Container-based cluster security management method and system

Abstract

The invention belongs to the technical field of security management, and discloses a container-based cluster security management method and system. The method comprises the following steps: carrying out key generation and identity authentication based on a trusted mechanism; the method comprises the following steps: constructing an intrusion attack detection model, an access attack detection model, a protection strategy generation model, a container resource scheduling model and a Hfish honeypot chain network based on a cloud platform; encrypting and signing the real-time access request data based on the user terminal, and uploading the real-time access request data to the cloud platform; performing signature verification and decryption on the encrypted real-time access request data based on a cloud platform; intrusion attack detection is carried out based on a cloud platform; collecting real-time access flow data, and carrying out access attack detection; performing protection strategy generation and container resource scheduling; and based on the container cluster after resource scheduling, executing the adjusted real-time protection strategy. According to the invention, the problems of poor detection accuracy, poor safety management comprehensiveness, poor effect and low protection level in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of security management, and in particular relates to a container-based cluster security management method and system. Background Art

[0002] In recent years, with the rapid development of cloud computing and the popularization of the concept of "cloud native", more and more enterprises choose to deploy applications and services in lightweight and fast cloud containers to complete the migration to cloud platforms. At the same time, the scale of deployment is on a continuous growth trend, and container clusters built by several containers are increasingly widely used in cloud platforms. However, container clusters face many security challenges during operation, including the following defects:

[0003] 1) Existing container cluster security management technologies cannot accurately detect unknown attacks in the first place when faced with evolving attack methods, resulting in poor attack detection accuracy on cloud platforms;

[0004] 2) Existing container cluster security management technologies only implement static attack detection, with poor security management comprehensiveness and effectiveness;

[0005] 3) Existing security management technologies for container clusters rely on preset rules for security protection, with a low level of protection and a lack of adaptive security protection strategy generation capabilities. Summary of the invention

[0006] In order to solve the problems of poor detection accuracy, poor comprehensiveness of security management, poor effect and low protection level in the prior art, the present invention aims to provide a container-based cluster security management method and system.

[0007] The technical solution adopted by the present invention is:

[0008] A container-based cluster security management method includes the following steps:

[0009] Based on the trusted institution, all user terminals connected to the cloud platform are key-generated and authenticated, and the public-private key pair and signature information of each user terminal are obtained. The private key and signature information in the public-private key pair are returned to the corresponding user terminal, and the public key in the public-private key pair is published to the cloud platform.

[0010] Based on the cloud platform, we build intrusion attack detection models, access attack detection models, protection strategy generation models, and container resource scheduling models. According to the basic container information of each container in the container cluster, we build the corresponding Hfish honeypot, and based on several Hfish honeypots, we build an Hfish honeypot chain network.

[0011] Based on the user terminal, the real-time access request data is encrypted according to the private key to obtain the encrypted real-time access request data, the encrypted real-time access request data is signed according to the signature information to obtain the real-time signature data, and the encrypted real-time access request data and the real-time signature data are uploaded to the cloud platform;

[0012] Based on the cloud platform, a trusted institution is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data;

[0013] Based on the cloud platform, according to the decrypted real-time access request data, the intrusion attack detection model is used to perform intrusion attack detection and obtain the real-time intrusion attack detection result. If the real-time intrusion attack detection result shows that an intrusion attack exists, the protection strategy generation step is entered; otherwise, the access rights of the user terminal are opened and the next step is entered;

[0014] Based on the cloud platform, the Hfish honeypot chain network is used to collect the real-time access traffic data of the user terminal. According to the real-time access traffic data, the access attack detection model is used to perform access attack detection and obtain the real-time access attack detection result. If the real-time access attack detection result is that there is an access attack, the protection strategy generation step is entered, otherwise, the next user terminal access is waited for;

[0015] Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the protection strategy generation model is used to generate the protection strategy to obtain the real-time protection strategy. According to the real-time protection strategy, the container resource scheduling model is used to schedule the container resources to obtain the real-time container resource scheduling solution.

[0016] Based on the cloud platform, the real-time protection strategy is adjusted and container resources are scheduled for the container cluster according to the real-time container resource scheduling plan to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling, and the adjusted real-time protection strategy is executed based on the container cluster after resource scheduling.

[0017] Furthermore, based on the cloud platform, an intrusion attack detection model, an access attack detection model, a protection strategy generation model, and a container resource scheduling model are constructed. According to the basic container information of each container in the container cluster, a corresponding Hfish honeypot is constructed, and based on several Hfish honeypots, an Hfish honeypot chain network is constructed, including the following steps:

[0018] Based on the cloud platform, a number of historical access request data and a number of historical access flow data are collected, and pre-processed respectively to obtain a number of pre-processed historical access request data and a number of pre-processed historical access flow data;

[0019] Based on some pre-processed historical access request data, a deep learning algorithm is used to build an intrusion attack detection model and generate some historical intrusion attack detection results;

[0020] Based on some pre-processed historical access traffic data, a deep learning algorithm is used to build an access attack detection model and generate some historical access attack detection results;

[0021] Based on several historical intrusion attack detection results and several historical access attack detection results, a protection strategy generation model is constructed using a reinforcement learning algorithm to generate several historical protection strategies and several historical protection strategy generation experiences, and the historical protection strategy generation experiences are stored in the experience playback pool of the protection strategy generation model;

[0022] Based on several historical protection strategies, a fusion algorithm is used to build a container resource scheduling model;

[0023] Set up the Hfish honeypot management node, collect the basic container information of each container in the container cluster, retrieve the corresponding container image, obtain the matching container image, and generate the corresponding honeypot element based on the matching container image;

[0024] According to the honeypot elements, the corresponding Hfish honeypot is constructed, the traffic probe is set in the Hfish honeypot, all Hfish honeypots are distributed, each Hfish honeypot is connected to the Hfish honeypot management node to obtain the Hfish honeypot chain network, and a firewall is set between the Hfish honeypot chain network and the container cluster.

[0025] Furthermore, the intrusion attack detection model is constructed based on the RF-Attention-BiLSTM algorithm.

[0026] Furthermore, the access attack detection model is built based on the N-GAN-Attention-BiLSTM algorithm.

[0027] Furthermore, the protection strategy generation model is built based on the DQN algorithm;

[0028] The container resource scheduling model is built based on the BiLSTM-IFWA algorithm.

[0029] Furthermore, based on the cloud platform, according to the decrypted real-time access request data, an intrusion attack detection model is used to perform intrusion attack detection to obtain a real-time intrusion attack detection result. If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered. Otherwise, the access rights of the user terminal are opened and the next step is entered, which includes the following steps:

[0030] Based on the cloud platform, the decrypted real-time access request data is input into the intrusion attack detection model to extract M real-time key features of the decrypted real-time access request data, where M is the total number of key features;

[0031] According to the preset first attention weight, the M real-time key features are spliced ​​to obtain a first real-time spliced ​​feature;

[0032] Perform intrusion attack detection according to the first real-time splicing feature to obtain a real-time intrusion attack detection result;

[0033] If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered; otherwise, the access rights of the user terminal are opened and the access attack detection step is entered.

[0034] Furthermore, based on the cloud platform, the Hfish honeypot chain network is used to collect the real-time access traffic data of the user terminal. According to the real-time access traffic data, the access attack detection model is used to perform access attack detection to obtain the real-time access attack detection result. If the real-time access attack detection result is that there is an access attack, the protection strategy generation step is entered. Otherwise, the next user terminal access is waited for, including the following steps:

[0035] Based on the cloud platform, the traffic probe of Hfish honeypot chain network is used to collect the real-time access traffic data of user terminals accessing Hfish honeypot, and send the real-time access traffic data to the Hfish honeypot management node;

[0036] Based on the Hfish honeypot management node, the real-time access traffic data is input into the access attack detection model to extract the real-time dimension features of the real-time access traffic data in N key dimensions, where N is the total number of key dimensions;

[0037] According to the preset second attention weight, N real-time dimension features are spliced ​​to obtain a second real-time spliced ​​feature;

[0038] Perform access attack detection according to the second real-time splicing feature to obtain a real-time access attack detection result;

[0039] If the real-time access attack detection result is that there is an access attack, the protection strategy generation step is entered, otherwise, the next user terminal access is waited for.

[0040] Furthermore, based on the cloud platform, according to the real-time intrusion attack detection result or the real-time access attack detection result, a protection strategy generation model is used to generate a protection strategy to obtain a real-time protection strategy, and according to the real-time protection strategy, a container resource scheduling model is used to schedule container resources to obtain a real-time container resource scheduling solution, including the following steps:

[0041] Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the action space and state space of the protection strategy generation model are updated to obtain the updated action space and the updated state space;

[0042] Use the updated state space as the input of the deep Q network and use the agent to generate the Q value of each possible action in the updated action space;

[0043] Use the reward function to obtain the reward value of each possible action in the updated action space, and update the Q value of the possible action according to the reward value to obtain the updated Q value of each possible action;

[0044] Repeat the above Q value update until the predetermined number of iterations is reached, and use the greedy strategy to select the possible action with the highest updated Q value in each iteration as the execution action, and generate a protection strategy based on several execution actions to obtain a real-time protection strategy;

[0045] The real-time protection strategy is input into the container resource scheduling model to perform resource demand prediction and obtain the real-time resource demand prediction result;

[0046] According to the real-time resource demand prediction results, an objective function is set, and based on the objective function, container resources are scheduled to obtain a real-time container resource scheduling solution.

[0047] Furthermore, according to the real-time resource demand prediction result, an objective function is set, and based on the objective function, container resource scheduling is performed to obtain a real-time container resource scheduling solution, including the following steps:

[0048] Setting an objective function according to the resource demand index, action priority index, and impact range index included in the real-time resource demand prediction result;

[0049] Initialize the container resource scheduling scheme, generate several initial solutions, and use the objective function as the fitness function of the initial solution;

[0050] Based on the fitness function, several initial solutions are iteratively optimized to reach a predetermined number of iterations to obtain the optimal solution, and based on the optimal solution, a real-time container resource scheduling solution is obtained.

[0051] A container-based cluster security management system is used to implement a cluster security management method. The system includes a cloud platform, a trusted organization and several user terminals. The cloud platform and the trusted organization are respectively connected to the several user terminals in communication. An intrusion attack detection model, an access attack detection model, a protection strategy generation model and a container resource scheduling model are provided in the container cluster of the cloud platform. The trusted organization is also connected to the cloud platform in communication.

[0052] The beneficial effects of the present invention are:

[0053] The present invention provides a container-based cluster security management method and system, which combine an asymmetric encryption algorithm and a signature verification mechanism, ensure the data security of communication between a user terminal and a cloud platform, and provide double guarantee for data transmission; the constructed intrusion attack detection model realizes static intrusion attack detection, and the access attack detection model realizes dynamic access attack detection, which strengthens the comprehensiveness of security management, improves the accuracy of attack detection and the security management effect; the protection strategy generation model can dynamically generate protection strategies according to real-time attack detection results, and is combined with a container resource scheduling model to adjust resource allocation in real time, respond to security threats in an optimized manner, and improve the security protection level; the adjusted real-time protection strategy is executed after resource scheduling, ensuring that the container cluster has correspondingly strengthened security protection measures while optimizing resource configuration; the Hfish honeypot chain network can effectively trap attackers and collect attack information, providing strong support for real-time security management; the intrusion attack detection model, the access attack detection model, the protection strategy generation model and the container resource scheduling model are integrated together to form a multi-level and comprehensive security management system, which can adapt to different container clusters for security management, has strong practicality and high scalability.

[0054] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of the container-based cluster security management method in the present invention.

[0056] Figure 2 It is a structural block diagram of the container-based cluster security management system in the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

[0058] Embodiment 1:

[0059] like Figure 1 As shown, this embodiment provides a container-based cluster security management method, including the following steps:

[0060] S1: Based on a trusted institution, perform key generation and identity authentication for all user terminals connected to the cloud platform, obtain the public-private key pair and signature information of each user terminal, return the private key and signature information in the public-private key pair to the corresponding user terminal, and publish the public key in the public-private key pair to the cloud platform, including the following steps:

[0061] S1-1: Initialize the key based on the trusted institution to obtain the public parameters, master key and initial key;

[0062] GP={g,g1,g a ,e(g,g) a ,H1,H2,H3,H4,H5,H6}

[0063] PK={g,g1,g a ,e(g,g) a ,H u}

[0064] MSK = {g a ,a}

[0065] Where GP is the public parameter; MSK is the master key; PK is the initial key; a is the integer domain Z p Random numbers; H1, H2, H3, H4, H5, H6, H u All are target hash functions; g, g1, g a are all random numbers generated by generators in the cyclic group G; e(g,g) a is a bilinear map of random numbers g;

[0066] S1-2: Collecting attribute information V of user terminals u and entity ID, and uses an asymmetric encryption algorithm to generate keys for the user terminal based on the attribute information, public parameters, master key, and initial key to obtain the corresponding public-private key pair;

[0067] SK u = {MSK,V u ,K=g a g ab ,L u =g b ,(K' u =H3(V u ) b )}

[0068]

[0069] In the formula, SK u is the private key of user terminal u; b is the integer domain Z p Random number; L u , K' u is the private key parameter of user terminal u; H3 is the target hash function of public parameter GP; u is the user terminal indicator; MSK is the master key; PK is the initial key; PK u is the public key of user terminal u; g b , g a , gab V is a random number generated by a generator in the cyclic group G; u is the attribute information of the user terminal u;

[0070] S1-3: Use a digital identity authentication method to register an identity based on the public-private key pair and the corresponding entity ID, and obtain the signature information of the corresponding user terminal;

[0071] The formula is:

[0072]

[0073] Where k′ is a random number; K u is the registration parameter of user terminal u; KID u KID is the registration ID of user terminal u; u and the corresponding K u The signature information {K u ,KID u}; H1 is the target hash function; ID u is the entity ID of the user terminal u; is the prime order; P is the base point of the prime domain; mod(*) is the remainder function;

[0074] S1-4: Return the private key and signature information in the public-private key pair to the corresponding user terminal, and publish the public key in the public-private key pair to the cloud platform;

[0075] S2: Based on the cloud platform, build an intrusion attack detection model, an access attack detection model, a protection strategy generation model, and a container resource scheduling model. According to the basic container information of each container in the container cluster, build the corresponding Hfish honeypot, and build an Hfish honeypot chain network based on several Hfish honeypots, including the following steps:

[0076] S2-1: Based on the cloud platform, a number of historical access request data and a number of historical access flow data are collected, and pre-processed respectively to obtain a number of pre-processed historical access request data and a number of pre-processed historical access flow data;

[0077] S2-2: Based on some pre-processed historical access request data, the Random Forest (RF)-Attention-Bi-directional Long Short-Term Memory (BiLSTM) algorithm is used to build an intrusion attack detection model and generate some historical intrusion attack detection results;

[0078] The intrusion attack detection model includes a key feature extraction module based on the RF algorithm, a first attention weight module based on the Attention mechanism, and an intrusion attack detection module based on the BiLSTM algorithm.

[0079] The key feature extraction module uses the internal Classification And Regression Tree (CART) to screen the key features of the input data and extract several key features related to the data prediction label; the first attention weight generation module uses the preset attention weight to realize the splicing of key features and integrate the scattered features; enhance the influence of key features on label prediction, and the intrusion attack detection module uses a multi-layer hidden layer structure to explore the potential connection between key features and data prediction labels, train its own network structure through a large number of key features, predict new data features, and realize fast, efficient and accurate prediction of data labels;

[0080] The intrusion attack detection model implements intrusion attack detection for access request data sent by users, preventing malicious attacks from disguising as normal request data to invade the cloud platform, thus improving the protection level of the cloud platform;

[0081] S2-3: Based on some pre-processed historical access traffic data, an access attack detection model is constructed using the N-Generative Adversarial Networks (GAN)-Attention-BiLSTM algorithm, and some historical access attack detection results are generated;

[0082] The access detection model includes N dimensional feature extraction modules based on the GAN algorithm, a second attention weight module based on the Attention mechanism, and an access attack detection module based on the BiLSTM algorithm.

[0083] The dimension feature extraction module includes a generator and a discriminator. The goal of the generator is to generate sufficiently real data, while the goal of the discriminator is to distinguish between real data and data generated by the generator. In the extraction of key dimension features, GAN can be used to generate data that matches the features of real data to achieve feature extraction of key dimensions. The second attention weight generation module uses preset attention weights to achieve splicing of dimensional features and integrate scattered features. Similarly, the intrusion attack detection module uses a multi-layer hidden layer structure to explore the potential connection between key features and data prediction labels. It trains its own network structure through a large number of key features, predicts new data features, and achieves fast, efficient, and accurate prediction of data labels.

[0084] Different from the static detection of the intrusion attack detection model, the access detection model analyzes the dynamic traffic of user terminals on the cloud platform and performs dynamic access detection from key dimensions such as access behavior, violation degree, and damage risk. This enriches the cloud platform's attack detection methods for container clusters and improves the protection level of container clusters.

[0085] S2-4: Based on several historical intrusion attack detection results and several historical access attack detection results, a protection strategy generation model including an agent, a deep Q network and an experience replay pool is constructed using a deep Q network (DQN) algorithm, several historical protection strategies and several historical protection strategy generation experiences are generated, and the historical protection strategy generation experiences are stored in the experience replay pool of the protection strategy generation model, including the following steps:

[0086] S2-4-1: Use the protection strategy to generate problems as the simulation environment for the DQN algorithm, and build the intelligent agent and experience replay pool;

[0087] S2-4-2: Define the state space of the DQN algorithm according to each attack state type corresponding to the historical key dimension characteristics, and the parameters of the state space correspond to each attack state;

[0088] S2-4-3: Define the action space of the DQN algorithm based on the actions that the protection strategy needs to output; the action space includes no action (maintaining the current strategy), modifying firewall rules, enabling / disabling certain containers, reconfiguring container network resources, and sending alerts or notifying administrators, etc.

[0089] S2-4-4: Based on the possible impact of each action in the action space, define the reward function of the DQN algorithm to evaluate the quality or impact of the action;

[0090] S2-4-5: Construct the input layer, several hidden layers, and output layer of the deep Q network, connect the input layer to the state space, and connect the output layer to the action space;

[0091] S2-4-6: Based on the state space, action space and reward function, according to several historical intrusion attack detection results and several historical key features output by the corresponding key feature extraction module, and several historical access attack detection results and several historical dimensional features output by the corresponding dimensional feature extraction module, the deep Q network and the intelligent agent are optimized and trained to build a protection strategy generation model, and several historical protection strategy generation experiences are generated;

[0092] S2-4-7: storing several historical protection strategy generation experiences into the experience playback pool of the protection strategy generation model;

[0093] S2-5: Based on several historical protection strategies, the BiLSTM-Improved Fireworks Optimization Algorithm (IFWA) algorithm is used to build a container resource scheduling model;

[0094] The container resource scheduling model includes a resource demand prediction module based on the BiLSTM algorithm and a container resource scheduling module based on the IFWA optimization algorithm;

[0095] The resource demand prediction module uses the deep structure of the BiLSTM network to explore the potential connection between protection strategies and resource demand conditions, and predict the corresponding resource demand, action priority, and impact range. The container resource scheduling module optimizes in the search space based on the objective function constructed based on resource demand information, action priority, and impact range, to ensure efficient utilization of container cluster resources and maximization of protection effects as optimization goals, and to ensure that the implementation of the protection plan is both efficient and adaptable.

[0096] S2-6: Set up the Hfish honeypot management node, collect the basic container information of each container in the container cluster, retrieve the corresponding container image, obtain the matching container image, and generate the corresponding honeypot element according to the matching container image;

[0097] Honeypot elements include the service framework protocol and server attributes for building the virtual server corresponding to the Hfish honeypot; the Hfish honeypot elements are used to build the virtual server corresponding to the internal honeypot to build the Hfish honeypot;

[0098] S2-7: According to the honeypot elements, build the corresponding Hfish honeypot, set the traffic probe in the Hfish honeypot, distribute all Hfish honeypots, connect each Hfish honeypot to the Hfish honeypot management node, obtain the Hfish honeypot chain network, and set a firewall between the Hfish honeypot chain network and the container cluster;

[0099] S3: Based on the user terminal, the real-time access request data is encrypted according to the private key to obtain the encrypted real-time access request data, the encrypted real-time access request data is signed according to the signature information to obtain the real-time signature data, and the encrypted real-time access request data and the real-time signature data are uploaded to the cloud platform, including the following steps:

[0100] The formula is:

[0101] M u =E(SK u ,m u )

[0102] Where M uis the encrypted real-time access request data; E(*) is the asymmetric encryption function; m u Request data for real-time access; SK u is the private key of the data collection device u;

[0103] The formula is:

[0104]

[0105] In the formula, r' is a random number; is the prime order; P is the base point of the prime domain; H2 is the target hash function; K u For the signature information {K u ,KID u}Registration parameters of data collection device u; KID u For the signature information {K u ,KID u}Registration ID of data acquisition device u; ID u is the device ID of the data acquisition device u; the signature data is {ID u ,γ'={K u ,R u ,B u}}; R u ,B u ,γ' are the signature parameters of the data acquisition device u;

[0106] S4: Based on the cloud platform, the trusted institution is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data;

[0107] The formula is:

[0108] β u B u P=β u H2(R u ,ID u ,M u ,K u )R u +β u K u +β u H1(ID u ,K u )PK u

[0109] In the formula, β u PK is the signature verification parameter of the data acquisition device u; u is the public key of the data acquisition device u; if the left formula is equal to the right formula, the signature verification is successful;

[0110] m' u =E - (PK u ,M u )

[0111] In the formula, m' u To access the requested data in real time after decryption; E - (*) is an asymmetric decryption function; M u1 PK is used to request data for real-time access after encryption. u is the public key of the data collection device u;

[0112] S5: Based on the cloud platform, according to the decrypted real-time access request data, the intrusion attack detection model is used to perform intrusion attack detection to obtain the real-time intrusion attack detection result. If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered. Otherwise, the access rights of the user terminal are opened and the next step is entered, which includes the following steps:

[0113] S5-1: Based on the cloud platform, the decrypted real-time access request data is input into the intrusion attack detection model, and the key feature extraction module is used to extract M real-time key features of the decrypted real-time access request data, where M is the total number of key features, including the following steps:

[0114] S5-1-1: Use the RF structure trained in the key feature extraction module to extract the feature contribution of several real-time candidate features in the decrypted real-time access request data;

[0115] The formula is:

[0116]

[0117] In the formula, is the feature contribution of the j'th real-time candidate feature; is the feature contribution of the j'th real-time candidate feature in the i'th tree of the random forest; i' is the CART tree indicator; j' is the real-time candidate feature indicator; n is the total number of CARTs;

[0118]

[0119] In the formula, GI m , GI l , GI r" is the Gini index of the CART tree node m, node l and node r" of the random forest; p mk" is the proportion of category k" in CART tree node m; K is the total number of categories; m, l, r" are node indicators; k" is the category indicator;

[0120] S5-1-2: normalizing the feature contributions of several real-time candidate features to obtain several corresponding normalized feature contributions;

[0121] The formula is:

[0122]

[0123] Where VIM j' is the contribution of the feature after normalization; J is the total number of real-time candidate features;

[0124] S5-1-3: Generate feature selection standard values ​​for several real-time candidate features according to the normalized feature contribution;

[0125] The formula is:

[0126]

[0127] In the formula, CFC j' The feature selection standard value for the j'th real-time candidate feature; VIM j* is the normalized feature contribution of the j*th real-time candidate feature; j* is the indicator of the candidate feature;

[0128] S5-1-4: sort the real-time candidate features in descending order according to the feature selection standard value, and select the first M real-time candidate features as real-time key features to obtain M real-time key features;

[0129] S5-2: splicing the M real-time key features according to the first attention weight preset by the first attention weight module to obtain a first real-time splicing feature;

[0130] S5-3: Perform intrusion attack detection using an intrusion attack detection module according to the first real-time splicing feature to obtain a real-time intrusion attack detection result;

[0131] S5-4: If the real-time intrusion attack detection result is that an intrusion attack exists, enter the protection strategy generation step, otherwise, open the access rights of the user terminal and enter the access attack detection step;

[0132] S6: Based on the cloud platform, use the Hfish honeypot chain network to collect real-time access traffic data of user terminals. According to the real-time access traffic data, use the access attack detection model to perform access attack detection and obtain the real-time access attack detection result. If the real-time access attack detection result is that there is an access attack, enter the protection strategy generation step, otherwise, wait for the next user terminal to access, including the following steps:

[0133] S6-1: Based on the cloud platform, use the traffic probe of the Hfish honeypot chain network to collect the real-time access traffic data of the user terminal accessing the Hfish honeypot, and send the real-time access traffic data to the Hfish honeypot management node;

[0134] S6-2: Based on the Hfish honeypot management node, the real-time access traffic data is input into the access attack detection model, and the dimension feature extraction module is used to extract the real-time dimension features of the real-time access traffic data in N key dimensions, where N is the total number of key dimensions;

[0135] S6-3: splicing the N real-time dimensional features according to the second attention weight preset by the second attention weight module to obtain a second real-time splicing feature;

[0136] S6-4: performing access attack detection using an access attack detection module according to the second real-time splicing feature to obtain a real-time access attack detection result;

[0137] S6-5: If the real-time access attack detection result is that there is an access attack, enter the protection strategy generation step, otherwise, wait for the next user terminal to access;

[0138] S7: Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, a protection strategy generation model is used to generate a protection strategy to obtain a real-time protection strategy. According to the real-time protection strategy, a container resource scheduling model is used to schedule container resources to obtain a real-time container resource scheduling solution, including the following steps:

[0139] S7-1: Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the corresponding historical protection strategy generation experience is retrieved from the experience playback pool of the protection strategy generation model to obtain several matching historical protection strategy generation experiences;

[0140] S7-2: Based on some matching historical protection strategy generation experiences, the action space of the protection strategy generation model is updated to obtain the updated action space A'=[a'1,...,a' j" ,...,a' I ], where a' j" is the updated j-th "action value", j" is the action indicator, and I is the total number of action space dimensions;

[0141] S7-3: Update the state space A'=[a'1,...,a'1] of the protection strategy generation model according to the M real-time key features corresponding to the real-time intrusion attack detection results or the N real-time dimensional features corresponding to the real-time access attack detection results. j' ,...,a' I ], get the updated state space, where s'i" is the updated i'th state value, i' is the state indicator, and I' is the total number of state space dimensions;

[0142] S7-4: Use the updated state space as the input of the deep Q network and use the agent to generate the Q value of each possible action in the updated action space;

[0143] S7-5: Use the reward function to obtain the reward value of each possible action in the updated action space, and update the Q value of the possible action according to the reward value to obtain the updated Q value of each possible action;

[0144] The formula is:

[0145] Q(s' p' ,a' p' )=(1-α")·Q(s p' ,a p' )+α"·(R(s p' ,a p' ,s' p' )+γ·Q max (s p' ,a p' ))

[0146] In the formula, Q(s' p' ,a' p' ) is the updated state value s' p' and the updated action value a' p' The corresponding updated Q value; Q(s p' ,a p' ) is the state value s p' and action value a p' The corresponding predicted Q value; α" is the learning rate; Q max (s p' ,a p' ) is the highest predicted Q value; p' is the comprehensive indicator; γ is the update parameter;

[0147] S7-6: Repeat the Q value update until the predetermined number of iterations is reached, and use the greedy strategy to select the possible action with the highest updated Q value in each iteration as the execution action, and generate a protection strategy based on the several execution actions to obtain a real-time protection strategy;

[0148] S7-7: input the real-time protection strategy into the container resource scheduling model, use the resource demand prediction module to perform resource demand prediction, and obtain the real-time resource demand prediction result;

[0149] The real-time resource demand prediction result maps the real-time protection strategy to the actual resource demand, action priority and scope of influence, including converting actions (such as adjusting firewall rules, enabling / disabling containers) into specific resource consumption (such as CPU usage, memory demand, bandwidth consumption, etc.), analyzing the importance of different operations according to the real-time protection strategy, and realizing it by analyzing the frequency characteristics of different operations in the strategy. The higher the frequency, the higher the priority may be. Analyze the impact of each action on the overall security of the container cluster, and realize it by evaluating the characteristics of the operation on the availability of container services, data integrity, user privacy, etc., so as to provide a basis for the subsequent resource scheduling implementation. In this application, the potential relationship between the characteristics of the real-time protection strategy and resource demand, action priority and scope of influence is predicted, which improves the analysis efficiency and accuracy.

[0150] S7-8: According to the real-time resource demand prediction result, the objective function of the container resource scheduling module is set, and based on the objective function, the container resource scheduling module is used to perform container resource scheduling to obtain a real-time container resource scheduling solution, including the following steps:

[0151] S7-8-1: according to the resource demand index, action priority index and impact range index included in the real-time resource demand prediction result, set the objective function of the container resource scheduling module;

[0152] The formula is:

[0153]

[0154] Where F is the objective function of the resource scheduling module; R i is the demand for resource i, including CPU resources (for example, the container requires a specific amount of CPU time, and the required CPU share determines the weight of the container relative to other containers in CPU resource allocation), memory resources (the maximum and minimum amount of memory that the container can use), storage resources (container-specific storage space for storing application data, log files, etc.), and network resources (network bandwidth used by the container), etc.; P a is the priority of executing action a; C i is the action cost of resource i; I a is the impact range of action a; i is the resource indicator; a is the action indicator; n is the total number of resources; m is the total number of actions; resources include server resources, bandwidth resources and storage resources; W R , W p , W c are resource requirement weight, action priority weight, and action cost weight;

[0155] S7-8-2: Initialize the container resource scheduling scheme, generate several initial solutions, and use the objective function as the fitness function of the initial solution, including the following steps:

[0156] S7-8-2-1: Encode the resource scheduling solution generation problem and encode the container resource scheduling solution into an IFWA individual of the IFWA optimization algorithm;

[0157] S7-8-2-2: Use the Circle chaotic mapping sequence to initialize the IFWA population and obtain several initial solutions;

[0158]

[0159] In the formula, q l' is the initial solution, i.e. the initial IFWA individual of the Circle chaos map; q * l' is the randomly generated initial IFWA individual; l' is the IFWA individual indicator;

[0160] S7-8-2-3: Use the objective function as the fitness function of the initial solution;

[0161] f(q)=F(q)

[0162] Where, f(q) is the fitness value of IFWA individual q; F(q) is the objective function value of IFWA individual q; q is the IFWA individual reference variable;

[0163] S7-8-3: Based on the fitness function, iterative optimization is performed on several initial solutions to reach a predetermined number of iterations to obtain an optimal solution, and a real-time container resource scheduling solution is obtained based on the optimal solution, including the following steps:

[0164] S7-8-3-1: According to the fitness function, obtain the fitness value of each IFWA individual in the initialized IFWA population;

[0165] S7-8-3-2: Get the explosion radius and number of sparks of each IFWA individual in the initialized IFWA population. The formula is:

[0166]

[0167] In the formula, S l' is the initial IFWA individual q l' The number of sparks; M' is a constant; f max is the maximum fitness value in the initialized IFWA population; f(q l' ) is the initial IFWA individual q l' The fitness value of ; τ is an infinitesimal constant;

[0168]

[0169] In the formula, R l' is the initial IFWA individual q l' Explosion radius; f is the explosion radius adjustment constant; min is the minimum fitness value in the initialized IFWA population;

[0170] S7-8-3-3: According to the explosion radius and number of sparks of the initial IFWA individuals, fireworks are exploded to obtain an updated IFWA population. The formula is:

[0171] q' l' =q l' +S l' ×rand(-1,1)

[0172] In the formula, q' l' is the updated IFWA individual; rand(-1,1) is a random number between -1 and 1;

[0173] S7-8-3-4: Use the Gaussian mutation algorithm to perform Gaussian mutation on the initialized IFWA population to generate a Gaussian mutated IFWA population. The formula is:

[0174] q" l' =q l' +S l' ×G(1,1)

[0175] In the formula, q" l' is an IFWA individual with Gaussian variation; G(1,1) is a random number with Gaussian distribution whose mean and variance are both 1;

[0176] S7-8-3-5: Use the dynamic reverse learning algorithm to perform dynamic reverse learning on the initialized IFWA population to obtain the reverse IFWA population. The formula is:

[0177] q"' l' =γ(L max +L min )-q l'

[0178] In the formula, q"' l' is the reverse IFWA individual; γ is the decreasing inertia coefficient; L max , L min are the maximum and minimum values ​​of the vector space respectively;

[0179] S7-8-3-6: Obtain the fitness values ​​of the IFWA individuals of the updated IFWA population, the Gaussian-mutated IFWA population, and the reverse IFWA population, and take the IFWA individual with the minimum fitness value as the optimal individual;

[0180] S7-8-3-7: If the number of iterations reaches the threshold or the fitness value of the optimal individual meets the requirement, the optimal solution corresponding to the current optimal individual is output to obtain the optimal real-time container resource scheduling solution;

[0181] S8: Based on the cloud platform, according to the real-time container resource scheduling scheme, the real-time protection strategy is adjusted and the container resources of the container cluster are scheduled to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling, and the adjusted real-time protection strategy is executed based on the container cluster after resource scheduling, including the following steps:

[0182] S8-1: According to the protection service support involved in the real-time resource scheduling solution, the real-time protection strategy is adjusted to obtain an adjusted real-time protection strategy;

[0183] The real-time resource scheduling scheme needs to reallocate the resources of the container that has received the access attack, and the real-time protection strategy includes actions such as closing or restricting access to the container. In this case, the execution action in the real-time protection strategy needs to be adjusted to delay its execution time and wait for resource allocation before taking action.

[0184] S8-2: According to the specific resource scheduling instructions in the real-time container resource scheduling scheme, including adjusting the CPU resource weight of the container, allocating the maximum and minimum memory amounts of the container, etc., the container cluster is scheduled for container resources to obtain a container cluster after resource scheduling;

[0185] S8-3: Based on the container cluster after resource scheduling, execute the adjusted real-time protection strategy, including disabling containers and closing firewalls after resource scheduling is completed.

[0186] Embodiment 2:

[0187] like Figure 2 As shown, this embodiment provides a container-based cluster security management system for implementing a cluster security management method. The system includes a cloud platform, a trusted organization, and a plurality of user terminals. The cloud platform and the trusted organization are respectively connected to the plurality of user terminals in communication. An intrusion attack detection model, an access attack detection model, a protection strategy generation model, and a container resource scheduling model are provided in the container cluster of the cloud platform. The trusted organization is also connected to the cloud platform in communication.

[0188] The trusted institution is used to generate keys and authenticate the identities of all user terminals connected to the cloud platform, obtain the public-private key pair and signature information of each user terminal, return the private key and signature information in the public-private key pair to the corresponding user terminal, and publish the public key in the public-private key pair to the cloud platform;

[0189] The user terminal is used to encrypt the real-time access request data according to the private key to obtain the encrypted real-time access request data, sign the encrypted real-time access request data according to the signature information to obtain the real-time signature data, and upload the encrypted real-time access request data and the real-time signature data to the cloud platform;

[0190] The cloud platform is used to build intrusion attack detection models, access attack detection models, protection strategy generation models and container resource scheduling models. According to the basic container information of each container in the container cluster, the corresponding Hfish honeypot is built, and the Hfish honeypot chain network is built based on several Hfish honeypots; the trusted organization is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data; according to the decrypted real-time access request data, the intrusion attack detection model is used to perform intrusion attack detection to obtain real-time intrusion attack detection results; the Hfish honeypot chain network is used to collect user The real-time access traffic data of the terminal is used, and access attack detection is performed using an access attack detection model according to the real-time access traffic data to obtain real-time access attack detection results; according to the real-time intrusion attack detection results or the real-time access attack detection results, a protection strategy generation model is used to generate a protection strategy to obtain a real-time protection strategy; according to the real-time protection strategy, a container resource scheduling model is used to schedule container resources to obtain a real-time container resource scheduling plan; according to the real-time container resource scheduling plan, the real-time protection strategy is adjusted and container resources are scheduled for the container cluster to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling, and the adjusted real-time protection strategy is executed based on the container cluster after resource scheduling.

[0191] The present invention provides a container-based cluster security management method and system, which combine an asymmetric encryption algorithm and a signature verification mechanism, ensure the data security of communication between a user terminal and a cloud platform, and provide double guarantee for data transmission; the constructed intrusion attack detection model realizes static intrusion attack detection, and the access attack detection model realizes dynamic access attack detection, which strengthens the comprehensiveness of security management, improves the accuracy of attack detection and the security management effect; the protection strategy generation model can dynamically generate protection strategies according to real-time attack detection results, and is combined with a container resource scheduling model to adjust resource allocation in real time, respond to security threats in an optimized manner, and improve the security protection level; the adjusted real-time protection strategy is executed after resource scheduling, ensuring that the container cluster has correspondingly strengthened security protection measures while optimizing resource configuration; the Hfish honeypot chain network can effectively trap attackers and collect attack information, providing strong support for real-time security management; the intrusion attack detection model, the access attack detection model, the protection strategy generation model and the container resource scheduling model are integrated together to form a multi-level and comprehensive security management system, which can adapt to different container clusters for security management, has strong practicality and high scalability.

[0192] The present invention is not limited to the above optional implementations, and anyone can derive other various forms of products under the enlightenment of the present invention. The above specific implementations should not be understood as limiting the scope of protection of the present invention. The scope of protection of the present invention should be based on the definition in the claims, and the description can be used to interpret the claims.

Claims

1. A container-based cluster security management method, characterized by: The steps include: Based on the trusted institution, all user terminals connected to the cloud platform are key-generated and authenticated, and the public-private key pair and signature information of each user terminal are obtained. The private key and signature information in the public-private key pair are returned to the corresponding user terminal, and the public key in the public-private key pair is published to the cloud platform. Based on the cloud platform, we build intrusion attack detection models, access attack detection models, protection strategy generation models, and container resource scheduling models. According to the basic container information of each container in the container cluster, we build the corresponding Hfish honeypot, and based on several Hfish honeypots, we build an Hfish honeypot chain network. Based on the user terminal, the real-time access request data is encrypted according to the private key to obtain the encrypted real-time access request data, the encrypted real-time access request data is signed according to the signature information to obtain the real-time signature data, and the encrypted real-time access request data and the real-time signature data are uploaded to the cloud platform; Based on the cloud platform, a trusted institution is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data; Based on the cloud platform, according to the decrypted real-time access request data, the intrusion attack detection model is used to perform intrusion attack detection and obtain the real-time intrusion attack detection result. If the real-time intrusion attack detection result shows that an intrusion attack exists, the protection strategy generation step is entered; otherwise, the access rights of the user terminal are opened and the next step is entered; Based on the cloud platform, the Hfish honeypot chain network is used to collect the real-time access traffic data of the user terminal. According to the real-time access traffic data, the access attack detection model is used to perform access attack detection and obtain the real-time access attack detection result. If the real-time access attack detection result is that there is an access attack, the protection strategy generation step is entered, otherwise, the next user terminal access is waited for; Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the protection strategy generation model is used to generate the protection strategy to obtain the real-time protection strategy. According to the real-time protection strategy, the container resource scheduling model is used to schedule the container resources to obtain the real-time container resource scheduling solution. Based on the cloud platform, the real-time protection strategy is adjusted and container resources are scheduled for the container cluster according to the real-time container resource scheduling plan to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling, and the adjusted real-time protection strategy is executed based on the container cluster after resource scheduling.

2. A container-based cluster security management method according to claim 1, characterized in that: Based on the cloud platform, we build intrusion attack detection models, access attack detection models, protection strategy generation models, and container resource scheduling models. According to the basic container information of each container in the container cluster, we build the corresponding Hfish honeypot, and based on several Hfish honeypots, we build an Hfish honeypot chain network, which includes the following steps: Based on the cloud platform, a number of historical access request data and a number of historical access flow data are collected, and pre-processed respectively to obtain a number of pre-processed historical access request data and a number of pre-processed historical access flow data; Based on some pre-processed historical access request data, a deep learning algorithm is used to build an intrusion attack detection model and generate some historical intrusion attack detection results; Based on some pre-processed historical access traffic data, a deep learning algorithm is used to build an access attack detection model and generate some historical access attack detection results; Based on several historical intrusion attack detection results and several historical access attack detection results, a protection strategy generation model is constructed using a reinforcement learning algorithm to generate several historical protection strategies and several historical protection strategy generation experiences, and the historical protection strategy generation experiences are stored in the experience playback pool of the protection strategy generation model; Based on several historical protection strategies, a fusion algorithm is used to build a container resource scheduling model; Set up the Hfish honeypot management node, collect the basic container information of each container in the container cluster, retrieve the corresponding container image, obtain the matching container image, and generate the corresponding honeypot element based on the matching container image; According to the honeypot elements, the corresponding Hfish honeypot is constructed, the traffic probe is set in the Hfish honeypot, all Hfish honeypots are distributed, each Hfish honeypot is connected to the Hfish honeypot management node to obtain the Hfish honeypot chain network, and a firewall is set between the Hfish honeypot chain network and the container cluster.

3. A container-based cluster security management method according to claim 2, characterized in that: The intrusion attack detection model is built based on the RF-Attention-BiLSTM algorithm.

4. The container-based cluster security management method according to claim 2, characterized in that: The access attack detection model is built based on the N-GAN-Attention-BiLSTM algorithm.

5. The container-based cluster security management method according to claim 2, characterized in that: The protection strategy generation model is constructed based on the DQN algorithm; The container resource scheduling model is built based on the BiLSTM-IFWA algorithm.

6. The container-based cluster security management method according to claim 3, characterized in that: Based on the cloud platform, according to the decrypted real-time access request data, the intrusion attack detection model is used to perform intrusion attack detection and obtain the real-time intrusion attack detection result. If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered. Otherwise, the access rights of the user terminal are opened and the next step is entered, which includes the following steps: Based on the cloud platform, the decrypted real-time access request data is input into the intrusion attack detection model to extract M real-time key features of the decrypted real-time access request data, where M is the total number of key features; According to the preset first attention weight, the M real-time key features are spliced ​​to obtain a first real-time spliced ​​feature; Perform intrusion attack detection according to the first real-time splicing feature to obtain a real-time intrusion attack detection result; If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered; otherwise, the access rights of the user terminal are opened and the access attack detection step is entered.

7. The container-based cluster security management method according to claim 4, characterized in that: Based on the cloud platform, the Hfish honeypot chain network is used to collect the real-time access traffic data of the user terminal. According to the real-time access traffic data, the access attack detection model is used to perform access attack detection and obtain the real-time access attack detection result. If the real-time access attack detection result is that there is an access attack, the protection strategy generation step is entered. Otherwise, the next user terminal access is waited for, including the following steps: Based on the cloud platform, the traffic probe of Hfish honeypot chain network is used to collect the real-time access traffic data of user terminals accessing Hfish honeypot, and send the real-time access traffic data to the Hfish honeypot management node; Based on the Hfish honeypot management node, the real-time access traffic data is input into the access attack detection model to extract the real-time dimension features of the real-time access traffic data in N key dimensions, where N is the total number of key dimensions; According to the preset second attention weight, N real-time dimension features are spliced ​​to obtain a second real-time spliced ​​feature; Perform access attack detection according to the second real-time splicing feature to obtain a real-time access attack detection result; If the real-time access attack detection result is that there is an access attack, the protection strategy generation step is entered, otherwise, the next user terminal access is waited for.

8. The container-based cluster security management method according to claim 5, characterized in that: Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the protection strategy generation model is used to generate the protection strategy to obtain the real-time protection strategy. According to the real-time protection strategy, the container resource scheduling model is used to schedule the container resources to obtain the real-time container resource scheduling solution, including the following steps: Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the action space and state space of the protection strategy generation model are updated to obtain the updated action space and the updated state space; Use the updated state space as the input of the deep Q network and use the agent to generate the Q value of each possible action in the updated action space; Use the reward function to obtain the reward value of each possible action in the updated action space, and update the Q value of the possible action according to the reward value to obtain the updated Q value of each possible action; Repeat the above Q value update until the predetermined number of iterations is reached, and use the greedy strategy to select the possible action with the highest updated Q value in each iteration as the execution action, and generate a protection strategy based on several execution actions to obtain a real-time protection strategy; The real-time protection strategy is input into the container resource scheduling model to perform resource demand prediction and obtain the real-time resource demand prediction result; According to the real-time resource demand prediction results, an objective function is set, and based on the objective function, container resources are scheduled to obtain a real-time container resource scheduling solution.

9. A container-based cluster security management method according to claim 8, characterized in that: According to the real-time resource demand prediction results, an objective function is set, and container resource scheduling is performed based on the objective function to obtain a real-time container resource scheduling solution, which includes the following steps: Setting an objective function according to the resource demand index, action priority index, and impact range index included in the real-time resource demand prediction result; Initialize the container resource scheduling scheme, generate several initial solutions, and use the objective function as the fitness function of the initial solution; Based on the fitness function, several initial solutions are iteratively optimized to reach a predetermined number of iterations to obtain the optimal solution, and based on the optimal solution, a real-time container resource scheduling solution is obtained.

10. A container-based cluster security management system, used to implement the cluster security management method according to any one of claims 1 to 9, characterized in that: The system includes a cloud platform, a trusted organization and several user terminals. The cloud platform and the trusted organization are respectively connected to the several user terminals in communication. An intrusion attack detection model, an access attack detection model, a protection strategy generation model and a container resource scheduling model are set in the container cluster of the cloud platform. The trusted organization is also connected to the cloud platform in communication.

Images