node is l The third eigenvector in the network layer, , Indicates the number of rows , a real matrix with 1 columns.

[0119] In some embodiments, the electronic device determines the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first eigenvector, the third eigenvector and the second eigenvector corresponding to the first node and the second eigenvector corresponding to the second node, which may include: the electronic device determines the first target feature based on the first eigenvector, the third eigenvector and the first training parameter weight corresponding to the first node; the electronic device determines the second target feature based on the second eigenvector and the second training parameter weight corresponding to the second node; the electronic device determines the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first target feature and the second target feature.

[0120] The first target feature may also be called the first latent feature, which is a vector; the second target feature may also be called the second latent feature, which is also a vector.

[0121] The electronic device can calculate the first eigenvector, the third eigenvector and the first training parameter weight corresponding to the first node to obtain the first target feature, and calculate the second eigenvector and the second training parameter weight corresponding to the second node to obtain the second target feature, and then combine the first target feature for calculation to obtain the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node, and the accuracy of the attack probability is relatively high.

[0122] It should be noted that the timing for the electronic device to determine the first target feature and the second target feature is not limited.

[0123] Optionally, for the sth first node among the multiple first nodes, the first target feature adopts the first target formula in the fully connected neural network Calculated.

[0124] in, represents the first target feature; Represents a function; Indicates that the sth first node is l The first eigenvector in the network layer; Indicates that the sth first node is l The third eigenvector in the network layer; represents the first training parameter weight, , Indicates the number of rows , the number of columns is The real matrix of .

[0125] Optionally, for the oth second node among the plurality of second nodes, the second target feature adopts the second target formula in the fully connected neural network Calculated.

[0126] in, represents the second target feature; Indicates that the oth second node is l The second eigenvector in the network layer; represents the second training parameter weight, , Indicates the number of rows , the number of columns is The real matrix of , .

[0127] Optionally, for the sth first node and the oth second node, the attack probability is calculated using the inner product, specifically using the probability calculation formula Calculated.

[0128] in, It represents the attack probability of the threat traffic corresponding to the sth first node on the execution body corresponding to the oth second node.

[0129] Based on this, the electronic device can calculate the attack probability of any threat traffic on any executable body.

[0130] In some embodiments, the electronic device determines the scheduling measures of the execution body corresponding to the second node based on the attack probability, which may include: when the attack probability is greater than a preset probability threshold, the electronic device will schedule the execution body corresponding to the second node as a scheduling measure.

[0131] After determining the power probability, the electronic device can compare the attack probability with a preset probability threshold: if the attack probability is less than or equal to the preset probability threshold, it means that the corresponding threat traffic has not attacked the corresponding executable body, or the attack degree of the corresponding threat traffic on the corresponding executable body is small and cannot affect the normal operation of the executable body. At this time, no operation is performed; if the attack probability is greater than the preset probability threshold, it means that the corresponding threat traffic is attacking the corresponding executable body, and the attack degree is small, which has affected the normal operation of the executable body to a large extent. At this time, it is necessary to execute a scheduling plan to schedule and replace the executable body in advance, or schedule and clean it, thereby improving the safe operation of the executable body.

[0132] It should be noted that the process of electronic devices comparing the attack probability with the preset probability threshold can be regarded as a binary classification problem of predicting whether the executor will be breached by threat traffic. The entire process can be used as a prediction model. At this time, the binary cross entropy loss function commonly used in binary classification problems can be used to optimize the prediction model, update the model parameters, and obtain a trained prediction model with high accuracy.

[0133] Among them, the binary cross entropy loss function is: .

[0134] Indicates the loss value; N represents the number of input samples. Each input sample is a pair of threat traffic and execution body (i.e., attack relationship) in the heterogeneous graph. Therefore, N can also represent the number of edges in the heterogeneous graph. Indicates the number of input samples N The true label corresponding to the i-th input sample in , i.e. attack or not attack; represents the attack probability corresponding to the i-th true label.

[0135] For example, Figure 4 It is a flowchart of the execution body scheduling method provided by the present invention, such as Figure 4 As shown, the method includes: constructing a relational heterogeneous graph based on first nodes corresponding to each of the plurality of threat flows and second nodes corresponding to each of the plurality of execution bodies; determining initial attribute feature vectors corresponding to each of the plurality of threat flows and initial attribute feature vectors corresponding to each of the plurality of execution bodies; using a graph attention network, based on the initial attribute feature vectors corresponding to each of the plurality of threat flows, determining first feature vectors corresponding to each of the plurality of first nodes in the current network layer, and based on the initial attribute feature vectors corresponding to each of the plurality of execution bodies, determining second feature vectors corresponding to each of the plurality of second nodes in the current network layer.

[0136] Based on the first nodes corresponding to the multiple threat flows, a relational isomorphism graph is constructed; the initial attribute feature vectors corresponding to the multiple threat flows are determined; and a graph attention network is used to determine the third feature vectors corresponding to the multiple first nodes in the current network layer based on the initial attribute feature vectors corresponding to the multiple threat flows.

[0137] For the s-th first node and the o-th second node, determine the first target feature corresponding to the s-th first node based on the first eigenvector and the third eigenvector corresponding to the s-th first node, and determine the second target feature corresponding to the o-th second node based on the second eigenvector corresponding to the o-th second node; perform an inner product operation on the first target feature and the second target feature to determine the attack probability of the threat traffic corresponding to the s-th first node on the execution body corresponding to the o-th second node.

[0138] When the attack probability is greater than a preset probability threshold, the execution body corresponding to the oth second node is scheduled and replaced.

[0139] The entire process can perceive the current network environment in real time. When the network environment changes, by combining the constructed relationship heterogeneous graph and relationship isomorphic graph, the graph attention network is used to predict the probability of threat traffic in the current network breaking through the current work executor, and discovering the executors with a high probability of being broken in advance, so as to schedule and replace the corresponding executors in advance, improving the defense capability of mimicry defense against attacks, while reducing the resource loss caused by frequent scheduling.

[0140] The following describes the execution body scheduling device provided by the present invention. The execution body scheduling device described below and the execution body scheduling method described above can be referenced to each other.

[0141] Figure 5 This is a schematic diagram of the structure of the execution body scheduling device provided by the present invention. Figure 5 As shown, the device includes the following: a data processing module 501 and a solution determination module 502.

[0142] The data processing module 501 is used to construct a relational heterogeneous graph based on the first nodes corresponding to each of the plurality of threat flows, the second nodes corresponding to each of the plurality of execution bodies, and the set of edge relationships corresponding to the plurality of threat flows and the plurality of execution bodies; and use a graph attention network to determine the first eigenvectors corresponding to each of the plurality of first nodes in the relational heterogeneous graph, and the second eigenvectors corresponding to each of the plurality of second nodes; construct a relational isomorphic graph based on the node similarity between the plurality of first nodes and the plurality of first nodes; and use the graph attention network to determine the third eigenvectors corresponding to each of the plurality of first nodes in the relational isomorphic graph.

[0143] The solution determination module 502 is used to determine, for each first node among the multiple first nodes and each second node among the multiple second nodes, the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first eigenvector and the third eigenvector corresponding to the first node and the second eigenvector corresponding to the second node; and determine the scheduling measures for the execution body corresponding to the second node based on the attack probability.

[0144] Optionally, the data processing module 501 is specifically used to perform the following operations for each first node: determining the first neighborhood node set corresponding to the first node in the relational heterogeneous graph; determining multiple first attention scores of the first node in the current network layer based on the first node, the first neighborhood node set and the multiple second nodes; and determining the first eigenvector of the first node in the current network layer based on the multiple first attention scores and the first node.

[0145] Optionally, the first neighborhood node set includes at least one first neighborhood node, and the data processing module 501 is specifically used to use the graph attention network for each second node to determine the first attention score of the first node in the current network layer based on the first attribute feature vector of the first node in the previous network layer, the second attribute feature vector corresponding to each of the at least one first neighborhood node in the previous network layer, and the third attribute feature vector of the second node in the previous network layer.

[0146] Optionally, the data processing module 501 is specifically used to determine the first feature vector of the first node in the current network layer based on the multiple first attention scores and the first attribute feature vector of the first node in the previous network layer.

[0147] Optionally, the data processing module 501 is specifically used to perform the following operations for each second node: determining a second neighborhood node set corresponding to the second node in the relational heterogeneous graph; determining a plurality of second attention scores of the second node in the current network layer based on the second node, the second neighborhood node set and the plurality of first nodes; and determining a second eigenvector of the second node in the current network layer based on the plurality of second attention scores and the second node.

[0148] Optionally, the second neighborhood node set includes at least one second neighborhood node, and the data processing module 501 is specifically used to use the graph attention network for each first node to determine the second attention score of the second node in the current network layer based on the third attribute feature vector of the second node in the previous network layer, the fourth attribute feature vector corresponding to each of the at least one second neighborhood node in the previous network layer, and the first attribute feature vector of the first node in the previous network layer.

[0149] Optionally, the data processing module 501 is specifically used to determine the second feature vector of the second node in the current network layer based on the multiple second attention scores and the third attribute feature vector of the second node in the previous network layer.

[0150] Optionally, the data processing module 501 is specifically used to perform the following operations for each first node: determining at least one third neighboring node corresponding to the first node in the relationship isomorphism graph; determining at least one third attention score of the first node in the current network layer based on the first node and the at least one third neighboring node; and determining a third eigenvector of the first node in the current network layer based on the at least one third attention score and the first node.

[0151] Optionally, the data processing module 501 is specifically used to use the graph attention network for each third neighboring node to determine the third attention score of the first node in the current network layer based on the fifth attribute feature vector of the first node in the previous network layer, the sixth attribute feature vector of the third neighboring node in the previous network layer, and the seventh attribute feature vector corresponding to each of the at least one third neighboring node in the previous network layer.

[0152] Optionally, the data processing module 501 is specifically used to determine the third eigenvector of the first node in the current network layer based on the at least one third attention score and the fifth attribute eigenvector of the first node in the previous network layer.

[0153] Optionally, the solution processing module 502 is specifically used to determine the first target feature based on the first feature vector, the third feature vector and the first training parameter weight corresponding to the first node; determine the second target feature based on the second feature vector and the second training parameter weight corresponding to the second node; and determine the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first target feature and the second target feature.

[0154] Optionally, the solution processing module 502 is specifically configured to determine, when the attack probability is greater than a preset probability threshold, scheduling replacement of the execution body corresponding to the second node as the scheduling measure.

[0155] Figure 6 An example of a physical structure diagram of an electronic device is shown below. Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640. The processor 610, the communication interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call logic instructions in the memory 630 to execute the body scheduling method.

[0156] Furthermore, the logic instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0157] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the execution body scheduling method provided by the above methods.

[0158] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented to execute the execution body scheduling method provided by the above methods when the computer program is executed by a processor.

[0159] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0160] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for scheduling an execution body, characterized in that: include: Constructing a heterogeneous relationship graph based on first nodes corresponding to respective threat flows, second nodes corresponding to respective execution bodies, and sets of edge relationships corresponding to the threat flows and the execution bodies; and using a graph attention network to determine a first eigenvector corresponding to each of the plurality of first nodes and a second eigenvector corresponding to each of the plurality of second nodes in the relational heterogeneous graph; Constructing a relational isomorphism graph based on the multiple first nodes and the node similarities between the multiple first nodes; and using the graph attention network to determine a third eigenvector corresponding to each of the multiple first nodes in the relational isomorphism graph; For each first node among the multiple first nodes and each second node among the multiple second nodes, determine the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first feature vector and the third feature vector corresponding to the first node and the second feature vector corresponding to the second node; and determine the scheduling measures for the execution body corresponding to the second node based on the attack probability.

2. The execution body scheduling method according to claim 1, characterized in that: The method of using a graph attention network to determine first eigenvectors corresponding to respective first nodes in the relational heterogeneous graph includes: The following operations are performed for each first node: In the relational heterogeneous graph, determining a first neighboring node set corresponding to the first node; Determining, based on the first node, the first set of neighboring nodes, and the plurality of second nodes, a plurality of first attention scores of the first node in a current network layer; Determine a first feature vector of the first node in the current network layer based on the multiple first attention scores and the first node.

3. The execution body scheduling method according to claim 2, characterized in that: The first neighborhood node set includes at least one first neighborhood node, and determining, based on the first node, the first neighborhood node set, and the plurality of second nodes, a plurality of first attention scores of the first node in the current network layer includes: For each of the second nodes, the graph attention network is used to determine the first attention score of the first node in the current network layer based on the first attribute feature vector of the first node in the previous network layer, the second attribute feature vector corresponding to each of the at least one first neighboring nodes in the previous network layer, and the third attribute feature vector of the second node in the previous network layer.

4. The execution body scheduling method according to claim 3, characterized in that: The determining, based on the multiple first attention scores and the first node, a first feature vector of the first node in the current network layer includes: Determine a first feature vector of the first node in the current network layer based on the multiple first attention scores and the first attribute feature vector of the first node in the previous network layer.

5. The execution body scheduling method according to claim 1, characterized in that: Using a graph attention network, determining a second eigenvector corresponding to each of the plurality of second nodes in the relational heterogeneous graph includes: The following operations are performed for each second node: In the relational heterogeneous graph, determining a second neighborhood node set corresponding to the second node; Determining, based on the second node, the second neighborhood node set, and the plurality of first nodes, a plurality of second attention scores of the second node in the current network layer; Determine a second feature vector of the second node in the current network layer based on the multiple second attention scores and the second node.

6. The execution body scheduling method according to claim 5, characterized in that: The second neighborhood node set includes at least one second neighborhood node, and determining, based on the second node, the second neighborhood node set, and the plurality of first nodes, a plurality of second attention scores of the second node in the current network layer includes: For each of the first nodes, the graph attention network is used to determine the second attention score of the second node in the current network layer based on the third attribute feature vector of the second node in the previous network layer, the fourth attribute feature vector corresponding to each of the at least one second neighboring nodes in the previous network layer, and the first attribute feature vector of the first node in the previous network layer.

7. The execution body scheduling method according to claim 5, characterized in that: The determining, based on the plurality of second attention scores and the second node, a second feature vector of the second node in the current network layer, includes: Determine a second feature vector of the second node in the current network layer based on the multiple second attention scores and the third attribute feature vector of the second node in the previous network layer.

8. The execution body scheduling method according to claim 1, characterized in that: The step of using the graph attention network to determine the third eigenvectors corresponding to the plurality of first nodes in the relational isomorphism graph comprises: The following operations are performed for each first node: In the relational isomorphism graph, determining at least one third neighboring node corresponding to the first node; Determining at least one third attention score of the first node in the current network layer based on the first node and the at least one third neighboring node; Determine a third eigenvector of the first node in the current network layer based on the at least one third attention score and the first node.

9. The execution body scheduling method according to claim 8, characterized in that: The determining, based on the first node and the at least one third neighboring node, at least one third attention score of the first node in the current network layer includes: For each third-neighborhood node, the graph attention network is used to determine the third attention score of the first node in the current network layer based on the fifth attribute feature vector of the first node in the previous network layer, the sixth attribute feature vector of the third neighboring node in the previous network layer, and the seventh attribute feature vector corresponding to each of the at least one third neighboring node in the previous network layer.

10. The execution body scheduling method according to claim 8, characterized in that: The determining, based on the at least one third attention score and the first node, a third eigenvector of the first node in the current network layer includes: Determine a third eigenvector of the first node in the current network layer based on the at least one third attention score and the fifth attribute eigenvector of the first node in the previous network layer.

11. The method for scheduling an executable object according to any one of claims 1 to 10, characterized in that: The determining, based on the first feature vector and the third feature vector corresponding to the first node and the second feature vector corresponding to the second node, a probability of the threat traffic corresponding to the first node attacking the executable corresponding to the second node includes: Determining a first target feature according to a first eigenvector, a third eigenvector, and a first training parameter weight corresponding to the first node; Determine a second target feature according to a second feature vector and a second training parameter weight corresponding to the second node; An attack probability of the threat traffic corresponding to the first node on the executable corresponding to the second node is determined according to the first target feature and the second target feature.

12. The method for scheduling an executable object according to any one of claims 1 to 10, characterized in that: The determining, based on the attack probability, a scheduling measure for the execution body corresponding to the second node includes: When the attack probability is greater than a preset probability threshold, scheduling replacement of the execution body corresponding to the second node is determined as the scheduling measure.

13. An executive scheduling device, characterized in that: include: A data processing module, configured to construct a heterogeneous relationship graph based on first nodes corresponding to respective threat flows, second nodes corresponding to respective execution bodies, and sets of edge relationships corresponding to the plurality of threat flows and the plurality of execution bodies; A graph attention network is used to determine first eigenvectors corresponding to each of the plurality of first nodes in the relational heterogeneous graph, and second eigenvectors corresponding to each of the plurality of second nodes; a relational isomorphic graph is constructed based on the node similarities between the plurality of first nodes and the plurality of first nodes; and the graph attention network is used to determine third eigenvectors corresponding to each of the plurality of first nodes in the relational isomorphic graph; A scheme determination module is used to determine, for each first node among the multiple first nodes and each second node among the multiple second nodes, the attack probability of the threat traffic corresponding to the first node on the execution body corresponding to the second node based on the first eigenvector and the third eigenvector corresponding to the first node and the second eigenvector corresponding to the second node; and determine the scheduling measures for the execution body corresponding to the second node based on the attack probability.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the execution body scheduling method according to any one of claims 1 to 12 is implemented.

15. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the execution body scheduling method according to any one of claims 1 to 12 is implemented.

Images