A container-based cluster security management method and system

Abstract

The present invention belongs to the field of security management technology, and discloses a container-based cluster security management method and system. The method comprises the following steps: based on a trusted institution, performing key generation and identity authentication; based on a cloud platform, constructing an intrusion attack detection model, an access attack detection model, a protection strategy generation model, a container resource scheduling model, and an Hfish honeypot chain network; based on a user terminal, encrypting and signing real-time access request data, and uploading it to the cloud platform; based on the cloud platform, performing signature verification and decryption on the encrypted real-time access request data; based on the cloud platform, performing intrusion attack detection; collecting real-time access traffic data, and performing access attack detection; performing protection strategy generation and container resource scheduling; based on the container cluster after resource scheduling, executing the adjusted real-time protection strategy. The present invention solves the problems of poor detection accuracy, poor comprehensiveness of security management, poor effect, and low protection level in the prior art.

Description

Technical Field

[0001] The present invention belongs to the technical field of security management, and in particular relates to a container-based cluster security management method and system. Background Art

[0002] In recent years, with the rapid development of cloud computing and the popularization of the "cloud native" concept, more and more enterprises are choosing to deploy applications and services in lightweight and fast cloud containers to complete the migration to cloud platforms. At the same time, the scale of these deployments is on a continuous growth trend, and container clusters built from multiple containers are becoming increasingly widely used in cloud platforms. However, container clusters face many security challenges during operation, including the following vulnerabilities:

[0003] 1) Existing container cluster security management technologies are unable to accurately detect unknown attacks in the face of evolving attack methods, resulting in poor attack detection accuracy on cloud platforms.

[0004] 2) Existing container cluster security management technologies only implement static attack detection, resulting in poor security management comprehensiveness and effectiveness.

[0005] 3) Existing container cluster security management technologies rely on preset rules for security protection, with a low level of protection and a lack of adaptive security protection strategy generation capabilities. Summary of the Invention

[0006] In order to solve the problems of poor detection accuracy, poor comprehensiveness of security management, poor effect and low protection level in the existing technology, the purpose of the present invention is to provide a container-based cluster security management method and system.

[0007] The technical solution adopted in the present invention is:

[0008] A container-based cluster security management method includes the following steps:

[0009] Based on a trusted institution, key generation and identity authentication are performed on all user terminals connected to the cloud platform. The public-private key pair and signature information of each user terminal are obtained. The private key and signature information in the public-private key pair are returned to the corresponding user terminal, and the public key in the public-private key pair is published to the cloud platform.

[0010] Based on the cloud platform, we build intrusion attack detection models, access attack detection models, protection strategy generation models, and container resource scheduling models. Based on the basic container information of each container in the container cluster, we build a corresponding Hfish honeypot. Then, we build an Hfish honeypot chain network based on several Hfish honeypots.

[0011] Based on the user terminal, the real-time access request data is encrypted according to the private key to obtain the encrypted real-time access request data, the encrypted real-time access request data is signed according to the signature information to obtain the real-time signature data, and the encrypted real-time access request data and the real-time signature data are uploaded to the cloud platform;

[0012] Based on the cloud platform, a trusted institution is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data;

[0013] Based on the cloud platform, the intrusion attack detection model is used to perform intrusion attack detection based on the decrypted real-time access request data to obtain real-time intrusion attack detection results. If the real-time intrusion attack detection result indicates that an intrusion attack has occurred, the protection strategy generation step is entered; otherwise, the user terminal's access rights are opened and the next step is entered;

[0014] Based on the cloud platform, the Hfish honeypot chain network is used to collect real-time access traffic data of user terminals. Based on the real-time access traffic data, access attack detection is performed using the access attack detection model to obtain real-time access attack detection results. If the real-time access attack detection result indicates that an access attack exists, the protection strategy generation step is entered. Otherwise, the next user terminal access is waited for.

[0015] Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, a protection strategy generation model is used to generate a protection strategy to obtain a real-time protection strategy. Based on the real-time protection strategy, a container resource scheduling model is used to schedule container resources to obtain a real-time container resource scheduling solution.

[0016] Based on the cloud platform, the real-time protection strategy is adjusted and the container resources of the container cluster are scheduled according to the real-time container resource scheduling plan to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling. The adjusted real-time protection strategy is executed based on the container cluster after resource scheduling.

[0017] Furthermore, based on the cloud platform, we build an intrusion attack detection model, an access attack detection model, a protection strategy generation model, and a container resource scheduling model. Based on the basic container information of each container in the container cluster, we build a corresponding Hfish honeypot. Then, based on several Hfish honeypots, we build an Hfish honeypot chain network, which includes the following steps:

[0018] Based on the cloud platform, a number of historical access request data and a number of historical access flow data are collected and pre-processed respectively to obtain a number of pre-processed historical access request data and a number of pre-processed historical access flow data;

[0019] Based on a number of pre-processed historical access request data, a deep learning algorithm is used to build an intrusion attack detection model and generate a number of historical intrusion attack detection results;

[0020] Based on some pre-processed historical access traffic data, a deep learning algorithm is used to build an access attack detection model and generate some historical access attack detection results.

[0021] Based on several historical intrusion attack detection results and several historical access attack detection results, a reinforcement learning algorithm is used to build a protection strategy generation model, generate several historical protection strategies and several historical protection strategy generation experiences, and store the historical protection strategy generation experiences in the experience replay pool of the protection strategy generation model;

[0022] Based on several historical protection strategies, a fusion algorithm is used to build a container resource scheduling model;

[0023] Set up the Hfish honeypot management node, collect the basic container information of each container in the container cluster, retrieve the corresponding container image, obtain the matching container image, and generate the corresponding honeypot element based on the matching container image;

[0024] According to the honeypot elements, the corresponding Hfish honeypot is constructed, the traffic probe is set in the Hfish honeypot, all Hfish honeypots are distributed, each Hfish honeypot is connected to the Hfish honeypot management node to obtain the Hfish honeypot chain network, and a firewall is set between the Hfish honeypot chain network and the container cluster.

[0025] Furthermore, the intrusion attack detection model is constructed based on the RF-Attention-BiLSTM algorithm.

[0026] Furthermore, the access attack detection model is built based on the N-GAN-Attention-BiLSTM algorithm.

[0027] Furthermore, the protection strategy generation model is built based on the DQN algorithm;

[0028] The container resource scheduling model is built based on the BiLSTM-IFWA algorithm.

[0029] Furthermore, based on the cloud platform, an intrusion attack detection model is used to perform intrusion attack detection based on the decrypted real-time access request data to obtain a real-time intrusion attack detection result. If the real-time intrusion attack detection result indicates that an intrusion attack exists, the protection strategy generation step is entered. Otherwise, the access rights of the user terminal are opened and the next step is entered, which includes the following steps:

[0030] Based on the cloud platform, the decrypted real-time access request data is input into the intrusion attack detection model to extract M real-time key features of the decrypted real-time access request data, where M is the total number of key features;

[0031] According to the preset first attention weight, the M real-time key features are spliced to obtain a first real-time splicing feature;

[0032] Perform intrusion attack detection based on the first real-time splicing feature to obtain a real-time intrusion attack detection result;

[0033] If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered; otherwise, the access rights of the user terminal are opened and the access attack detection step is entered.

[0034] Furthermore, based on the cloud platform, the Hfish honeypot chain network is used to collect real-time access traffic data of user terminals. Based on the real-time access traffic data, access attack detection is performed using the access attack detection model to obtain real-time access attack detection results. If the real-time access attack detection result indicates that an access attack exists, the protection strategy generation step is entered. Otherwise, the next user terminal access is waited for, including the following steps:

[0035] Based on the cloud platform, the traffic probe of the Hfish honeypot chain network is used to collect real-time access traffic data of user terminals accessing the Hfish honeypot, and the real-time access traffic data is sent to the Hfish honeypot management node;

[0036] Based on the Hfish honeypot management node, the real-time access traffic data is input into the access attack detection model to extract the real-time dimension features of the real-time access traffic data in N key dimensions, where N is the total number of key dimensions;

[0037] According to the preset second attention weight, N real-time dimension features are spliced to obtain a second real-time splicing feature;

[0038] Perform access attack detection based on the second real-time splicing feature to obtain a real-time access attack detection result;

[0039] If the real-time access attack detection result is that an access attack exists, the protection strategy generation step is entered; otherwise, the process waits for the next user terminal to access.

[0040] Furthermore, based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, a protection strategy generation model is used to generate a protection strategy to obtain a real-time protection strategy. According to the real-time protection strategy, a container resource scheduling model is used to schedule container resources to obtain a real-time container resource scheduling solution, including the following steps:

[0041] Based on the cloud platform, the action space and state space of the protection strategy generation model are updated according to the real-time intrusion attack detection results or the real-time access attack detection results, and the updated action space and state space are obtained;

[0042] The updated state space is used as the input of the deep Q network, and the agent is used to generate the Q value of each possible action in the updated action space.

[0043] Use the reward function to obtain the reward value of each possible action in the updated action space, and update the Q value of the possible action based on the reward value to obtain the updated Q value of each possible action;

[0044] Repeat the above Q-value update until the predetermined number of iterations is reached, and use the greedy strategy to select the possible action with the highest updated Q-value in each iteration as the execution action. Then, generate a protection strategy based on several execution actions to obtain a real-time protection strategy.

[0045] Input the real-time protection strategy into the container resource scheduling model to perform resource demand forecasting and obtain the real-time resource demand forecast results;

[0046] According to the real-time resource demand prediction results, an objective function is set, and based on the objective function, container resource scheduling is performed to obtain a real-time container resource scheduling solution.

[0047] Furthermore, according to the real-time resource demand prediction results, an objective function is set, and container resource scheduling is performed based on the objective function to obtain a real-time container resource scheduling solution, which includes the following steps:

[0048] Setting an objective function based on the resource demand index, action priority index, and impact range index included in the real-time resource demand prediction result;

[0049] Initialize the container resource scheduling scheme, generate several initial solutions, and use the objective function as the fitness function of the initial solutions;

[0050] Based on the fitness function, several initial solutions are iteratively optimized to reach a predetermined number of iterations to obtain the optimal solution, and based on the optimal solution, a real-time container resource scheduling solution is obtained.

[0051] A container-based cluster security management system is used to implement a cluster security management method. The system includes a cloud platform, a trusted organization, and several user terminals. The cloud platform and the trusted organization are respectively connected to the several user terminals in communication. Intrusion attack detection model, access attack detection model, protection strategy generation model, and container resource scheduling model are set in the container cluster of the cloud platform. The trusted organization is also connected to the cloud platform in communication.

[0052] The beneficial effects of the present invention are:

[0053] The present invention provides a container-based cluster security management method and system, which combine an asymmetric encryption algorithm and a signature verification mechanism to ensure the data security of communication between user terminals and cloud platforms, providing double guarantees for data transmission. The constructed intrusion attack detection model realizes static intrusion attack detection, and the access attack detection model realizes dynamic access attack detection, thereby enhancing the comprehensiveness of security management and improving the attack detection accuracy and security management effect. The protection strategy generation model can dynamically generate protection strategies based on real-time attack detection results, and combined with the container resource scheduling model, adjust resource allocation in real time to respond to security threats in an optimized manner, thereby improving the security protection level. After resource scheduling, the adjusted real-time protection strategy is executed, ensuring that the container cluster optimizes resource configuration while also strengthening security protection measures accordingly. The Hfish honeypot chain network can effectively trap attackers and collect attack information, providing strong support for real-time security management. The intrusion attack detection model, access attack detection model, protection strategy generation model, and container resource scheduling model are integrated to form a multi-level, comprehensive security management system that can adapt to different container clusters for security management, with strong practicality and high scalability.

[0054] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a flowchart of the container-based cluster security management method of the present invention.

[0056] Figure 2 This is a structural block diagram of the container-based cluster security management system in the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0058] Example 1:

[0059] like Figure 1 As shown, this embodiment provides a container-based cluster security management method, including the following steps:

[0060] S1: Based on a trusted institution, perform key generation and identity authentication for all user terminals connected to the cloud platform, obtain the public-private key pair and signature information of each user terminal, return the private key and signature information in the public-private key pair to the corresponding user terminal, and publish the public key in the public-private key pair to the cloud platform, including the following steps:

[0061] S1-1: Initialize the key based on the trusted institution to obtain the public parameters, master key and initial key;

[0062] GP={g,g1,g a ,e(g,g) a ,H1,H2,H3,H4,H5,H6}

[0063] PK={g,g1,g a ,e(g,g) a ,H u}

[0064] MSK={g a ,a}

[0065] Where GP is the public parameter; MSK is the master key; PK is the initial key; a is the integer domain Z p Random numbers; H1, H2, H3, H4, H5, H6, H u All are target hash functions; g, g1, g a are all random numbers generated by generators in the cyclic group G; e(g,g) a is a bilinear map of random numbers g;

[0066] S1-2: Collect attribute information V of user terminal u and entity ID, and uses an asymmetric encryption algorithm to generate keys for the user terminal based on attribute information, public parameters, master key, and initial key to obtain the corresponding public-private key pair;

[0067] SK u ={MSK,V u ,K=g a g ab ,L u =g b ,(K' u =H3(V u ) b )}

[0068]

[0069] Where SK u is the private key of user terminal u; b is the integer domain Z p Random number; L u , K' u is the private key parameter of user terminal u; H3 is the target hash function of public parameter GP; u is the user terminal indicator; MSK is the master key; PK is the initial key; PK u is the public key of user terminal u; g b 、g a 、gab A random number generated by a generator in the cyclic group G; V u is the attribute information of the user terminal u;

[0070] S1-3: Based on the public-private key pair and the corresponding entity ID, use the digital identity authentication method to register the identity and obtain the signature information of the corresponding user terminal;

[0071] The formula is:

[0072]

[0073] Where k′ is a random number; K u is the registration parameter of user terminal u; KID u KID is the registration ID of user terminal u; u and the corresponding K u Constitute the signature information {K u ,KID u}; H1 is the target hash function; ID u is the entity ID of the user terminal u; is the prime order; P is the base point of the prime field; mod(*) is the remainder function;

[0074] S1-4: Return the private key and signature information in the public-private key pair to the corresponding user terminal, and publish the public key in the public-private key pair to the cloud platform;

[0075] S2: Based on the cloud platform, we build an intrusion attack detection model, an access attack detection model, a protection strategy generation model, and a container resource scheduling model. Based on the basic container information of each container in the container cluster, we build a corresponding Hfish honeypot. Then, based on several Hfish honeypots, we build an Hfish honeypot chain network. This includes the following steps:

[0076] S2-1: Based on the cloud platform, a number of historical access request data and a number of historical access flow data are collected and pre-processed respectively to obtain a number of pre-processed historical access request data and a number of pre-processed historical access flow data;

[0077] S2-2: Based on some pre-processed historical access request data, use the Random Forest (RF)-Attention-Bidirectional Long Short-Term Memory (BiLSTM) algorithm to build an intrusion attack detection model and generate some historical intrusion attack detection results.

[0078] The intrusion attack detection model includes a key feature extraction module based on the RF algorithm, a first attention weight module based on the Attention mechanism, and an intrusion attack detection module based on the BiLSTM algorithm.

[0079] The key feature extraction module uses an internal Classification and Regression Tree (CART) to screen the key features of the input data and extract several key features related to the data prediction label. The first attention weight generation module uses preset attention weights to splice the key features and integrate the scattered features, thereby enhancing the influence of key features on label prediction. The intrusion attack detection module uses a multi-layer hidden layer structure to explore the potential connection between key features and data prediction labels. It trains its own network structure with a large number of key features to predict new data features and achieve fast, efficient and accurate prediction of data labels.

[0080] The intrusion attack detection model implements intrusion attack detection for access request data sent by users, preventing malicious attacks from disguising themselves as normal request data to invade the cloud platform, thus improving the protection level of the cloud platform;

[0081] S2-3: Based on some pre-processed historical access traffic data, we use the N-Generative Adversarial Networks (GAN)-Attention-BiLSTM algorithm to build an access attack detection model and generate some historical access attack detection results.

[0082] The access detection model includes N dimensional feature extraction modules built based on the GAN algorithm, a second attention weight module built based on the Attention mechanism, and an access attack detection module built based on the BiLSTM algorithm;

[0083] The dimensional feature extraction module includes a generator and a discriminator. The goal of the generator is to generate sufficiently realistic data, while the goal of the discriminator is to distinguish between real data and data generated by the generator. In the key dimension feature extraction, GAN can be used to generate data that matches the real data features to achieve feature extraction of key dimensions. The second attention weight generation module uses preset attention weights to splice dimensional features and integrate scattered features. Similarly, the intrusion attack detection module uses a multi-layer hidden layer structure to explore the potential connection between key features and data prediction labels. It trains its own network structure through a large number of key features to predict new data features and achieve fast, efficient and accurate prediction of data labels.

[0084] Unlike the static detection of intrusion attack detection models, the access detection model analyzes the dynamic traffic of user terminals on the cloud platform and performs dynamic access detection based on key dimensions such as access behavior, violation level, and damage risk. This enriches the cloud platform's attack detection methods for container clusters and improves the protection level of container clusters.

[0085] S2-4: Based on several historical intrusion attack detection results and several historical access attack detection results, a protection strategy generation model is constructed using the Deep Q Network (DQN) algorithm, which includes an agent, a Deep Q Network, and an experience replay pool. Several historical protection strategies and several historical protection strategy generation experiences are generated, and the historical protection strategy generation experiences are stored in the experience replay pool of the protection strategy generation model. The steps include the following:

[0086] S2-4-1: Use the defense strategy to generate problems as the simulation environment for the DQN algorithm, and build the intelligent agent and experience replay pool;

[0087] S2-4-2: Define the state space of the DQN algorithm based on each attack state type corresponding to the historical key dimension characteristics, and the parameters of the state space correspond to each attack state;

[0088] S2-4-3: Define the action space of the DQN algorithm based on the actions that the protection strategy needs to output. The action space includes taking no action (maintaining the current strategy), modifying firewall rules, enabling / disabling certain containers, reconfiguring container network resources, and sending alerts or notifying administrators.

[0089] S2-4-4: Based on the possible impact of each action in the action space, define the reward function of the DQN algorithm to evaluate the quality or impact of the action;

[0090] S2-4-5: Construct the input layer, several hidden layers, and output layer of the deep Q network, connect the input layer to the state space, and connect the output layer to the action space;

[0091] S2-4-6: Based on the state space, action space, and reward function, and according to several historical intrusion attack detection results and several historical key features output by the corresponding key feature extraction module, and several historical access attack detection results and several historical dimensional features output by the corresponding dimensional feature extraction module, the deep Q network and the intelligent agent are optimized and trained to build a protection strategy generation model and generate several historical protection strategy generation experiences;

[0092] S2-4-7: Store several historical protection strategy generation experiences into the experience replay pool of the protection strategy generation model;

[0093] S2-5: Based on several historical protection strategies, a container resource scheduling model is constructed using the BiLSTM-Improved Fireworks Optimization Algorithm (IFWA) algorithm.

[0094] The container resource scheduling model includes a resource demand prediction module based on the BiLSTM algorithm and a container resource scheduling module based on the IFWA optimization algorithm.

[0095] The resource demand prediction module uses the deep structure of the BiLSTM network to explore the potential connection between protection strategies and resource requirements, and predict the corresponding resource requirements, action priorities, and impact range. The container resource scheduling module optimizes within the search space based on the objective function constructed based on resource demand information, action priorities, and impact range, ensuring efficient utilization of container cluster resources and maximizing protection effectiveness as optimization goals, ensuring that the implementation of protection plans is both efficient and adaptable.

[0096] S2-6: Set up the Hfish honeypot management node, collect the basic container information of each container in the container cluster, retrieve the corresponding container image, obtain the matching container image, and generate the corresponding honeypot element based on the matching container image;

[0097] Honeypot elements include the service framework protocol and server attributes for building the virtual server corresponding to the Hfish honeypot; Hfish honeypot elements are used to build the virtual server corresponding to the internal honeypot to construct the Hfish honeypot;

[0098] S2-7: Based on the honeypot elements, build the corresponding Hfish honeypot, set up traffic probes in the Hfish honeypot, distribute all Hfish honeypots, connect each Hfish honeypot to the Hfish honeypot management node to obtain the Hfish honeypot chain network, and set up a firewall between the Hfish honeypot chain network and the container cluster;

[0099] S3: Based on the user terminal, the real-time access request data is encrypted according to the private key to obtain the encrypted real-time access request data. The encrypted real-time access request data is signed according to the signature information to obtain the real-time signature data. The encrypted real-time access request data and the real-time signature data are uploaded to the cloud platform, including the following steps:

[0100] The formula is:

[0101] M u =E(SK u ,m u )

[0102] Where M uis the encrypted real-time access request data; E(*) is the asymmetric encryption function; m u Request data for real-time access; SK u is the private key of the data acquisition device u;

[0103] The formula is:

[0104]

[0105] Where r' is a random number; is the prime order; P is the base point of the prime field; H2 is the target hash function; K u For the signature information {K u ,KID u}Registration parameters of data acquisition device u; KID u For the signature information {K u ,KID u}Registration ID of data acquisition device u; ID u is the device ID of the data acquisition device u; the signature data is {ID u ,γ'={K u ,R u ,B u}}; R u ,B u ,γ' are the signature parameters of the data acquisition device u;

[0106] S4: Based on the cloud platform, the trusted institution is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data;

[0107] The formula is:

[0108] β u B u P=β u H2(R u ,ID u ,M u ,K u )R u +β u K u +β u H1(ID u ,K u )PK u

[0109] Where, β u PK is the signature verification parameter of the data acquisition device u; u is the public key of the data acquisition device u; if the left formula is equal to the right formula, the signature verification is successful;

[0110] m' u =E - (PK u ,M u )

[0111] Where m' u To access the requested data in real time after decryption; E - (*) is the asymmetric decryption function; M u1 PK is used to request data for real-time access after encryption. u is the public key of the data acquisition device u;

[0112] S5: Based on the cloud platform, an intrusion attack detection model is used to perform intrusion attack detection based on the decrypted real-time access request data to obtain a real-time intrusion attack detection result. If the real-time intrusion attack detection result indicates that an intrusion attack has occurred, the protection strategy generation step is entered. Otherwise, the user terminal's access rights are opened and the next step is entered, which includes the following steps:

[0113] S5-1: Based on the cloud platform, the decrypted real-time access request data is input into the intrusion attack detection model. The key feature extraction module is used to extract M real-time key features of the decrypted real-time access request data, where M is the total number of key features. The steps include:

[0114] S5-1-1: Use the RF structure trained in the key feature extraction module to extract the feature contribution of several real-time candidate features in the decrypted real-time access request data;

[0115] The formula is:

[0116]

[0117] Where, is the feature contribution of the j'th real-time candidate feature; is the feature contribution of the j'th real-time candidate feature in the i'th tree of the random forest; i' is the CART tree indicator; j' is the real-time candidate feature indicator; n is the total number of CARTs;

[0118]

[0119] Where, GI m GI l GI r" is the Gini index of CART tree node m, node l and node r" of random forest; p mk" is the proportion of category k" in CART tree node m; K is the total number of categories; m, l, r" are node indicators; k" is the category indicator;

[0120] S5-1-2: normalize the feature contributions of several real-time candidate features to obtain corresponding normalized feature contributions;

[0121] The formula is:

[0122]

[0123] Where VIM j' is the contribution of the feature after normalization; J is the total number of real-time candidate features;

[0124] S5-1-3: Generate feature selection standard values for several real-time candidate features based on the normalized feature contribution;

[0125] The formula is:

[0126]

[0127] Where, CFC j' The feature selection standard value for the j'th real-time candidate feature; VIM j* is the normalized feature contribution of the j*th real-time candidate feature; j* is the indicator of the candidate feature;

[0128] S5-1-4: Sort the real-time candidate features in descending order according to the feature selection standard value, and select the top M real-time candidate features as real-time key features to obtain M real-time key features;

[0129] S5-2: splicing the M real-time key features according to the first attention weight preset by the first attention weight module to obtain a first real-time splicing feature;

[0130] S5-3: Using an intrusion attack detection module, perform intrusion attack detection based on the first real-time splicing feature to obtain a real-time intrusion attack detection result;

[0131] S5-4: If the real-time intrusion attack detection result indicates that an intrusion attack exists, the process proceeds to the protection strategy generation step; otherwise, the user terminal's access rights are opened and the process proceeds to the access attack detection step;

[0132] S6: Based on the cloud platform, use the Hfish honeypot chain network to collect real-time access traffic data of user terminals. Based on the real-time access traffic data, use the access attack detection model to perform access attack detection and obtain the real-time access attack detection result. If the real-time access attack detection result indicates that an access attack exists, enter the protection strategy generation step. Otherwise, wait for the next user terminal to access, including the following steps:

[0133] S6-1: Based on the cloud platform, use the traffic probe of the Hfish honeypot chain network to collect real-time access traffic data of user terminals accessing the Hfish honeypot, and send the real-time access traffic data to the Hfish honeypot management node;

[0134] S6-2: Based on the Hfish honeypot management node, the real-time access traffic data is input into the access attack detection model. The dimension feature extraction module is used to extract the real-time dimension features of the real-time access traffic data in N key dimensions, where N is the total number of key dimensions.

[0135] S6-3: splicing the N real-time dimensional features according to the second attention weight preset by the second attention weight module to obtain a second real-time splicing feature;

[0136] S6-4: Using the access attack detection module, perform access attack detection based on the second real-time splicing feature to obtain a real-time access attack detection result;

[0137] S6-5: If the real-time access attack detection result indicates that an access attack exists, the process proceeds to the protection strategy generation step; otherwise, the process waits for the next user terminal to access.

[0138] S7: Based on the cloud platform, a protection policy generation model is used to generate a protection policy based on the real-time intrusion attack detection results or the real-time access attack detection results, thereby obtaining a real-time protection policy. Based on the real-time protection policy, a container resource scheduling model is used to schedule container resources, thereby obtaining a real-time container resource scheduling solution, including the following steps:

[0139] S7-1: Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, the corresponding historical protection strategy generation experience is retrieved from the experience replay pool of the protection strategy generation model to obtain several matching historical protection strategy generation experiences;

[0140] S7-2: Based on the experience of generating several matching historical protection strategies, the action space of the protection strategy generation model is updated to obtain the updated action space A'=[a'1,...,a' j" ,...,a' I ], where a' j" is the updated j-th "action value", j" is the action indicator, and I is the total number of action space dimensions;

[0141] S7-3: Update the state space A'=[a'1,...,a'1] of the protection strategy generation model based on the M real-time key features corresponding to the real-time intrusion attack detection results or the N real-time dimensional features corresponding to the real-time access attack detection results. j' ,...,a' I ], get the updated state space, where s'i" is the updated i-th state value, i" is the state indicator, and I' is the total number of state space dimensions;

[0142] S7-4: Use the updated state space as the input of the deep Q-network and use the agent to generate Q-values for each possible action in the updated action space.

[0143] S7-5: Use the reward function to obtain the reward value of each possible action in the updated action space, and update the Q value of the possible action according to the reward value to obtain the updated Q value of each possible action;

[0144] The formula is:

[0145] Q(s' p' ,a' p' )=(1-α")·Q(s p' ,a p' )+α"·(R(s p' ,a p' ,s' p' )+γ·Q max (s p' ,a p' ))

[0146] Where, Q(s' p' ,a' p' ) is the updated state value s' p' and updated action value a' p' The corresponding updated Q value; Q(s p' ,a p' ) is the state value s p' and action value a p' The corresponding predicted Q value; α" is the learning rate; Q max (s p' ,a p' ) is the highest predicted Q value; p' is the comprehensive indicator; γ is the update parameter;

[0147] S7-6: Repeat the above Q-value update until the predetermined number of iterations is reached, and use the greedy strategy to select the possible action with the highest updated Q-value in each iteration as the execution action, and generate a protection strategy based on the several execution actions to obtain a real-time protection strategy;

[0148] S7-7: Input the real-time protection policy into the container resource scheduling model, use the resource demand prediction module to perform resource demand prediction, and obtain the real-time resource demand prediction result;

[0149] The real-time resource demand prediction result maps the real-time protection strategy to the actual resource demand, action priority and impact range, including converting actions (such as adjusting firewall rules, enabling / disabling containers) into specific resource consumption (such as CPU usage, memory demand, bandwidth consumption, etc.), analyzing the importance of different operations according to the real-time protection strategy, and achieving this by analyzing the frequency characteristics of different operations in the strategy. The higher the frequency, the higher the priority may be. Analyze the impact of each action on the overall security of the container cluster, and achieve this by evaluating the characteristics of the operation on container service availability, data integrity, user privacy, etc., thereby providing a basis for subsequent resource scheduling implementation. In this application, prediction is made based on the potential relationship between the characteristics of the real-time protection strategy and resource demand, action priority and impact range, thereby improving analysis efficiency and accuracy;

[0150] S7-8: According to the real-time resource demand prediction results, the objective function of the container resource scheduling module is set. Based on the objective function, the container resource scheduling module is used to schedule container resources to obtain a real-time container resource scheduling solution, including the following steps:

[0151] S7-8-1: Set the objective function of the container resource scheduling module based on the resource demand index, action priority index, and impact range index included in the real-time resource demand prediction result;

[0152] The formula is:

[0153]

[0154] Where F is the objective function of the resource scheduling module; R i is the demand for resource i, including CPU resources (for example, the container requires a specific amount of CPU time, and the required CPU share determines the weight of the container relative to other containers in CPU resource allocation), memory resources (the maximum and minimum amount of memory that the container can use), storage resources (container-specific storage space for storing application data, log files, etc.), and network resources (the network bandwidth used by the container), etc.; P a is the priority of executing action a; C i is the action cost of resource i; I a is the impact range of action a; i is the resource indicator; a is the execution action indicator; n is the total number of resources; m is the total number of execution actions; resources include server resources, bandwidth resources and storage resources; W R 、W p 、W c are resource demand weight, action priority weight, and action cost weight;

[0155] S7-8-2: Initialize the container resource scheduling scheme, generate several initial solutions, and use the objective function as the fitness function of the initial solutions, including the following steps:

[0156] S7-8-2-1: Encode the resource scheduling solution generation problem and encode the container resource scheduling solution into an IFWA individual of the IFWA optimization algorithm;

[0157] S7-8-2-2: Use the Circle chaotic map sequence to initialize the IFWA population and obtain several initial solutions;

[0158]

[0159] Where q l' is the initial solution, i.e. the initial IFWA individual of the Circle chaos map; q * l' is the randomly generated initial IFWA individual; l' is the IFWA individual indicator;

[0160] S7-8-2-3: Take the objective function as the fitness function of the initial solution;

[0161] f(q)=F(q)

[0162] Where f(q) is the fitness value of IFWA individual q; F(q) is the objective function value of IFWA individual q; q is the IFWA individual referent variable;

[0163] S7-8-3: Based on the fitness function, iteratively optimize several initial solutions until a predetermined number of iterations are reached to obtain the optimal solution. Based on the optimal solution, a real-time container resource scheduling solution is obtained, including the following steps:

[0164] S7-8-3-1: Obtain the fitness value of each IFWA individual in the initialized IFWA population according to the fitness function;

[0165] S7-8-3-2: Get the explosion radius and number of sparks of each IFWA individual in the initialized IFWA population. The formula is:

[0166]

[0167] Where S l' is the initial IFWA individual q l' The number of sparks; M' is a constant; f max is the maximum fitness value in the initialized IFWA population; f(q l' ) is the initial IFWA individual q l' The fitness value of ; τ is an infinitesimal constant;

[0168]

[0169] Where R l' is the initial IFWA individual q l' blast radius; f is the explosion radius adjustment constant; min is the minimum fitness value in the initialized IFWA population;

[0170] S7-8-3-3: Based on the explosion radius and number of sparks of the initial IFWA individuals, perform a fireworks explosion to obtain an updated IFWA population. The formula is:

[0171] q' l' =q l' +S l' ×rand(-1,1)

[0172] Where q' l' is the updated IFWA individual; rand(-1,1) is a random number between -1 and 1;

[0173] S7-8-3-4: Use the Gaussian mutation algorithm to perform Gaussian mutation on the initialized IFWA population to generate a Gaussian mutated IFWA population. The formula is:

[0174] q" l' =q l' +S l' ×G(1,1)

[0175] Where, q" l' is an IFWA individual with Gaussian variation; G(1,1) is a random number with Gaussian distribution and mean and variance 1;

[0176] S7-8-3-5: Use the dynamic reverse learning algorithm to perform dynamic reverse learning on the initialized IFWA population to obtain the reverse IFWA population. The formula is:

[0177] q"' l' =γ(L max +L min )-q l'

[0178] Where, q"' l' is the reverse IFWA individual; γ is the decreasing inertia coefficient; L max , L min are the maximum and minimum values of the vector space respectively;

[0179] S7-8-3-6: Obtain the fitness values of the IFWA individuals of the updated IFWA population, the Gaussian-mutated IFWA population, and the reverse IFWA population, and take the IFWA individual with the minimum fitness value as the optimal individual;

[0180] S7-8-3-7: If the number of iterations reaches the threshold or the fitness value of the optimal individual meets the requirements, the optimal solution corresponding to the current optimal individual is output to obtain the optimal real-time container resource scheduling solution;

[0181] S8: Based on the cloud platform, adjust the real-time protection policy and schedule container resources for the container cluster according to the real-time container resource scheduling solution, obtain the adjusted real-time protection policy and the container cluster after resource scheduling, and execute the adjusted real-time protection policy based on the container cluster after resource scheduling, including the following steps:

[0182] S8-1: Adjust the real-time protection strategy based on the protection service support involved in the real-time resource scheduling plan to obtain an adjusted real-time protection strategy;

[0183] The real-time resource scheduling solution needs to reallocate the resources of the container that is under access attack. If the real-time protection strategy includes actions such as shutting down or restricting access to the container, the execution time of the real-time protection strategy needs to be adjusted to delay the execution and wait for resource allocation before taking action.

[0184] S8-2: Perform container resource scheduling on the container cluster according to the specific resource scheduling instructions in the real-time container resource scheduling plan, including adjusting the CPU resource weight of the container, allocating the maximum and minimum memory amounts of the container, etc., to obtain the container cluster after resource scheduling;

[0185] S8-3: Based on the container cluster after resource scheduling, execute the adjusted real-time protection strategy, including disabling containers and closing firewalls after resource scheduling is completed.

[0186] Example 2:

[0187] like Figure 2 As shown, this embodiment provides a container-based cluster security management system for implementing a cluster security management method. The system includes a cloud platform, a trusted organization, and several user terminals. The cloud platform and the trusted organization are respectively connected to the several user terminals in communication. In addition, an intrusion attack detection model, an access attack detection model, a protection strategy generation model, and a container resource scheduling model are provided in the container cluster of the cloud platform. The trusted organization is also connected to the cloud platform in communication.

[0188] The trusted institution is responsible for performing key generation and identity authentication for all user terminals connected to the cloud platform, obtaining the public-private key pair and signature information of each user terminal, returning the private key and signature information in the public-private key pair to the corresponding user terminal, and publishing the public key in the public-private key pair to the cloud platform;

[0189] The user terminal is configured to encrypt the real-time access request data according to the private key to obtain the encrypted real-time access request data, sign the encrypted real-time access request data according to the signature information to obtain the real-time signature data, and upload the encrypted real-time access request data and the real-time signature data to the cloud platform;

[0190] The cloud platform is used to build intrusion attack detection models, access attack detection models, protection strategy generation models and container resource scheduling models. According to the basic container information of each container in the container cluster, the corresponding Hfish honeypot is built, and the Hfish honeypot chain network is built based on several Hfish honeypots; the trusted organization is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data; according to the decrypted real-time access request data, the intrusion attack detection model is used to perform intrusion attack detection and obtain real-time intrusion attack detection results; the Hfish honeypot chain network is used to collect user The real-time access traffic data of the terminal is used, and an access attack detection model is used according to the real-time access traffic data to perform access attack detection and obtain real-time access attack detection results; according to the real-time intrusion attack detection results or the real-time access attack detection results, a protection strategy generation model is used to generate a protection strategy and obtain a real-time protection strategy; according to the real-time protection strategy, a container resource scheduling model is used to schedule container resources and obtain a real-time container resource scheduling plan; according to the real-time container resource scheduling plan, the real-time protection strategy is adjusted and the container cluster is scheduled for container resources to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling, and the adjusted real-time protection strategy is executed based on the container cluster after resource scheduling.

[0191] The present invention provides a container-based cluster security management method and system, which combine an asymmetric encryption algorithm and a signature verification mechanism to ensure the data security of communication between user terminals and cloud platforms, providing double guarantees for data transmission. The constructed intrusion attack detection model realizes static intrusion attack detection, and the access attack detection model realizes dynamic access attack detection, thereby enhancing the comprehensiveness of security management and improving the attack detection accuracy and security management effect. The protection strategy generation model can dynamically generate protection strategies based on real-time attack detection results, and combined with the container resource scheduling model, adjust resource allocation in real time to respond to security threats in an optimized manner, thereby improving the security protection level. After resource scheduling, the adjusted real-time protection strategy is executed, ensuring that the container cluster optimizes resource configuration while also strengthening security protection measures accordingly. The Hfish honeypot chain network can effectively trap attackers and collect attack information, providing strong support for real-time security management. The intrusion attack detection model, access attack detection model, protection strategy generation model, and container resource scheduling model are integrated to form a multi-level, comprehensive security management system that can adapt to different container clusters for security management, with strong practicality and high scalability.

[0192] The present invention is not limited to the above optional embodiments. Anyone can derive various other forms of products based on the teachings of the present invention. The above specific embodiments should not be construed as limiting the scope of protection of the present invention. The scope of protection of the present invention shall be based on the scope defined in the claims, and the description can be used to interpret the claims.

Claims

1. A container-based cluster security management method, characterized by: The steps include: Based on a trusted institution, key generation and identity authentication are performed on all user terminals connected to the cloud platform. The public-private key pair and signature information of each user terminal are obtained. The private key and signature information in the public-private key pair are returned to the corresponding user terminal, and the public key in the public-private key pair is published to the cloud platform. Based on the cloud platform, we build intrusion attack detection models, access attack detection models, protection strategy generation models, and container resource scheduling models. Based on the basic container information of each container in the container cluster, we build a corresponding Hfish honeypot. Then, we build an Hfish honeypot chain network based on several Hfish honeypots. The intrusion attack detection model is built based on the RF-Attention-BiLSTM algorithm; The intrusion attack detection model includes a key feature extraction module based on the RF algorithm, a first attention weight module based on the Attention mechanism, and an intrusion attack detection module based on the BiLSTM algorithm. The access attack detection model is built based on the N-GAN-Attention-BiLSTM algorithm; The access attack detection model includes N dimensional feature extraction modules built based on the GAN algorithm, a second attention weight module built based on the Attention mechanism, and an access attack detection module built based on the BiLSTM algorithm. The protection strategy generation model is constructed based on the DQN algorithm; The container resource scheduling model is built based on the BiLSTM-IFWA algorithm; The container resource scheduling model includes a resource demand prediction module based on the BiLSTM algorithm and a container resource scheduling module based on the IFWA optimization algorithm. Based on the user terminal, the real-time access request data is encrypted according to the private key to obtain the encrypted real-time access request data, the encrypted real-time access request data is signed according to the signature information to obtain the real-time signature data, and the encrypted real-time access request data and the real-time signature data are uploaded to the cloud platform; Based on the cloud platform, a trusted institution is called to perform signature verification on the real-time signature data. After the signature verification is passed, the encrypted real-time access request data is decrypted according to the public key of the corresponding user terminal to obtain the decrypted real-time access request data; Based on the cloud platform, the intrusion attack detection model is used to perform intrusion attack detection based on the decrypted real-time access request data to obtain real-time intrusion attack detection results. If the real-time intrusion attack detection result indicates that an intrusion attack has occurred, the protection strategy generation step is entered; otherwise, the user terminal's access rights are opened and the next step is entered; Based on the cloud platform, the Hfish honeypot chain network is used to collect real-time access traffic data of user terminals. Based on the real-time access traffic data, access attack detection is performed using the access attack detection model to obtain real-time access attack detection results. If the real-time access attack detection result indicates that an access attack exists, the protection strategy generation step is entered. Otherwise, the next user terminal access is waited for. Based on the cloud platform, according to the real-time intrusion attack detection results or the real-time access attack detection results, a protection strategy generation model is used to generate a protection strategy to obtain a real-time protection strategy. Based on the real-time protection strategy, a container resource scheduling model is used to schedule container resources to obtain a real-time container resource scheduling solution. Based on the cloud platform, the real-time protection strategy is adjusted and the container resources of the container cluster are scheduled according to the real-time container resource scheduling plan to obtain the adjusted real-time protection strategy and the container cluster after resource scheduling. The adjusted real-time protection strategy is executed based on the container cluster after resource scheduling.

2. The container-based cluster security management method according to claim 1, characterized in that: Based on the cloud platform, we build intrusion attack detection models, access attack detection models, protection strategy generation models, and container resource scheduling models. Based on the basic container information of each container in the container cluster, we build the corresponding Hfish honeypot. Then, we build an Hfish honeypot chain network based on several Hfish honeypots. The steps include: Based on the cloud platform, a number of historical access request data and a number of historical access flow data are collected and pre-processed respectively to obtain a number of pre-processed historical access request data and a number of pre-processed historical access flow data; Based on a number of pre-processed historical access request data, a deep learning algorithm is used to build an intrusion attack detection model and generate a number of historical intrusion attack detection results; Based on some pre-processed historical access traffic data, a deep learning algorithm is used to build an access attack detection model and generate some historical access attack detection results. Based on several historical intrusion attack detection results and several historical access attack detection results, a reinforcement learning algorithm is used to build a protection strategy generation model, generate several historical protection strategies and several historical protection strategy generation experiences, and store the historical protection strategy generation experiences in the experience replay pool of the protection strategy generation model; Based on several historical protection strategies, a fusion algorithm is used to build a container resource scheduling model; Set up the Hfish honeypot management node, collect the basic container information of each container in the container cluster, retrieve the corresponding container image, obtain the matching container image, and generate the corresponding honeypot element based on the matching container image; According to the honeypot elements, the corresponding Hfish honeypot is constructed, the traffic probe is set in the Hfish honeypot, all Hfish honeypots are distributedly connected, each Hfish honeypot is connected to the Hfish honeypot management node to obtain the Hfish honeypot chain network, and a firewall is set between the Hfish honeypot chain network and the container cluster.

3. The container-based cluster security management method according to claim 1, characterized in that: Based on the cloud platform, an intrusion attack detection model is used to perform intrusion attack detection based on the decrypted real-time access request data to obtain a real-time intrusion attack detection result. If the real-time intrusion attack detection result indicates that an intrusion attack has occurred, the protection strategy generation step is entered. Otherwise, the user terminal's access rights are opened and the next step is entered, which includes the following steps: Based on the cloud platform, the decrypted real-time access request data is input into the intrusion attack detection model to extract M real-time key features of the decrypted real-time access request data, where M is the total number of key features; According to the preset first attention weight, the M real-time key features are spliced to obtain a first real-time splicing feature; Perform intrusion attack detection based on the first real-time splicing feature to obtain a real-time intrusion attack detection result; If the real-time intrusion attack detection result is that an intrusion attack exists, the protection strategy generation step is entered; otherwise, the access rights of the user terminal are opened and the access attack detection step is entered.

4. The container-based cluster security management method according to claim 1, characterized in that: Based on the cloud platform, the Hfish honeypot chain network is used to collect real-time access traffic data of user terminals. Based on the real-time access traffic data, access attack detection is performed using the access attack detection model to obtain real-time access attack detection results. If the real-time access attack detection result indicates that an access attack exists, the protection strategy generation step is entered. Otherwise, the next user terminal access is waited for, including the following steps: Based on the cloud platform, the traffic probe of the Hfish honeypot chain network is used to collect real-time access traffic data of user terminals accessing the Hfish honeypot, and send the real-time access traffic data to the Hfish honeypot management node; Based on the Hfish honeypot management node, the real-time access traffic data is input into the access attack detection model to extract the real-time dimension features of the real-time access traffic data in N key dimensions, where N is the total number of key dimensions; According to the preset second attention weight, N real-time dimension features are spliced to obtain a second real-time splicing feature; Perform access attack detection based on the second real-time splicing feature to obtain a real-time access attack detection result; If the real-time access attack detection result is that an access attack exists, the protection strategy generation step is entered; otherwise, the process waits for the next user terminal to access.

5. The container-based cluster security management method according to claim 1, characterized in that: Based on the cloud platform, a protection strategy generation model is used to generate a protection strategy based on real-time intrusion attack detection results or real-time access attack detection results, thereby obtaining a real-time protection strategy. Based on the real-time protection strategy, a container resource scheduling model is used to schedule container resources, thereby obtaining a real-time container resource scheduling solution. The steps include the following: Based on the cloud platform, the action space and state space of the protection strategy generation model are updated according to the real-time intrusion attack detection results or the real-time access attack detection results, and the updated action space and state space are obtained; The updated state space is used as the input of the deep Q network, and the agent is used to generate the Q value of each possible action in the updated action space. Use the reward function to obtain the reward value of each possible action in the updated action space, and update the Q value of the possible action based on the reward value to obtain the updated Q value of each possible action; Repeat the above Q-value update until the predetermined number of iterations is reached, and use the greedy strategy to select the possible action with the highest updated Q-value in each iteration as the execution action. Then, generate a protection strategy based on several execution actions to obtain a real-time protection strategy. Input the real-time protection strategy into the container resource scheduling model to perform resource demand forecasting and obtain the real-time resource demand forecast results; According to the real-time resource demand prediction results, an objective function is set, and based on the objective function, container resource scheduling is performed to obtain a real-time container resource scheduling solution.

6. The container-based cluster security management method according to claim 5, characterized in that: According to the real-time resource demand prediction results, an objective function is set. Based on the objective function, container resource scheduling is performed to obtain a real-time container resource scheduling solution, which includes the following steps: Setting an objective function based on the resource demand index, action priority index, and impact range index included in the real-time resource demand prediction result; Initialize the container resource scheduling scheme, generate several initial solutions, and use the objective function as the fitness function of the initial solutions; Based on the fitness function, several initial solutions are iteratively optimized to reach a predetermined number of iterations to obtain the optimal solution, and based on the optimal solution, a real-time container resource scheduling solution is obtained.

7. A container-based cluster security management system, used to implement the cluster security management method according to any one of claims 1 to 6, characterized in that: The system includes a cloud platform, a trusted organization and several user terminals. The cloud platform and the trusted organization are respectively connected to the several user terminals in communication. The container cluster of the cloud platform is provided with an intrusion attack detection model, an access attack detection model, a protection strategy generation model and a container resource scheduling model. The trusted organization is also connected to the cloud platform in communication.

Images