Resource scheduling method, device and equipment during attack defense in multi-autonomous-domain network

Abstract

The invention discloses a resource scheduling method, device and equipment during attack defense in a multi-autonomous-domain network, and the method comprises the steps: locking a to-be-allocated resource for each autonomous domain in the network as a decision variable when a DDoS attack is detected; determining the sum of the occupied resources of each attacked autonomous domain in the network by the attacker as a target function; determining an allocable resource range of each autonomous domain according to the resource sum of the multiple autonomous domains, and determining that the to-be-allocated resource of each autonomous domain does not exceed the corresponding resource range as a constraint condition; combining decision variables of each autonomous domain into blocks, and iteratively solving each block by using a block joint descent method by taking minimization of the target function as a target under the condition that the constraint condition is met; and when iteration is finished, resources are allocated to the autonomous domains according to the decision variables in the blocks of the autonomous domains. Therefore, the problem that an existing DDoS attack defense scheme cannot timely and reasonably perform optimal scheduling on resources is solved.

Description

Background Art

[0002] With the development of the Internet of Things (IoT), there are more and more devices that lack security mechanisms in the network. The security vulnerabilities of these devices make them easier for hackers to control through malicious programs, thereby building botnets and launching distributed denial of service (DDoS) attacks. DDoS attacks have a long history, but in recent years, the damage caused by hackers has become increasingly serious due to the increase in hacker attack capabilities. Many network scenarios such as the Internet of Things, space-based networks, and industrial Internet of Things have become the hardest hit areas for the proliferation of DDoS attacks. From an industry perspective, government, medical, financial, educational, cultural and entertainment fields are also possible targets for hackers. DDoS attacks mainly achieve the effect of denial of service by exhausting resources in the target network, which means that if resources can be optimally scheduled in a timely and reasonable manner when encountering an attack, the impact of DDoS attacks can be mitigated to the greatest extent.

[0003] Current measures to curb DDoS attacks often focus on sharing or transmitting blacklist addresses between different autonomous domains. When an autonomous domain is attacked, malicious Internet Protocol (IP) addresses are discovered in a timely manner and intercepted in other autonomous domains. However, this solution cannot achieve timely and reasonable optimal scheduling of resources. Summary of the invention

[0004] The purpose of this application is to provide a resource scheduling method, device and equipment for defending against attacks in a multi-autonomous domain network, which is used to solve the problem that the existing solution for defending against DDoS attacks cannot timely and reasonably perform optimal resource scheduling.

[0005] In a first aspect, an embodiment of the present application provides a resource scheduling method for defending against attacks in a multi-autonomous domain network, the method comprising:

[0006] When a DDoS attack is detected, the resources to be allocated for each autonomous domain in the network are locked as decision variables;

[0007] The sum of resources occupied by the attacker in each attacked autonomous domain in the network is determined as the objective function;

[0008] According to the resource range of each autonomous domain determined by the sum of resources of multiple autonomous domains, it is determined as a constraint condition that the resources to be allocated to each autonomous domain do not exceed the corresponding resource range;

[0009] The decision variables of each autonomous domain are combined into blocks, and the block joint descent method is used to iteratively solve each block with the goal of minimizing the objective function under the constraint condition;

[0010] At the end of the iteration, resources are allocated to each autonomous domain according to the decision variables in the blocks of the autonomous domain.

[0011] In some possible embodiments, locking resources to be allocated to each autonomous domain in the network as decision variables includes:

[0012] The bandwidth resources B to be allocated to each autonomous domain of the network i , computing and processing resources C i and memory storage resources M i At least one of them is locked as a decision variable;

[0013] Among them, i=1,2,…,n, n is the number of autonomous domains in the network, and i is the number of the autonomous domain.

[0014] In some possible embodiments, the sum of resources occupied by the attacker in each attacked autonomous domain in the network is determined as the objective function, including:

[0015] Determine the sum of the basic idle resource item and the attack information item, and then subtract the resource coupling item as the objective function;

[0016] The basic idle resource item is the sum of the ratios of the resources remaining after the multiple autonomous domains provide services in the network to the total resources of the multiple autonomous domains;

[0017] The attack information item is used to indicate the coupling relationship between different resources of the attacked autonomous domain determined according to the resource consumption of the attacked autonomous domain by the DDos attack launched by the attacker;

[0018] The resource coupling item is used to indicate the capability of other autonomous domains in the network to provide resource support relative to the attacked autonomous domain.

[0019] In some possible embodiments, the basic idle resource item is:

[0020]

[0021] Among them, X(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is the basic idle resource item, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, Ci.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain.

[0022] In some possible embodiments, the attack information item is:

[0023]

[0024] Among them, Y(B j ,C j ,M j ) is the attack information item, α is the first correction coefficient, V is the consumption of bandwidth resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, R is the consumption of computing resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, D is the consumption of memory resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M It is the adjustment factor of memory storage resources.

[0025] In some possible embodiments, the resource coupling item is:

[0026]

[0027] Among them, Z(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is the resource coupling term, β is the second correction coefficient, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M is the adjustment factor of memory storage resources, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max It is the sum of memory storage resources of multiple autonomous domains.

[0028] In some possible embodiments, the constraints include:

[0029] B i ≤B max -B i,0 , C i ≤C max -C i,0 、Mi ≤M max -M i,0 ;

[0030] B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain.

[0031] In some possible embodiments, each block is iteratively solved using a block joint descent method, including:

[0032] When a new round of iteration is triggered, the blocks of each autonomous domain are optimized one by one. When optimizing the blocks of the current autonomous domain, the blocks of other autonomous domains remain unchanged.

[0033] At the end of the current round of iteration, if the difference between the blocks in the last two rounds of each autonomous domain is less than the set threshold or the number of iterations reaches the set number or the objective function is less than the set target value, the iteration is stopped, otherwise a new round of iteration is triggered.

[0034] In a second aspect, an embodiment of the present application provides a resource scheduling device for defending against attacks in a multi-autonomous domain network, including:

[0035] A decision variable locking module is used to lock the resources to be allocated to each autonomous domain in the network as decision variables when a DDoS attack is detected;

[0036] The target function determination module is used to determine the sum of the resources occupied by the attacker in each attacked autonomous domain in the network as the target function;

[0037] A constraint condition determination module, used to determine the resource range that can be allocated to each autonomous domain according to the sum of resources of multiple autonomous domains, and to determine as a constraint condition that the resources to be allocated to each autonomous domain do not exceed the corresponding resource range;

[0038] A block solving module is used to combine the decision variables of each autonomous domain into blocks, and iteratively solve each block by using a block joint descent method with the goal of minimizing the objective function under the constraints;

[0039] The resource allocation module is used to allocate resources to each autonomous domain according to the decision variables in the blocks of each autonomous domain at the end of iteration.

[0040] In the third aspect, another embodiment of the present application also provides a resource scheduling device for defending against DDoS attacks in a multi-autonomous domain network, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any resource scheduling method for defending against DDoS attacks in a multi-autonomous domain network provided in the embodiments of the present application.

[0041] In a fourth aspect, another embodiment of the present application further provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute a resource scheduling method for defending against DDoS attacks in any multi-autonomous domain network provided in an embodiment of the present application.

[0042] The resource scheduling method, device and equipment for defending against DDoS attacks in a multi-autonomous domain network provided in the embodiments of the present application improve the pertinence of the solution by locking the variable factors that can be used for scheduling and allocation; determine the mapping relationship between the real physical world and the theoretical model by establishing an objective function, thereby improving the actual value of the solution; determine the maximum and minimum values ​​of various resources that can be used for allocation based on the total resources of the multiple autonomous domains, thereby further narrowing the optimization scope and improving the feasibility of the solution; based on the iterative solution optimization mechanism of the block joint descent method, the decision variables are divided into blocks according to the autonomous domains to which they belong, and the decision variables of each block are iteratively updated, and multiple rounds of cyclic iterations are used to solve the optimal resource combination that each autonomous domain should have when resisting the attack, thereby improving the overall defense efficiency of the defender from a macro defense perspective.

[0043] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 is a schematic diagram of an application environment according to an embodiment of the present application;

[0046] Figure 2 A schematic diagram of a resource scheduling method for defending against DDoS attacks in a multi-autonomous domain network according to an embodiment of the present application;

[0047] Figure 3 A schematic diagram of an iterative solution optimization process based on a block joint descent method according to an embodiment of the present application;

[0048] Figure 4 A schematic diagram of a resource scheduling method for defending against DDoS attacks in a multi-autonomous domain network according to an example of an embodiment of the present application;

[0049] Figure 5 A diagram of a resource scheduling device for defending against DDoS attacks in a multi-autonomous domain network according to an embodiment of the present application;

[0050] Figure 6 This is a structural diagram of a resource scheduling device for defending against DDoS attacks in a multi-autonomous domain network according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method can be executed in the order of the method shown in the embodiment or drawings or in parallel during the actual processing process or when the control device is executed.

[0052] The existing network space can often be divided into multiple autonomous systems (AS), and for an autonomous system, it can be further divided into network areas or sub-domains. When hackers launch DDoS attacks on network targets in a certain autonomous system, they can call on resources from other autonomous systems to mitigate them, or distribute and optimize resource scheduling in multiple autonomous systems to achieve the goal of curbing DDoS attacks to the greatest extent.

[0053] However, there is no solution in the related technology to conduct theoretical analysis and optimization design of the relevant network resources required for defense against attacks. If the scenario can be established as a convex optimization problem, and the multiple coupled key network resource variables can be iteratively optimized using distributed optimization methods, then the actual physical scenario can be modeled, a convex function model can be constructed and solved using the block joint descent method, and the optimal solution of the function under certain constraints can be obtained, providing theoretical support for the joint resource scheduling and allocation strategy between multiple autonomous domains.

[0054] The application scenarios of the resource scheduling method for defending against attacks in a multi-autonomous domain network provided by the embodiment of the present application are as follows: Figure 1 As shown in the figure, the multi-domain network includes autonomous domains AS1, AS2, and AS3. The attacker launches a DDoS attack against autonomous domain AS1, which consumes resources in the attacked autonomous domain AS1. In this network scenario, when the hacker sends DDoS attack traffic from autonomous domain AS1 into the entire network, the defender needs to adjust the resource allocation plan for each autonomous domain in a timely manner to maintain the availability of the network, and prepare to implement other related security measures.

[0055] The technical terms involved in the embodiments of this application are explained as follows:

[0056] IoT (Internet of Things): "Internet of Everything" is an extension and expansion of the Internet, which enables the interconnection of people, machines and things at any time and any place.

[0057] DDoS (Distributed denial of service): A distributed denial of service attack occurs when multiple attackers in different locations simultaneously attack one or more targets, or when an attacker controls multiple machines in different locations and uses them to attack the victim simultaneously.

[0058] Convex Optimization: Convex optimization is a subfield of mathematical optimization that studies the problem of minimizing convex functions defined in convex sets. Convex optimization is applied to many disciplines, such as automatic control systems, signal processing, communications and networks, electronic circuit design, data analysis and modeling, statistics (optimization design), and finance.

[0059] AS (Autonomous system): An autonomous domain refers to the combination of all IP networks and routers under the jurisdiction of one or more entities on the Internet, which jointly implement the same routing policy.

[0060] Block Coordinate Descent: Block Coordinate Descent groups the problem variables into several "blocks" and performs iterative optimization block by block. In each iteration, the variables of one or more blocks are selected for optimization, while the variables of other blocks are fixed. This method is particularly suitable for optimization problems with strong coupling between variables but tighter coupling within blocks.

[0061] The embodiment of the present application provides a resource scheduling method when defending against attacks in a multi-autonomous domain network. In order to fill the gap of lack of theoretical guidance in the joint resource scheduling of multiple autonomous domains when defending against DDoS attacks in the existing network, the embodiment of the present application is linked to the real network scenario, combined with the convex optimization theory to establish the objective function to be optimized, and the decision variables are locked by using the attack characteristics and network resources. The constraints are determined based on multiple limiting factors, and the block joint descent method is used to decouple and iteratively solve the problem, so as to achieve the optimal allocation of resources for each autonomous domain, and provide a theoretical basis for each autonomous domain to further optimize and adjust the defense strategy and determine the range of available resources in the domain, thereby protecting the valuable resources in the network and ensuring the service availability of users.

[0062] like Figure 2 As shown, the resource scheduling method for defending against attacks in a multi-autonomous domain network provided in an embodiment of the present application includes:

[0063] Step 201, when a DDoS attack is detected, resources to be allocated to each autonomous domain in the network are locked as decision variables;

[0064] The existing DDoS attacks, in order to achieve the effect of denial of service, can basically be considered as consuming the relevant resources of the autonomous domain in the network to achieve the effect of denial of service. Therefore, in the embodiment of the present application, the decision variables are locked by using the attack information and the main resource types to determine the relevant network resources that play a major role in resisting the attack, and the decision variables are set to the resources to be allocated for each autonomous domain. In the embodiment of the present application, the resources to be allocated for each autonomous domain are the resources allocated to each autonomous domain after executing resource scheduling. The resources to be allocated are resources determined from the available resources, and the available resources do not include the resources required to maintain the basic network services of the autonomous domain.

[0065] Step 202, determining the total amount of resources occupied by the attacker in each attacked autonomous domain in the network as the objective function;

[0066] The resources in each autonomous domain may include at least one resource, and the resources are determined specifically according to the resources required to provide network services. When an attacker launches a DDoS attack on an autonomous domain, the attacked autonomous domain will have corresponding resource consumption. In the embodiment of the present application, the sum of the resources occupied by the attacker in each attacked autonomous domain in the network is determined as the objective function. If the sum of the resources occupied by each attacked autonomous domain in the network is minimized, the effect of denial of service can be achieved.

[0067] Step 203, determining the resource range that can be allocated to each autonomous domain according to the sum of resources of multiple autonomous domains, and determining that the resources to be allocated to each autonomous domain do not exceed the corresponding resource range as a constraint condition;

[0068] The sum of resources of multiple autonomous domains is the sum of available resources in the autonomous domain network. Based on the sum of resources, the range of resources that can be allocated to each autonomous domain can be determined. Then, the resource to be allocated to each autonomous domain does not exceed the corresponding resource range, which is determined as a constraint condition.

[0069] Step 204, combining the decision variables of each autonomous domain into blocks, and iteratively solving each block by using a block joint descent method with the goal of minimizing the objective function under the constraints;

[0070] When the resources of an autonomous domain include multiple items, multiple decision variables are included accordingly. The multiple decision variables of an autonomous domain are combined into blocks, and the block joint descent method is used to iteratively solve each block. During the specific iteration, the value of the block after the iteration is determined. The above-mentioned constraints need to be satisfied and the objective is to minimize the objective function. For the specific iterative calculation method, please refer to the calculation method of the block joint descent method in the related technology, which will not be described in detail in this embodiment.

[0071] Step 205: when the iteration ends, resources are allocated to each autonomous domain according to the decision variables in the blocks of the autonomous domain.

[0072] According to the optimization solution results of the decision variables in the blocks of each autonomous domain, the optimal resource allocation plan for each subdomain is determined, and network resources are allocated for the subdomain to defend against DDoS attacks.

[0073] The embodiment of the present application locks the resources of each autonomous domain as a decision variable. Specifically, according to the different types of main resources in each autonomous domain in the network and the impact and attack method of DDoS attacks on the network, the variable factors that can be used for scheduling and allocation can be locked, thereby improving the pertinence of the solution; a method for establishing an objective function is proposed, and according to the impact of DDoS attacks on multi-autonomous domain networks, an objective function that maps the total occupation of resources of each attacked autonomous domain in the network by the attacker is established, and the mapping relationship between the real physical world and the theoretical model is determined, thereby improving the actual value of the solution; a method for determining constraints is proposed, and according to the total resources of multiple autonomous domains, the maximum and minimum values ​​of various resources of the autonomous domains that can be used for allocation are determined, thereby further narrowing the optimization scope and improving the feasibility of the solution; an iterative solution optimization mechanism based on the block joint descent method is proposed, and the decision variables are divided into blocks according to the autonomous domains to which they belong, and then the decision variables of each block are iteratively updated, and multiple rounds of cyclic iterations are used to solve the optimal resource combination that each autonomous domain should have when resisting the attack, thereby improving the overall defense efficiency of the defender from a macro defense perspective.

[0074] Based on this, the embodiments of the present application can, in existing multi-autonomous domain network scenarios, quickly calculate the most effective resource allocation plan required to resist attacks based on the maximum resources owned or dispatchable by the defender and the attacker's attack information, thereby providing a theoretical basis for the subsequent defense of each autonomous domain, protecting network resources while ensuring user service availability.

[0075] In some possible embodiments, the resources to be allocated to each autonomous domain in the network are locked as decision variables, including: the bandwidth resources B to be allocated to each autonomous domain in the network i , computing and processing resources C i and memory storage resources M i At least one of them is locked as a decision variable;

[0076] Wherein i=1,2,…,n, n is the number of autonomous domains in the network, and i is the number of the autonomous domain.

[0077] In order to achieve the effect of denial of service, the existing DDoS attacks can basically be considered as the attacker consuming the bandwidth resources, computing resources, and storage resources in the network to achieve the effect of denial of service. Therefore, in the embodiment of the present application, the decision variables are set to the bandwidth resources, computing resources, and memory storage resources of each autonomous domain. The defender needs to allocate these resources before the network can be alleviated. Therefore, the decision variables in the embodiment of the present application are set to the bandwidth resources B allocated to each autonomous domain when defending against attacks. i , computing and processing resources C i 、Memory storage resources M i , where i = 1, 2, …, n, and n is the number of autonomous domains in the network.

[0078] After determining the decision variables, the most critical step is to determine the objective function. According to the convex optimization theory, a multi-factor coupled objective function is established, and the size of various resources that should be allocated to different autonomous domains is obtained through the objective function. The attacker performs DDoS on several autonomous domains to consume their various resources, so the objective function is set to the sum of the attacker's occupation of various resources in all attacked autonomous domains in the entire network, expressed as G. In order to appropriately simplify the model while ensuring its practical significance, according to the above-mentioned consumption of resources by the attacker, the embodiment of the present application divides the objective function into three parts, namely, the basic idle resource item, the resource coupling item and the attack information item. Among them, the basic idle resource item is the sum of the proportion of the remaining resources in the network that are left after multiple autonomous domains provide services; the attack information item is used to indicate the coupling relationship of different resources in the attacked autonomous domain determined according to the resource consumption of the attacked autonomous domain launched by the attacker; the resource coupling item is used to indicate the ability of other autonomous domains in the network to provide resource support relative to the attacked autonomous domain. Determine the sum of the basic idle resource item and the attack information item, and then subtract the resource coupling item as the objective function.

[0079] The ultimate goal of the embodiment of the present application is to minimize the target function G, so as to minimize the impact of the attacker's resource occupation by reasonable allocation of resources. The target function G can be expressed as:

[0080]

[0081] Among them, X(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is the basic idle resource item, Y(B j ,C j ,M j ) is the attack information item, Z(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is a resource coupling item.

[0082] In some possible embodiments, the basic idle resource items are:

[0083]

[0084] Among them, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain, ω b is the weight of the impact of bandwidth resources on network services, ω c is the weight of the impact of computing processing resources on the network services provided, ω m It is the weight of the proportion of memory storage resources in providing services to the network. The above weight depends on the relevant network conditions. The weight of network resources that are sensitive to network service provision can be set larger, or the same value can be used. The basic idle resource item mainly represents the sum of the proportions of each resource remaining in each autonomous domain in the network in addition to providing services, and then the proportions of each autonomous domain are summed to obtain the basic idle resource direction. The more unbalanced this part is, the larger the objective function is, indicating that the attacker has a greater impact on the network, and vice versa.

[0085] In some possible embodiments, the above attack information items are:

[0086]

[0087] Where α is the first correction coefficient, V is the consumption of bandwidth resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, R is the consumption of computing resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, D is the consumption of memory resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M is the adjustment factor of memory storage resources. The above adjustment factor can be set according to the impact of resources. The adjustment factor of the setting with greater impact is larger. The above first correction coefficient is a set parameter. The attack information item mainly represents the coupling relationship between different resources of the attacked autonomous domain. The less the strength of the resources of the attacked j-th autonomous domain is relative to the attacker, the greater the impact of the attack and the greater the objective function.

[0088] In some possible embodiments, the resource coupling items are:

[0089]

[0090] Among them, Z(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is the resource coupling term, β is the second correction coefficient, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M is the adjustment factor of memory storage resources, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max The second correction coefficient is a set parameter. The functional relationship here expresses the resource support capability of other autonomous domains in the network relative to the attacked autonomous domain. The larger the part, the more reasonable the resource allocation, and the smaller the corresponding objective function.

[0091] In some possible embodiments, the above constraints include:

[0092] B i ≤B max -B i,0 , C i ≤C max -C i,0 、M i ≤M max-M i,0 ;

[0093] B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain. The maximum value of the resources to be allocated is limited by the above constraints. The significance of these constraints is mainly to limit the resource scheduling range of each autonomous domain, that is, not exceeding the maximum available capacity of the entire network, so that the entire model is closer to the actual situation and is convenient for increasing the actual value of the optimized resource allocation plan.

[0094] In some possible embodiments, each block is iteratively solved using a block joint descent method, including:

[0095] When a new round of iteration is triggered, the blocks of each autonomous domain are optimized one by one. When optimizing the blocks of the current autonomous domain, the blocks of other autonomous domains remain unchanged.

[0096] At the end of the current round of iteration, if the difference between the blocks in the last two rounds of each autonomous domain is less than the set threshold or the number of iterations reaches the set number or the objective function is less than the set target value, the iteration is stopped, otherwise a new round of iteration is triggered.

[0097] After determining the objective function, decision variables and constraints, the embodiment of the present application can use the block joint descent method to solve the model. The embodiment of the present application determines the block standard of the decision variables and divides the bandwidth resources B of the same autonomous domain into i , computing resources C i 、Memory storage resources M iDivide into a group, so that all decision variables will be divided into several blocks with the same number of autonomous domains. In addition, the initial value of each decision variable needs to be set, such as the resources can be evenly distributed at the beginning. Then the whole process is divided into multiple rounds of iterations. Each round of iteration will iterate each block one by one. When iterating the block, multiple decision variables in the block will be iterated at the same time. In each round of single iteration for a certain block, the variables of other blocks are fixed, and only the variables of the current block are optimized. The decision variables of other blocks are regarded as constants. When calculating the optimal solution for the decision variables of the current block, the method that can be used is to use the partial derivative of the objective function with respect to the current block variable to obtain the extreme value point. The specific calculation process can refer to the relevant technical description, which will not be repeated here. After completing a round of iteration of all blocks, the next round of iteration begins. Until the difference between the iteration results of two consecutive rounds is less than the set threshold, that is, the changes of all decision variables are less than the set threshold, the iteration is stopped. Or if other iteration stopping conditions are met, such as the number of iterations exceeds the set number or the objective function is less than the set target value, the iteration will be stopped and the final decision variable will be output as the resource allocation plan.

[0098] like Figure 3 The figure shows the iterative process of solving the convex optimization problem using the block joint descent method, which mainly includes: setting the initial value of the iteration of the decision variable according to the constraint conditions; starting a new round of iteration, iteratively updating each variable according to the above process, that is, bandwidth resources B, computing processing resources C, and memory storage resources M; at the end of this round, calculating the difference between the decision variables B, C, and M in two adjacent rounds; if the difference values ​​are all less than the set threshold, it is determined that the termination condition is met and the optimal resource allocation plan is output, otherwise the next round of iteration is triggered.

[0099] The following is a specific example of a resource scheduling method for defending against attacks in a multi-autonomous domain network provided by an embodiment of the present application. Figure 4 As shown, it mainly includes:

[0100] Step 401, clarify the types of resources that can be called upon in each autonomous domain, such as bandwidth resources, computing processing resources, and memory storage resources, so as to lock the decision variables.

[0101] The subsequent optimization of the embodiment of the present application is achieved by adjusting different types of resources in different autonomous domains, and finally achieving the optimal defense effect. For example, there are 5 sub-autonomous domains in the network, n=5.

[0102] Step 402, establishing an objective function based on convex optimization theory and the actual network environment. The objective function is the sum of the resources occupied by the attacker in each attacked autonomous domain in the network. The minimum objective function represents the impact when the attacker's attack degree is reduced to the minimum.

[0103] The specific establishment of the objective function refers to the description of the above embodiment, which will not be repeated here.

[0104] Step 403, determining the maximum value of all decision variables currently in the network, thereby determining the constraint conditions;

[0105] For example, the autonomous domain currently under attack is AS1, and the available bandwidth resources of all ASs in the network are 10Tbps (10Tbits per second), computing and processing resources are 100,000RPS (processing 100,000 requests per second), and memory storage resources are 1TB. If it is attacked by a mixed type of DDoS attack at this time, the intensity is 5000Gbps, 50,000RPS, which will occupy 500GB of memory. At the same time, each other autonomous domain has its own service tasks. In order to meet the normal service load, it needs to consume bandwidth resources of 500Gbps, computing and processing resources of 5000RPS, and memory resources of 5GB. The available bandwidth resources B can be determined based on this. i , computing and processing resources C i 、Memory storage resources M i range, that is, the bandwidth resources to be allocated shall not exceed the available bandwidth resources, and the available bandwidth resources are the sum of the bandwidth resources of multiple autonomous domains minus the bandwidth resources required to maintain basic network services; that is, the computing and processing resources to be allocated shall not exceed the available computing and processing resources, and the available computing and processing resources are the sum of the computing and processing resources of multiple autonomous domains minus the computing and processing resources required to maintain basic network services; that is, the memory storage resources to be allocated shall not exceed the available memory storage resources, and the available memory storage resources are the sum of the memory storage resources of multiple autonomous domains minus the memory storage resources required to maintain basic network services.

[0106] Step 404: After determining the objective function, decision variables and constraints, the command center will start calculating the optimal allocation plan for the entire network resources under the current attack according to the set program. The block descent method is used to solve the decision variables of different autonomous domains.

[0107] After setting the initial iteration starting value, start solving resource iterations for each autonomous domain. The starting value can be the result of average distribution. And set the number of iterations t max =500, or the difference between the allocation solutions of two consecutive iterations is less than the threshold value such as tol B =10,tol C =20,tol C =5, then stop the iteration and output the B of each autonomous domain at this time i ,C i ,M i , that is, the optimal allocation solution is obtained.

[0108] Step 405: determine the optimal resource allocation plan based on the optimization solution, and allocate network resources to each autonomous domain to resist DDoS attacks.

[0109] Based on the same inventive concept, the present application also provides a resource scheduling device for defending against attacks in a multi-autonomous domain network, such as Figure 5 As shown, including:

[0110] A decision variable locking module 501 is used to lock the resources to be allocated to each autonomous domain in the network as decision variables when a DDoS attack is detected;

[0111] The target function determination module 502 is used to determine the sum of the resources occupied by the attacker in each attacked autonomous domain in the network as the target function;

[0112] A constraint condition determination module 503, configured to determine the resource range that can be allocated to each autonomous domain according to the total resources of the multiple autonomous domains, and to determine as a constraint condition that the resources to be allocated to each autonomous domain do not exceed the corresponding resource range;

[0113] A block solving module 504 is used to combine the decision variables of each autonomous domain into blocks, and iteratively solve each block by using a block joint descent method with the goal of minimizing the objective function under the constraints;

[0114] The resource allocation module 505 is used to allocate resources to each autonomous domain according to the decision variables in the blocks of each autonomous domain when the iteration ends.

[0115] In some possible embodiments, locking resources to be allocated to each autonomous domain in the network as decision variables includes:

[0116] The bandwidth resources B to be allocated to each autonomous domain of the network i , computing and processing resources C i and memory storage resources M i At least one of them is locked as a decision variable;

[0117] Where i = 1, 2, ..., n, n is the number of autonomous domains in the network, and i is the number of the autonomous domain.

[0118] In some possible embodiments, the target function determination module determines the sum of resources occupied by the attacker in each attacked autonomous domain in the network as the target function, including:

[0119] Determine the sum of the basic idle resource item and the attack information item, and then subtract the resource coupling item as the objective function;

[0120] The basic idle resource item is the sum of the ratios of the resources remaining after the multiple autonomous domains provide services in the network to the total resources of the multiple autonomous domains;

[0121] The attack information item is used to indicate the coupling relationship between different resources of the attacked autonomous domain determined according to the resource consumption of the attacked autonomous domain by the DDos attack launched by the attacker;

[0122] The resource coupling item is used to indicate the capability of other autonomous domains in the network to provide resource support relative to the attacked autonomous domain.

[0123] In some possible embodiments, the basic idle resource item is:

[0124]

[0125] Among them, X(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is the basic idle resource item, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain.

[0126] In some possible embodiments, the attack information item is:

[0127]

[0128] Among them, Y(B j ,C j ,M j ) is the attack information item, α is the first correction coefficient, V is the consumption of bandwidth resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, R is the consumption of computing resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, D is the consumption of memory resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M It is the adjustment factor of memory storage resources.

[0129] In some possible embodiments, the resource coupling item is:

[0130]

[0131] Among them, Z(B 1 ,C 1 ,M 1 ,…,B n ,C n ,M n ) is the resource coupling term, β is the second correction coefficient, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M is the adjustment factor of memory storage resources, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max It is the sum of memory storage resources of multiple autonomous domains.

[0132] In some possible embodiments, the constraints include:

[0133] B i ≤B max -B i,0 , C i ≤C max -C i,0 、M i ≤M max -M i,0 ;

[0134] B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain.

[0135] In some possible embodiments, the block solving module uses a block joint descent method to iteratively solve each block, including:

[0136] When a new round of iteration is triggered, the blocks of each autonomous domain are optimized one by one. When optimizing the blocks of the current autonomous domain, the blocks of other autonomous domains remain unchanged.

[0137] At the end of the current round of iteration, if the difference between the blocks in the last two rounds of each autonomous domain is less than the set threshold or the number of iterations reaches the set number or the objective function is less than the set target value, the iteration is stopped, otherwise a new round of iteration is triggered.

[0138] After introducing the resource scheduling method and apparatus for defending against DDoS attacks in a multi-autonomous domain network according to an exemplary embodiment of the present application, next, a resource scheduling device for defending against DDoS attacks in a multi-autonomous domain network according to another exemplary embodiment of the present application is introduced.

[0139] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0140] In some possible implementations, the resource scheduling device for defending against DDoS attacks in a multi-autonomous domain network according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the resource scheduling method for defending against DDoS attacks in a multi-autonomous domain network according to various exemplary implementations of the present application described above in this specification.

[0141] Refer to the following Figure 6 To describe the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network according to this embodiment of the present application. Figure 6 The resource scheduling device 160 shown for defending against DDoS attacks in a multi-autonomous domain network is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0142] like Figure 6 As shown, the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network is presented in the form of a general electronic device. The components of the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network may include, but are not limited to: the at least one processor 161, the at least one memory 162, and a bus 163 connecting different system components (including the memory 162 and the processor 161).

[0143] Bus 163 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0144] The memory 162 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1621 and / or a cache memory 1622 , and may further include a read-only memory (ROM) 1623 .

[0145] The memory 132 may also include a program / utility 1625 having a set (at least one) of program modules 1624, such program modules 1624 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0146] The resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network may also communicate with one or more external devices 164 (e.g., keyboards, pointing devices, etc.), and may also communicate with one or more devices that enable a user to interact with the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network, and / or communicate with any device (e.g., routers, modems, etc.) that enables the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network to communicate with one or more other electronic devices. Such communication may be performed through an input / output (I / O) interface 165. In addition, the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 166. As shown in the figure, the network adapter 166 communicates with other modules of the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network through a bus 163. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the resource scheduling device 160 for defending against DDoS attacks in a multi-autonomous domain network, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0147] In some possible implementations, various aspects of a resource scheduling method for defending against DDoS attacks in a multi-autonomous domain network provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a resource scheduling method for defending against DDoS attacks in a multi-autonomous domain network according to various exemplary implementations of the present application described above in this specification.

[0148] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0149] The program product for resource scheduling when defending against DDoS attacks in a multi-autonomous domain network of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on an electronic device. However, the program product of the present application is not limited to this. In this document, the readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0150] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0151] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0152] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A resource scheduling method for defending against attacks in a multi-autonomous domain network, characterized in that: The method comprises: When a DDoS attack is detected, the resources to be allocated for each autonomous domain in the network are locked as decision variables; The sum of resources occupied by the attacker in each attacked autonomous domain in the network is determined as the objective function; According to the resource range of each autonomous domain determined by the sum of resources of multiple autonomous domains, it is determined as a constraint condition that the resources to be allocated to each autonomous domain do not exceed the corresponding resource range; The decision variables of each autonomous domain are combined into blocks, and the block joint descent method is used to iteratively solve each block with the goal of minimizing the objective function under the constraint condition; At the end of the iteration, resources are allocated to each autonomous domain according to the decision variables in the blocks of the autonomous domain.

2. The method according to claim 1, characterized in that The resources to be allocated to each autonomous domain in the network are locked as decision variables, including: The bandwidth resources B to be allocated to each autonomous domain of the network i , computing and processing resources C i and memory storage resources M i At least one of them is locked as a decision variable; Wherein i=1,2,…,n, n is the number of autonomous domains in the network, and i is the number of the autonomous domain.

3. The method according to claim 1 or 2, characterized in that: The sum of the resources occupied by the attacker in each attacked autonomous domain in the network is determined as the objective function, including: Determine the sum of the basic idle resource item and the attack information item, and then subtract the resource coupling item as the objective function; The basic idle resource item is the sum of the ratios of the resources remaining after the multiple autonomous domains provide services in the network to the total resources of the multiple autonomous domains; The attack information item is used to indicate the coupling relationship between different resources of the attacked autonomous domain determined according to the resource consumption of the attacked autonomous domain by the DDos attack launched by the attacker; The resource coupling item is used to indicate the capability of other autonomous domains in the network to provide resource support relative to the attacked autonomous domain.

4. The method according to claim 3, characterized in that The basic idle resource items are: Among them, X(B1,C1,M1,…,B n ,C n ,M n ) is the basic idle resource item, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain.

5. The method according to claim 3, characterized in that: The attack information items are: Among them, Y(B j ,C j ,M j ) is the attack information item, α is the first correction coefficient, V is the consumption of bandwidth resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, R is the consumption of computing resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, D is the consumption of memory resources of the attacked j-th autonomous domain by the DDos attack launched by the attacker, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M It is the adjustment factor of memory storage resources.

6. The method according to claim 3, characterized in that The resource coupling items are: Among them, Z(B1,C1,M1,…,B n ,C n ,M n ) is the resource coupling term, β is the second correction coefficient, s B is the adjustment factor of bandwidth resources, s C is the adjustment factor for computing processing resources, s M is the adjustment factor of memory storage resources, B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max It is the sum of memory storage resources of multiple autonomous domains.

7. The method according to claim 1, characterized in that The constraints include: B i ≤B max -B i,0 、C i ≤C max -C i,0 、M i ≤M max -M i,0 ; B max is the sum of bandwidth resources of multiple autonomous domains, C max is the sum of computing resources of multiple autonomous domains, M max is the sum of memory storage resources of multiple autonomous domains, B i.0 The bandwidth resources required to maintain basic network services for the i-th autonomous domain, C i.0 The computing resources required to maintain basic network services for the i-th autonomous domain, M i.0 The memory storage resources required to maintain basic network services for the i-th autonomous domain.

8. The method according to claim 1, characterized in that The block joint descent method is used to iteratively solve each block, including: When a new round of iteration is triggered, the blocks of each autonomous domain are optimized one by one. When optimizing the blocks of the current autonomous domain, the blocks of other autonomous domains remain unchanged. At the end of the current round of iteration, if the difference between the blocks in the last two rounds of each autonomous domain is less than the set threshold or the number of iterations reaches the set number or the objective function is less than the set target value, the iteration is stopped, otherwise a new round of iteration is triggered.

9. A resource scheduling device for defending against attacks in a multi-autonomous domain network, characterized in that: include: A decision variable locking module is used to lock the resources to be allocated to each autonomous domain in the network as decision variables when a DDoS attack is detected; The target function determination module is used to determine the sum of the resources occupied by the attacker in each attacked autonomous domain in the network as the target function; A constraint condition determination module, used to determine the resource range that can be allocated to each autonomous domain according to the sum of resources of multiple autonomous domains, and to determine as a constraint condition that the resources to be allocated to each autonomous domain do not exceed the corresponding resource range; A block solving module is used to combine the decision variables of each autonomous domain into blocks, and iteratively solve each block by using a block joint descent method with the goal of minimizing the objective function under the constraints; The resource allocation module is used to allocate resources to each autonomous domain according to the decision variables in the blocks of each autonomous domain at the end of iteration.

10. A resource scheduling device for defending against DDoS attacks in a multi-autonomous domain network, characterized in that: It comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method as described in any one of claims 1-8.

11. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method according to any one of claims 1 to 8.

Images