Network security dynamic defense method and device based on edge computing

Abstract

The invention provides a network security dynamic defense method and device based on edge computing, and relates to the technical field of edge computing, and the method comprises the steps: generating a defense strategy according to the type of a security threat when it is detected that the security threat exists in a core network; acquiring node features of each edge computing node in the edge computing node resource pool; selecting a plurality of edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of the security threat to obtain a plurality of target edge computing nodes; and distributing a defense task to each target edge computing node in combination with the defense strategy and the node state of each target edge computing node. The technical effect of the invention is that the security defense capability of the whole network system is improved.

Description

Technical Field

[0001] The present application relates to the field of edge computing technology, and specifically to a network security dynamic defense method and device based on edge computing. Background Art

[0002] With the development of network technology, network security issues are becoming increasingly prominent. The security and stability of the core network is crucial to the normal operation of the entire network system. The types and scales of network attacks are constantly changing and escalating, and traditional network security defense measures face huge challenges. As the backbone of the network system, the security of the core network directly affects the operation of the entire network and the reliability of data transmission.

[0003] In order to solve the above problems, existing network security solutions usually adopt centralized defense mechanisms. Although this method can centrally manage and control the network's security protection measures to a certain extent, the centralized defense mechanism relies on a single or a small number of core nodes for centralized processing. When the scale of the attack expands, these core nodes are prone to overload operation, resulting in a decrease in the defense capabilities of the entire network system. Summary of the invention

[0004] The present application provides a network security dynamic defense method and device based on edge computing, which is used to improve the security defense capability of the entire network system.

[0005] In the first aspect, the present application provides a network security dynamic defense method based on edge computing, the method comprising: when a security threat is detected in the core network, generating a defense strategy according to the type of the security threat; obtaining the node characteristics of each edge computing node in the edge computing node resource pool; selecting multiple edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of the security threat, to obtain multiple target edge computing nodes; and assigning a defense task to each target edge computing node in combination with the defense strategy and the node status of each target edge computing node.

[0006] By adopting the above technical solution, when a security threat is detected, a corresponding optimized defense strategy can be generated according to the threat type; the resource status of the edge computing node is obtained, and the appropriate target edge computing node is selected according to the node characteristics and threat type; and the node defense status is considered, and defense tasks are assigned to the target node according to the defense strategy requirements to form a dynamic and coordinated edge defense system. Compared with the traditional centralized defense mechanism, this method makes full use of edge computing resources and can flexibly respond to large-scale, dynamically changing network attacks. By coordinating edge nodes for defense, the distribution of network defense can be improved, overload of core nodes can be avoided, and the security defense capabilities of the entire network system can be improved.

[0007] Optionally, a defense strategy is generated according to the type of the security threat, including: according to the type of the security threat, selecting a defense strategy corresponding to the type of the security threat from a defense strategy library, the defense strategy including at least one of attack detection, traffic cleaning, security isolation and countermeasures.

[0008] By adopting the above technical solutions and combining security threat types to generate targeted defense strategies, the defense strategies can be made more in line with the actual threat situation and improve the defense effect. The preset defense strategy library fully considers various known threat types and can quickly respond to select corresponding strategies. The selected defense strategies cover key links such as attack detection, traffic control, isolation and countermeasures, forming a comprehensive defense system. In this way, targeted defense measures can be implemented for different types of threats, improving the accuracy and effectiveness of defense.

[0009] Optionally, the node characteristics include computing power, storage capacity, network bandwidth and geographical location, and selecting multiple edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of security threat, including: determining a performance index of each edge computing node according to the computing power, storage capacity and network bandwidth of each edge computing node; determining a performance threshold of the edge computing node for defending against the security threat according to the attack traffic size of the security threat; taking an edge computing node having a performance index higher than the performance threshold as a candidate edge computing node; obtaining the geographical location of each candidate edge computing node, and selecting multiple edge computing nodes from the candidate edge computing nodes as target edge computing nodes according to the geographical location of each candidate edge computing node.

[0010] By adopting the above technical solution, the performance index of the node is calculated and matched with the attack traffic size of the security threat, and the candidate nodes with qualified performance are screened out. Then, the geographical distribution of the candidate nodes is comprehensively considered, and the target edge computing nodes with dispersed node locations are selected. This selection mechanism fully considers the node hardware performance, network bandwidth and location distribution, and can select nodes with excellent performance and reasonable location for defense. It not only meets the hardware requirements for responding to large-volume attacks, but also realizes the distributed deployment requirements of regional defense. Finally, a target edge computing node cluster with optimized comprehensive indicators and dispersed locations is formed, which can maximize the defense capabilities of the nodes, enhance the defense range of the network, and improve the response effect to security threats.

[0011] Optionally, determining the performance index of each edge computing node according to the computing power, the storage capacity and the network bandwidth of each edge computing node includes: obtaining the computing power parameter, the storage capacity parameter and the network bandwidth parameter of each edge computing node; substituting the computing power parameter, the storage capacity parameter and the network bandwidth parameter of each edge computing node into a performance index calculation formula to determine the performance index of each edge computing node; wherein the performance index calculation formula is: In the formula, PI i is the performance index of the ith edge computing node, c i is the computing power parameter of the ith edge computing node, c min is the minimum value of the computing power parameters of all edge computing nodes, c max is the maximum value of the computing power parameters of all edge computing nodes, s i is the storage capacity parameter of the i-th edge computing node, s min is the minimum value of the storage capacity parameters of all edge computing nodes, s max is the maximum value of the storage capacity parameters of all edge computing nodes, b i is the network bandwidth parameter of the ith edge computing node, b min is the minimum value of the network bandwidth parameters of all edge computing nodes, b max is the maximum value of the network bandwidth parameters of all edge computing nodes, ω c ,ω s and b are all weight coefficients.

[0012] By adopting the above technical solution,

[0013] Optionally, the node status includes a defense resource occupancy rate and a defense task execution progress, and the defense task is assigned to each target edge computing node in combination with the defense strategy and the node status of each target edge computing node, including: obtaining the defense resource occupancy rate and the defense task execution progress of each target edge computing node; determining the priority of each type of defense task according to the defense strategy; selecting a first edge computing node from the target edge computing nodes whose defense resource occupancy rate is lower than a preset threshold and whose defense task execution progress is the fastest, and assigning the highest priority defense task to the first edge computing node; selecting a second edge computing node from the remaining target edge computing nodes whose defense resource occupancy rate is lower than the preset threshold and whose defense task execution progress is the fastest, and assigning the second highest priority defense task to the second edge computing node, until all defense tasks in the defense strategy are assigned.

[0014] By adopting the above technical solution, the performance index calculation formula fully considers the hardware configuration of the edge computing node. By normalizing the computing power parameters, storage capacity parameters and network bandwidth parameters, the performance of different edge nodes can be fairly evaluated. The calculation formula adopts the linear weighted method, and the preference for a certain indicator can be emphasized by adjusting the size of the weight coefficient. In this way, the comprehensive performance level of the node can be quantified. Based on the performance index, some edge nodes whose performance does not meet the requirements can be excluded, so as to select computing nodes with stronger performance. This quantitative performance evaluation mechanism makes the node screening more objective and accurate, which is conducive to selecting edge computing nodes that are truly suitable for defense tasks, thereby improving the defense effect.

[0015] Optionally, after assigning defense tasks to each of the target edge computing nodes, it also includes: obtaining real-time load parameters of each of the target edge computing nodes; determining whether the real-time load parameters of each of the target edge computing nodes exceed a predetermined load threshold; if the real-time load parameters of an abnormal target edge computing node exceed the predetermined load threshold, selecting one or more edge computing nodes from the edge computing node resource pool, and transferring part of the defense tasks on the abnormal target edge computing node to the one or more edge computing nodes, so as to achieve load balancing of each of the target edge computing nodes.

[0016] By adopting the above technical solution, the load parameters of the nodes are monitored in real time to determine whether the load exceeds the predetermined threshold, the load is transferred to abnormal nodes with excessively high loads, and new nodes are selected to share their defense tasks to achieve dynamic balancing of node loads. This mechanism can prevent edge computing nodes from overloading during defense tasks and ensure that nodes participate in defense at a reasonable load level. In addition, new computing resources can be dynamically added to cope with overload situations and improve system processing capabilities. This can ensure the overall stable operation of the defense system and avoid system crashes caused by single node failures. The load balancing mechanism improves the reliability and flexibility of the system, enabling the defense system to dynamically adjust resources and better respond to changing defense needs, thereby enhancing the security defense capabilities of the overall network. Optionally, after assigning defense tasks to each of the target edge computing nodes, it also includes: obtaining the defense task execution results and updated node status of each of the target edge computing nodes; determining whether the security threat has been successfully defended based on the defense task execution results of each of the target edge computing nodes; if the security threat is not successfully defended, adjusting the defense strategy based on the updated node status of each of the target edge computing nodes to obtain an adjusted defense strategy; based on the adjusted defense strategy, selecting at least one new target edge computing node from the edge computing node resource pool, and assigning unfinished defense tasks to the new target edge computing node and the original target edge computing node until the security threat is successfully defended.

[0017] By adopting the above technical solution, the execution results and updated status of the node's defense task can be obtained in real time, and the threat can be judged whether it is successfully defended based on the execution effect. If the defense is unsuccessful, the defense strategy will be adjusted according to the latest node status, and the edge computing node will be reselected to redistribute the defense task until the threat is eliminated. This mechanism realizes dynamic monitoring and strategy adjustment of the defense process, allowing the system to continuously optimize the defense plan and automatically select more resources for supplementary defense. This allows the system to continuously respond to changing threats, actively allocate resources to fill defense gaps, and greatly improve the network's self-adaptive defense capabilities. Compared with static defense strategies, this dynamic evaluation and adjustment mechanism can significantly improve the effectiveness of defense and enhance the network's ability to resist large-scale security threats.

[0018] In the second aspect, the present application provides a network security dynamic defense device for edge computing, the device comprising: the device comprising: a detection module, an acquisition module, a selection module and an output module; wherein the detection module is used to generate a defense strategy according to the type of security threat when a security threat is detected in the core network; the acquisition module is used to obtain the node characteristics of each edge computing node in the edge computing node resource pool; the selection module is used to select multiple edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of security threat, and obtain multiple target edge computing nodes; the combination module is used to combine the defense strategy and the node status of each target edge computing node, and assign a defense task to each target edge computing node.

[0019] In the third aspect, the present application provides an electronic device, adopting the following technical solution: including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes a computer program such as any one of the above-mentioned edge computing-based dynamic network security defense methods.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: storing a computer program that can be loaded by a processor and execute any of the above-mentioned edge computing-based dynamic network security defense methods.

[0021] In summary, the present application includes at least one of the following beneficial technical effects: 1. When a security threat is detected, the corresponding optimized defense strategy can be generated according to the threat type; the resource status of the edge computing node is obtained, and the appropriate target edge computing node is selected according to the node characteristics and threat type; and the node defense status is considered, and defense tasks are assigned to the target node according to the defense strategy requirements to form a dynamic and coordinated edge defense system. Compared with the traditional centralized defense mechanism, this method makes full use of edge computing resources and can flexibly respond to large-scale and dynamically changing network attacks. By coordinating edge nodes for defense, the distribution of network defense can be improved, the overload of core nodes can be avoided, and the security defense capability of the entire network system can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of a network security dynamic defense method based on edge computing provided in an embodiment of the present application; Figure 2 It is a structural diagram of a network security dynamic defense device based on edge computing provided in an embodiment of the present application; Figure 3It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0023] Description of reference numerals: 1000, electronic device; 1001, processor; 1002, communication bus; 1003, user interface; 1004, network interface; 1005, memory. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0025] In the description of the embodiments of the present application, words such as "illustrative", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "illustrative", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "illustrative", "for example" or "for example" is intended to present related concepts in a concrete way.

[0026] In a large financial institution, the core network carries a large amount of sensitive data and important business systems, so network security is of vital importance. In order to deal with various potential network security threats, the institution has deployed a network security dynamic defense system based on edge computing. For example, the system monitors abnormal traffic in the core network, and the detection module identifies that this is a large-scale DDOS attack. The rapid increase in attack traffic may cause the interruption of online financial services, and customers cannot perform normal transactions, which seriously affects business continuity.

[0027] The system first analyzed the type and characteristics of this DDOS attack. By analyzing the attack source, traffic pattern, and attack target, the system confirmed that this was a typical DDOS attack, with the goal of paralyzing the financial transaction server. In order to deal with this threat, the system selected a defense strategy specifically for DDOS attacks from the defense strategy library. This strategy includes the following aspects: enabling the advanced attack detection module, monitoring traffic in real time, and accurately identifying abnormal traffic and attack sources; starting traffic cleaning equipment to filter out malicious traffic to ensure that normal business traffic is not affected; isolating the attacked transaction server from other systems to prevent the attack from spreading to other business systems; restricting or banning the attack source IP to reduce the impact of attack traffic.

[0028] After that, the system obtains the characteristics of each node in the edge computing node resource pool, including computing power, storage capacity, network bandwidth, and geographical location. Based on the characteristics of each edge computing node and the characteristics of this DDOS attack, the system calculates the performance index of each node and determines the performance threshold required to defend against this attack. The system selects nodes with performance indexes higher than the threshold as candidate nodes, and further selects multiple edge computing nodes as target nodes based on geographical location to ensure fast response and load balancing.

[0029] Combining the generated defense strategy and the status of the target node (including defense resource occupancy and defense task execution progress), the system assigns defense tasks to each target edge computing node. The most urgent defense tasks are assigned to nodes with low resource occupancy and fast task execution progress to ensure efficient execution of defense measures. During the execution of defense tasks, the system continuously monitors the real-time load parameters of each target node. If it is found that the load parameters of some nodes exceed the predetermined threshold, the system will select new nodes from the resource pool and transfer some defense tasks to them to achieve load balancing.

[0030] At the same time, the system will also obtain the execution results of the defense tasks and the updated node status. If it is found that the security threat is not completely defended, the system will adjust the defense strategy and reallocate the unfinished defense tasks until the DDOS attack is successfully defended. Through such a defense process, the core network of financial institutions can quickly generate targeted defense strategies when encountering DDOS attacks, and use the distributed characteristics of edge computing to efficiently allocate and execute defense tasks. This not only ensures the stability and security of the network, but also provides a solid guarantee for the continuity of financial services.

[0031] In short, the edge computing-based network security dynamic defense method has demonstrated its high efficiency, flexibility and reliability in practical applications, effectively improving the ability of financial institutions to deal with complex network security threats. Of course, this application is not only applicable to the network security protection of financial institutions, but can also be widely used in other fields that require high security and stability. Through efficient, flexible and reliable network security defense measures, the network security protection capabilities of various key areas can be improved to ensure the security and stability of their network systems.

[0032] Figure 1 This is a flow chart of a network security dynamic defense method based on edge computing provided by an embodiment of the present application, such as Figure 1 As shown, the method includes S101-S104.

[0033] S101, when a security threat is detected in the core network, a defense strategy is generated according to the type of the security threat.

[0034] The core network refers to the backbone part that plays a key role in a computer network. It is responsible for processing and transmitting a large amount of network traffic, connecting different subnets and network devices, and supporting various key businesses and applications. The core network usually has the characteristics of high bandwidth, low latency and high reliability, and is the foundation of the entire network architecture.

[0035] In one example, when the system detects a security threat in the core network, it first needs to classify and identify the threat. Different types of security threats (such as DDoS attacks, data leaks, malware propagation, etc.) have different characteristics and impacts, and require different defense strategies to deal with them. Specifically, the system analyzes attributes such as the source of the threat, attack mode, impact range, and severity to accurately determine the type of threat.

[0036] Once the threat type is determined, the system will select the defense strategy corresponding to that type of threat from the pre-built defense strategy library. This defense strategy library contains a variety of strategies for dealing with different security threats, such as attack detection, traffic cleaning, security isolation, and countermeasures. These strategies are based on in-depth research on various threats and actual defense experience, ensuring that each strategy can effectively deal with specific types of threats.

[0037] During the specific implementation, assume that a DDoS attack is detected. After the system identifies the attack type, it selects a defense strategy suitable for the DDoS attack from the defense strategy library. This strategy may include the following aspects: First, monitor and analyze traffic in real time through the attack detection module to identify abnormal traffic and attack sources; second, start the traffic cleaning device to filter out malicious traffic to ensure that normal business traffic is not affected; then, use security isolation technology to isolate the attacked part of the network to prevent the attack from spreading; finally, take countermeasures, such as limiting or blocking the attack source IP to reduce the attack pressure.

[0038] Based on the above embodiment, as an optional implementation, in S101, generating a defense strategy according to the type of security threat specifically includes the following steps: According to the type of security threat, a defense strategy corresponding to the type of security threat is selected from the defense strategy library, and the defense strategy includes at least one of attack detection, traffic cleaning, security isolation and countermeasures.

[0039] In one example, the system analyzes and categorizes the currently detected security threats. The types of security threats may include DDoS attacks, data leaks, malware propagation, network intrusions, etc. Each threat has different characteristics and impacts, so targeted defense strategies are required to deal with them.

[0040] To achieve this, the system calls a pre-built defense policy library. The defense policy library stores pre-defined defense policies for different types of security threats. These policies are based on the summary and optimization of a large amount of historical attack data and defense experience, covering a variety of defense methods, such as attack detection, traffic cleaning, security isolation and countermeasures.

[0041] In specific implementation, the system first selects the corresponding defense strategy from the defense strategy library according to the type of security threat detected. For example, for DDoS attacks, the defense strategy may include detection and identification of attack traffic, cleaning and filtering of malicious traffic, and location and countermeasures of the attack source. For data leakage, the defense strategy may include abnormal access detection, encryption of sensitive data and access control measures.

[0042] After selecting a defense strategy, the system will refine and adjust the defense strategy based on the current network status and resource conditions. For example, the system will adjust the specific parameters of traffic cleaning and attack detection based on the current network traffic load and node computing resources to ensure that the defense measures can be efficiently executed in the current environment.

[0043] S102: Obtain node characteristics of each edge computing node in the edge computing node resource pool.

[0044] The edge computing node resource pool is a collection of resources that contains multiple edge computing nodes. This resource pool can dynamically allocate and manage these nodes to meet different computing needs and workloads.

[0045] Edge computing nodes are computing devices or servers deployed at the edge of the network. These nodes are close to data sources and end users and can provide low-latency, high-bandwidth computing and storage services.

[0046] In one example, first, the system calls the management interface of the edge computing node resource pool to obtain the real-time status data of each node. These status data include but are not limited to CPU utilization, memory usage, storage capacity, network bandwidth, node geographic location, and current load. The ways to obtain this data usually include node monitoring systems, resource management platforms, and network management tools. The system uses these tools to collect and summarize the feature data of each node in real time to form a node feature database.

[0047] After obtaining the node characteristics, the system will analyze and process these data. Based on the computing power of the node, the system can evaluate the performance of each node when executing complex computing tasks; through storage capacity information, the system can determine whether the node has enough space to store temporary data or log files; network bandwidth analysis helps the system determine the node's carrying capacity in large-scale data transmission; geographic location information is used to optimize task allocation, reduce latency, and improve response speed.

[0048] By fully understanding the characteristics of each edge computing node, the system can calculate the performance index of each node and set the performance threshold of the defense task according to actual needs. The calculation of the performance index is usually based on a multi-factor weighted algorithm, taking into account factors such as the computing power, storage capacity, network bandwidth and geographical location of each node to generate a comprehensive score. After setting the performance threshold, the system will screen out nodes with a performance index higher than the threshold as candidate nodes, and further determine the final target node based on factors such as geographical location.

[0049] S103, selecting multiple edge computing nodes from an edge computing node resource pool according to node characteristics of each edge computing node and the type of security threat, to obtain multiple target edge computing nodes.

[0050] In one example, the system will classify and analyze the types of security threats currently detected. The types of security threats may include DDoS attacks, data leaks, malware propagation, network intrusions, etc. Each type of threat has different requirements for computing resources, storage requirements, and response time. The system determines the specific resources and performance indicators required for the defense task based on the characteristics of the threat type. Node characteristics refer to the various attributes and capabilities of edge computing nodes, which determine the performance and efficiency of the nodes when performing computing tasks.

[0051] Then, the node feature database obtained in step S102 is called to match the current security threat type. The matching process includes calculating the performance index of each edge computing node and screening the edge computing nodes in combination with the specific performance requirements required by the threat type. The system uses a multi-factor weighted algorithm to comprehensively consider the node's computing power, storage capacity, network bandwidth, geographical location, and current load conditions, score each node, and set performance thresholds for specific threat types.

[0052] During the screening process, nodes with performance indexes higher than the threshold of a specific threat type are given priority. To ensure efficient execution of defense tasks, the system will also optimize selection based on geographic location, selecting nodes closer to the threat location to reduce latency and increase response speed. At the same time, the system will consider load balancing to avoid overloading certain nodes and ensure that defense tasks can be reasonably distributed among multiple nodes.

[0053] Once the qualified nodes are screened, the system will generate a list of candidate nodes. In order to further optimize the defense effect, these candidate nodes are screened again to determine the final target edge computing nodes. The secondary screening is mainly based on real-time monitoring data, taking into account the current status and performance fluctuations of the nodes to ensure that the selected target nodes can operate stably and efficiently when performing defense tasks.

[0054] Based on the above embodiment, as an optional implementation, in S103, the node characteristics include computing power, storage capacity, network bandwidth and geographical location. According to the node characteristics of each edge computing node and the type of security threat, selecting multiple edge computing nodes from the edge computing node resource pool specifically includes the following steps S30-S33: S30, determining a performance index of each edge computing node according to the computing power, storage capacity, and network bandwidth of each edge computing node.

[0055] In an example, we first need to identify the key performance indicators of each edge computing node, which include computing power, storage capacity, and network bandwidth. Computing power is usually measured by the performance parameters of the CPU and GPU (such as the number of cores, main frequency, floating-point computing power, etc.); storage capacity includes the node's memory capacity and hard disk storage space; and network bandwidth refers to the node's network connection speed and data transmission capacity.

[0056] In order to determine the performance index of each edge computing node, the system needs to standardize these key performance indicators so that the performance of different nodes can be comprehensively compared. Standardization can use normalization methods to convert different indicators into dimensionless standardized values ​​so that each indicator can be weighted and summed.

[0057] The system first collects real-time data on the computing power, storage capacity, and network bandwidth of each edge computing node. It converts them into standardized values ​​through normalization. Then, in order to reflect the impact of each indicator on the overall performance, the system assigns a weight to each standardized indicator.

[0058] Next, the performance index of each node is calculated by weighted summation. This process weights the standardized computing power, storage capacity, and network bandwidth according to their respective weights to obtain an index value that comprehensively evaluates the performance of each node. The higher the performance index, the stronger the overall performance of the node, and the more suitable it is for undertaking more or more complex computing tasks.

[0059] Based on the above embodiment, as an optional implementation, in S30, according to the computing power, storage capacity and network bandwidth of each edge computing node, determining the performance index of each edge computing node specifically includes: Obtain the computing power parameters, storage capacity parameters and network bandwidth parameters of each edge computing node; substitute the computing power parameters, storage capacity parameters and network bandwidth parameters of each edge computing node into the performance index calculation formula to determine the performance index of each edge computing node; wherein the performance index calculation formula is: In the formula, PI i is the performance index of the ith edge computing node, c i is the computing power parameter of the ith edge computing node, c min is the minimum value of the computing power parameters of all edge computing nodes, c max is the maximum value of the computing power parameters of all edge computing nodes, s i is the storage capacity parameter of the i-th edge computing node, s min is the minimum value of the storage capacity parameters of all edge computing nodes, s max is the maximum value of the storage capacity parameters of all edge computing nodes, b i is the network bandwidth parameter of the ith edge computing node, b min is the minimum value of the network bandwidth parameters of all edge computing nodes, b max is the maximum value of the network bandwidth parameters of all edge computing nodes, ω c ,ω s and b are all weight coefficients.

[0060] In one example, in order to determine the computing power parameters, storage capacity parameters and network bandwidth parameters of each edge computing node, the performance indicators of these nodes can be scored. First, the raw data of each node is collected, including information such as the number of CPU cores, memory capacity, disk capacity and network bandwidth. Then, these data are standardized to ensure that different indicators can be compared uniformly. Then, based on the standardized data, the indicators are weighted and summed using the preset weights to calculate the comprehensive score of each node. Finally, according to the score, the computing power, storage capacity and network bandwidth of the node are divided into different levels (such as high, medium and low) to clarify the specific performance parameters of each node.

[0061] The purpose of this formula design is to normalize different parameters so that they can be converted into dimensionless standardized values ​​so that different performance indicators can be compared on the same scale. In this way, the system can comprehensively evaluate the performance of each edge computing node.

[0062] pass and Normalizing computing power, storage capacity, and network bandwidth can eliminate the dimensional differences of different indicators and ensure that these indicators can be compared on the same scale.

[0063] This formula combines three key indicators: computing power, storage capacity, and network bandwidth, to provide a comprehensive evaluation indicator. Through standardization, indicators of different dimensions are converted into relative values ​​to ensure that the contribution of each indicator to the comprehensive score is comparable, avoiding score distortion caused by different dimensions. Using maximum and minimum values ​​for standardization makes the score relative, reflecting the relative position of each node among all nodes, rather than the absolute performance value, so as to adapt to edge computing networks of different scales and configurations. By adjusting the weights, it can adapt to the needs of different scenarios. By setting the weight coefficient ω c ,ω s and ω b , the system can adjust the relative importance of each performance indicator according to actual needs. For example, in some application scenarios, computing power may be more important than storage capacity, so you can set ω c Larger, ω s The setting of weight coefficient enables the system to be flexibly adjusted to meet the needs of different tasks and application scenarios. S31, determining a performance threshold of an edge computing node for defending against security threats according to the attack traffic size of the security threats.

[0064] In one example, the attack traffic size of the security threat first needs to be accurately measured and analyzed. The size of the attack traffic is usually expressed in terms of the amount of data transmitted per second (such as Gbps or Tbps), which directly reflects the intensity and scale of the attack. Through real-time monitoring and historical data analysis, the system can determine the attack traffic size of the current security threat.

[0065] Next, the system needs to match the attack traffic size with the performance indicators of the edge computing nodes. To achieve this, the system sets a performance threshold based on the size of the attack traffic, which is used to select edge computing nodes that have sufficient resources to handle the attack traffic. The setting of the performance threshold requires comprehensive consideration of three indicators: computing power, storage capacity, and network bandwidth. For example, for a large-scale DDoS attack, the system may need to select nodes with strong computing power, large storage capacity, and high network bandwidth.

[0066] When setting the performance threshold, the system will refer to the performance index of each node calculated in the previous step. The performance index is a comprehensive evaluation of each edge computing node, reflecting the comprehensive performance of the node in terms of computing power, storage capacity, and network bandwidth. The system will set a minimum performance index as a threshold based on the size of the attack traffic, that is, only nodes with a performance index higher than the threshold will be selected for defense against security threats.

[0067] Specifically, the system will first determine a reasonable performance threshold based on the current attack traffic size. For example, if the attack traffic is 100Gbps, the system may set a performance threshold that requires the node's performance index to be at least 80. Then, the system will screen out all nodes with a performance index higher than 80 and select several of the most suitable nodes to perform defense tasks.

[0068] In this way, the system can ensure that the selected edge computing nodes have sufficient resources to handle the current attack traffic, avoiding defense failures due to insufficient resources. In addition, the dynamic adjustment of performance thresholds enables the system to respond in a timely manner according to changes in attack traffic, improving the flexibility and effectiveness of defense measures.

[0069] S32: Take the edge computing nodes whose performance index is higher than the performance threshold as candidate edge computing nodes.

[0070] S33, obtaining the geographical location of each candidate edge computing node, and selecting multiple edge computing nodes from the candidate edge computing nodes as target edge computing nodes according to the geographical location of each candidate edge computing node.

[0071] In one example, the geographic location information of all candidate edge computing nodes needs to be obtained first. This information usually includes the node's latitude and longitude data, network location (such as IP address), and possible regional identification. With this geographic location information, the system can accurately locate the location of each candidate node.

[0072] Once the geographic location information is obtained, the system needs to filter it according to the geographic requirements of the task. Assuming that the task needs to provide services in a specific area, the system will give priority to the edge computing nodes closest to the area to reduce the delay of data transmission. To achieve this, the system calculates the distance between each candidate node and the target area, usually using the earth distance formula or network measurement-based methods to determine the physical distance or network distance.

[0073] After determining the distance, the system will sort by distance and select several nodes that meet the conditions as the target edge computing nodes. Selecting multiple nodes can provide redundancy and load balancing, ensuring that when a node fails, other nodes can quickly take over the task.

[0074] When selecting target edge computing nodes, the system also considers other factors, such as the node's performance index, current load, and network bandwidth. Although geographic location is the primary consideration, a comprehensive evaluation of these factors can further optimize node selection and ensure service stability and efficiency. For example, although a node has a good geographic location, if its current load is too high, the system may choose a suboptimal node to ensure service quality.

[0075] S104, assigning a defense task to each target edge computing node in combination with the defense strategy and the node status of each target edge computing node.

[0076] In one example, the system first determines the defense strategy that needs to be executed. The defense strategy is a specific defense measure based on the security threat type, threat level, and current network status. The defense strategy may include traffic filtering, attack source tracing, malware detection and isolation, data encryption, etc. These strategies specify the specific content and execution requirements of the defense task.

[0077] Next, the system will obtain the node status information of each target edge computing node. This node status information includes the real-time utilization of computing power, storage space usage, current load of network bandwidth, node response time, and security status. This data is usually updated in real time through the node monitoring system to reflect the real-time performance and resource usage of the node.

[0078] After clarifying the defense strategy and node status, the system will allocate defense tasks. During the task allocation process, the system will comprehensively consider the current status of each target node and the needs of the defense strategy to determine the optimal task allocation plan. Specifically, the system will allocate tasks according to the following logic: The system will give priority to nodes with sufficient computing power and low current load to perform computing-intensive defense tasks. For example, when performing complex data analysis and attack tracing, the system will assign these tasks to nodes with strong computing power to ensure that the tasks can be completed quickly and efficiently.

[0079] Second, for defense tasks that require a lot of storage space, such as logging and data backup, the system will select nodes with sufficient storage capacity and low current storage usage. This can avoid task failure or performance degradation due to insufficient storage resources.

[0080] For tasks that require high-speed data transmission, such as traffic filtering and real-time monitoring, the system will select nodes with sufficient network bandwidth and low current network load. This allocation can reduce data transmission delays and improve the real-time performance and response speed of defense tasks.

[0081] In addition, the system will also comprehensively consider the geographical location and security factors of the nodes. For defense tasks that require a quick response, the system will give priority to nodes that are geographically close to the threat source or user end to reduce network latency and response time. At the same time, for defense tasks involving sensitive data, the system will select nodes with high security to ensure data security and protection capabilities.

[0082] Based on the above embodiment, as an optional implementation, in S104, the node status includes the defense resource occupancy rate and the defense task execution progress. In combination with the defense strategy and the node status of each target edge computing node, the defense task is assigned to each target edge computing node, specifically including S40-S43: S40, obtaining the defense resource occupancy rate and defense task execution progress of each target edge computing node.

[0083] In one example, the defense resource utilization rate refers to the proportion of resources used by a node for security protection (such as firewalls, intrusion detection systems, etc.). This indicator reflects the resource load required by the node when performing defense tasks. The defense task execution progress refers to the completion of the current defense task, usually expressed as a percentage. The reason for obtaining this data is that nodes with high defense resource utilization rates may not be able to bear additional computing tasks, while nodes with low defense task execution progress may need more time to complete defense tasks, affecting their ability to handle other tasks.

[0084] During the specific implementation process, the defense resource occupancy rate and defense task execution progress of each node can be collected in real time through the monitoring system. These data are usually provided by the security management module inside the node, which can record and report the resource usage and progress of the defense task. In order to standardize these data, the defense resource occupancy rate and defense task execution progress are normalized and converted into relative values ​​between 0 and 1, so that they can be comprehensively evaluated together with indicators such as computing power, storage capacity and network bandwidth.

[0085] Next, the defense resource occupancy rate and defense task execution progress are incorporated into the comprehensive scoring system. By introducing new consideration dimensions, the actual capacity and load of each node can be more comprehensively evaluated. If the defense resource occupancy rate of a node is too high, or the defense task execution progress is low, the system can consider reducing the task allocation weight of the node to avoid performance degradation or security risks caused by resource overload or unfinished defense tasks. At the same time, such a comprehensive scoring system can be adjusted dynamically to reflect changes in node status in real time, thereby improving the flexibility and response speed of resource allocation.

[0086] S41, determine the priority of various defense tasks based on the defense strategy.

[0087] In one example, it is necessary to clarify the priorities of various defense tasks based on the established defense strategy. Defense strategies usually include response plans and countermeasures for different types of threats, such as firewall rule updates, intrusion detection system monitoring, malicious traffic filtering, etc. The priority of tasks is determined by factors such as the severity of the threat, potential impact, and urgency of resolution. High-priority tasks are usually those that have a significant impact on system security and need to be handled immediately, while low-priority tasks can be carried out after urgent tasks are completed.

[0088] In the specific implementation process, all defense tasks need to be classified first, and each type of task needs to be assigned a priority according to the defense strategy. The priority of each defense task can be expressed as a level or a value. The higher the value, the higher the priority. Then, the system needs to monitor the defense task execution progress and defense resource occupancy rate of each node in real time, and assign high-priority tasks to nodes with sufficient resources and good execution progress, so as to ensure that these tasks can be completed quickly and effectively.

[0089] In order to better manage and schedule these tasks, the system can use task queues to organize defense tasks. High-priority tasks enter the high-priority queue, and low-priority tasks enter the low-priority queue. The task scheduler dynamically adjusts the allocation of tasks based on the priority of tasks in the queue and the current status of each node.

[0090] S42, selecting a first edge computing node whose defense resource occupancy rate is lower than a preset threshold and whose defense task execution progress is the fastest from the target edge computing nodes, and assigning the highest priority defense task to the first edge computing node.

[0091] In one example, a preset threshold for defense resource utilization needs to be set. This threshold reflects the resource utilization of nodes on security protection tasks and avoids assigning new tasks to nodes that are already overloaded. Next, the system needs to monitor the defense resource utilization and defense task execution progress of each node in real time. Nodes with defense resource utilization below the preset threshold are considered to have sufficient resources to handle new defense tasks, while nodes with the fastest defense task execution progress indicate that they are more efficient in handling existing tasks.

[0092] In the specific implementation process, the defense resource occupancy rate and defense task execution progress data of all target edge computing nodes are first obtained through the monitoring system. Then, the nodes whose defense resource occupancy rate is lower than the preset threshold are screened out. Among these nodes, the defense task execution progress is further compared, and the node with the fastest execution progress is selected, which is called the first edge computing node.

[0093] Next, the highest priority defense task is assigned to this first edge computing node. The highest priority defense task is usually the task that has the greatest impact on system security and needs to be processed immediately. By assigning it to a node with sufficient resources and high processing efficiency, it can ensure that the task can be started quickly and completed efficiently.

[0094] S43, select a second edge computing node whose defense resource occupancy rate is lower than a preset threshold and whose defense task execution progress is the fastest from the remaining target edge computing nodes, and assign the defense task with the second highest priority to the second edge computing node until all defense tasks in the defense strategy are assigned.

[0095] In one example, after completing the task assignment of the first edge computing node, continue to screen nodes whose defense resource occupancy rate is lower than the preset threshold from the remaining target nodes. Then, select the node with the fastest defense task execution progress among these nodes, which is called the second edge computing node. Assign the defense task with the second highest priority to the second edge computing node. In this way, select qualified nodes from the remaining nodes in turn, and assign all defense tasks in the defense strategy one by one according to priority until all tasks are assigned.

[0096] Based on the above embodiment, as an optional implementation, after assigning a defense task to each target edge computing node in S104, the following steps are further included: S50, obtaining real-time load parameters of each target edge computing node.

[0097] S51, determining whether the real-time load parameter of each target edge computing node exceeds a predetermined load threshold.

[0098] S52: If the real-time load parameter of an abnormal target edge computing node exceeds a predetermined load threshold, one or more edge computing nodes are selected from the edge computing node resource pool, and part of the defense tasks on the abnormal target edge computing node are transferred to one or more edge computing nodes to achieve load balancing of each target edge computing node.

[0099] In one example, the system continuously monitors the real-time load parameters of all edge computing nodes, including CPU usage, memory usage, and network bandwidth. When the load parameters of a target edge computing node are found to exceed a predetermined load threshold, the node is marked as an abnormal target edge computing node. This real-time monitoring and threshold judgment mechanism is designed to prevent a single node from being overloaded, thereby affecting its performance and the overall stability of the system.

[0100] Next, one or more lightly loaded edge computing nodes are selected from the edge computing node resource pool. The selection criteria for these nodes include defense resource occupancy rate below the preset threshold and high defense task execution progress to ensure that they have the ability to receive and process new defense tasks. The selected nodes are considered as candidate nodes that can share the load of the abnormal target edge computing node.

[0101] Then, the system transfers part of the defense tasks on the abnormal target edge computing node to these candidate edge computing nodes. The task transfer process needs to consider the priority and urgency of the task, and prioritize the transfer of low-priority or resource-intensive tasks to quickly reduce the load on the abnormal node. At the same time, ensure that the execution of the transferred tasks is not affected to maintain the system's defense capability and response speed.

[0102] After assigning defense tasks to each target edge computing node, it also includes: Obtain the defense task execution results and updated node status of each target edge computing node; Determine whether the security threat has been successfully defended based on the defense task execution results of each target edge computing node; If the security threat is not successfully defended, the defense strategy is adjusted according to the updated node status of each target edge computing node to obtain an adjusted defense strategy; According to the adjusted defense strategy, at least one new target edge computing node is selected from the edge computing node resource pool, and the unfinished defense tasks are assigned to the new target edge computing node and the original target edge computing node until the security threat is successfully defended.

[0103] In one example, based on the defense task execution results of each target edge computing node, the system determines whether the security threat has been successfully defended. If the defense task execution results show that the security threat has been successfully eliminated, the defense task can be marked as completed and the system returns to normal monitoring status. However, if the defense task execution results show that the security threat still exists, further measures need to be taken.

[0104] If the security threat is not successfully defended, the system adjusts the defense strategy based on the updated node status of each target edge computing node. The purpose of adjusting the defense strategy is to optimize resource allocation and task scheduling to enhance the defense effect. The adjusted defense strategy will take into account the current node load, the priority and urgency of the defense task, and ensure that the new strategy can more effectively respond to unresolved security threats.

[0105] According to the adjusted defense strategy, the system selects at least one new target edge computing node from the edge computing node resource pool. These newly selected nodes must meet the requirements of defense resource occupancy rate below the preset threshold and high defense task execution progress to ensure that they are capable of receiving and processing unfinished defense tasks. Then, the system reallocates the unfinished defense tasks to the new target edge computing nodes and the original target edge computing nodes, and continues to execute the tasks until the security threat is successfully defended.

[0106] Based on the above method, the present application also discloses a network security dynamic defense device for edge computing, such as Figure 2 As shown, Figure 2 It is a structural diagram of an edge computing network security dynamic defense device provided in an embodiment of the present application.

[0107] A network security dynamic defense device for edge computing includes: a detection module, an acquisition module, a selection module and an output module; wherein the detection module is used to generate a defense strategy according to the type of security threat when a security threat is detected in the core network; the acquisition module is used to obtain the node characteristics of each edge computing node in the edge computing node resource pool; the selection module is used to select multiple edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of security threat to obtain multiple target edge computing nodes; the combination module is used to combine the defense strategy with the node status of each target edge computing node to assign a defense task to each target edge computing node.

[0108] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0109] See also Figure 3 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 3 As shown, the electronic device 1000 may include: at least one processor 1001 , at least one network interface 1004 , a user interface 1003 , a memory 1005 , and at least one communication bus 1002 .

[0110] The communication bus 1002 is used to realize the connection and communication between these components.

[0111] The user interface 1003 may include a display screen (Display) and a camera (Camera), and the optional user interface 1003 may also include a standard wired interface and a wireless interface.

[0112] The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0113] Among them, the processor 1001 may include one or more processing cores. The processor 1001 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 1005, and calling data stored in the memory 1005. Optionally, the processor 1001 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 1001 can integrate one or more combinations of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 1001, and it can be implemented separately through a chip.

[0114] Among them, the memory 1005 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 1005 includes a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1005 may optionally be at least one storage device located away from the aforementioned processor 1001. As Figure 3 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program of a network security dynamic defense method based on edge computing.

[0115] exist Figure 3 In the electronic device 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 1001 can be used to call an application stored in the memory 1005 that stores a network security dynamic defense method based on edge computing. When executed by one or more processors, the electronic device executes one or more methods described in the above embodiments.

[0116] An electronic device readable storage medium stores instructions, which, when executed by one or more processors, enable the electronic device to execute one or more of the methods described in the above embodiments.

[0117] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0118] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0119] In the several embodiments provided in the present application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0123] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of other embodiments of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are only regarded as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A network security dynamic defense method based on edge computing, characterized in that: The method comprises: When a security threat is detected in the core network, a defense strategy is generated according to the type of the security threat; Obtain node characteristics of each edge computing node in the edge computing node resource pool; According to the node characteristics of each edge computing node and the type of the security threat, multiple edge computing nodes are selected from the edge computing node resource pool to obtain multiple target edge computing nodes; In combination with the defense strategy and the node status of each of the target edge computing nodes, a defense task is assigned to each of the target edge computing nodes.

2. The network security dynamic defense method based on edge computing according to claim 1 is characterized in that: Generate a defense strategy based on the type of security threat, including: According to the type of the security threat, a defense strategy corresponding to the type of the security threat is selected from a defense strategy library, and the defense strategy includes at least one of attack detection, traffic cleaning, security isolation and countermeasures.

3. The network security dynamic defense method based on edge computing according to claim 1 is characterized in that: The node characteristics include computing power, storage capacity, network bandwidth and geographical location. The selecting of multiple edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of security threat includes: Determining a performance index of each edge computing node according to the computing capability, storage capacity, and network bandwidth of each edge computing node; Determine, according to the attack traffic size of the security threat, a performance threshold of the edge computing node for defending against the security threat; and use the edge computing node whose performance index is higher than the performance threshold as a candidate edge computing node; The geographic location of each of the candidate edge computing nodes is obtained, and according to the geographic location of each of the candidate edge computing nodes, multiple edge computing nodes are selected from the candidate edge computing nodes as target edge computing nodes.

4. The network security dynamic defense method based on edge computing according to claim 3 is characterized in that: The determining, according to the computing capability, the storage capacity, and the network bandwidth of each edge computing node, a performance index of each edge computing node includes: Obtaining computing power parameters, storage capacity parameters, and network bandwidth parameters of each of the edge computing nodes; Substituting the computing power parameters, storage capacity parameters and network bandwidth parameters of each edge computing node into the performance index calculation formula to determine the performance index of each edge computing node; wherein, The performance index calculation formula is: In the formula, PI i is the performance index of the ith edge computing node, c i is the computing power parameter of the ith edge computing node, c min is the minimum value of the computing power parameters of all edge computing nodes, c max is the maximum value of the computing power parameters of all edge computing nodes, s i is the storage capacity parameter of the i-th edge computing node, s min is the minimum value of the storage capacity parameters of all edge computing nodes, s max is the maximum value of the storage capacity parameters of all edge computing nodes, b i is the network bandwidth parameter of the ith edge computing node, b min is the minimum value of the network bandwidth parameters of all edge computing nodes, b max is the maximum value of the network bandwidth parameters of all edge computing nodes, ω c ,ω s and b are all weight coefficients.

5. The network security dynamic defense method based on edge computing according to claim 1 is characterized in that: The node status includes a defense resource occupancy rate and a defense task execution progress, and the defense strategy and the node status of each target edge computing node are combined to assign a defense task to each target edge computing node, including: Obtaining the defense resource occupancy rate and the defense task execution progress of each of the target edge computing nodes; Determine the priority of various defense tasks according to the defense strategy; Selecting a first edge computing node from the target edge computing node whose defense resource occupancy rate is lower than a preset threshold and whose defense task execution progress is the fastest, and assigning the highest priority defense task to the first edge computing node; A second edge computing node whose defense resource occupancy rate is lower than the preset threshold and whose defense task execution progress is the fastest is selected from the remaining target edge computing nodes, and the defense task with the second highest priority is assigned to the second edge computing node until all defense tasks in the defense strategy are assigned.

6. The network security dynamic defense method based on edge computing according to claim 1 is characterized in that: After assigning the defense task to each of the target edge computing nodes, the method further includes: Obtaining real-time load parameters of each target edge computing node; Determining whether the real-time load parameter of each of the target edge computing nodes exceeds a predetermined load threshold; If the real-time load parameter of an abnormal target edge computing node exceeds the predetermined load threshold, one or more edge computing nodes are selected from the edge computing node resource pool, and part of the defense tasks on the abnormal target edge computing node are transferred to the one or more edge computing nodes to achieve load balancing of each of the target edge computing nodes.

7. The network security dynamic defense method based on edge computing according to claim 1 is characterized in that: After assigning the defense task to each of the target edge computing nodes, the method further includes: Obtaining the defense task execution results and updated node status of each target edge computing node; Determining whether the security threat has been successfully defended according to the defense task execution result of each target edge computing node; If the security threat is not successfully defended, adjusting the defense strategy according to the updated node status of each target edge computing node to obtain an adjusted defense strategy; According to the adjusted defense strategy, at least one new target edge computing node is selected from the edge computing node resource pool, and unfinished defense tasks are assigned to the new target edge computing node and the original target edge computing node until the security threat is successfully defended.

8. A network security dynamic defense device for edge computing, characterized in that: The device comprises: a detection module, an acquisition module, a selection module and an output module; wherein, The detection module is used to generate a defense strategy according to the type of security threat when a security threat is detected in the core network; The acquisition module is used to acquire node characteristics of each edge computing node in the edge computing node resource pool; The selection module is used to select multiple edge computing nodes from the edge computing node resource pool according to the node characteristics of each edge computing node and the type of the security threat, so as to obtain multiple target edge computing nodes; The combining module is used to combine the defense strategy and the node status of each target edge computing node to assign a defense task to each target edge computing node.

9. An electronic device, characterized in that: It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 7.

Images