System and method for constructing virtual network security function chain

Abstract

The invention relates to the technical field of function chain construction, in particular to a system and a method for constructing a virtual network security function chain, which comprises the following steps of: virtualizing various security functions, deploying the security functions in a network in a virtualized form, constructing a virtual security function chain, identifying security threats and generating a corresponding security event report. When a security threat is identified, a response is quickly made and corresponding protection measures are taken, so that data transmission and instruction communication among the virtualization security functions are realized, tasks of the security functions are dynamically allocated, resource utilization is optimized, system performance bottlenecks and potential faults are detected, and maintenance and optimization are carried out. According to the invention, each virtualization security function cooperatively works through an effective communication interface and a task scheduling mechanism, and it is ensured that the system can quickly respond and take corresponding protection measures when identifying security threats, such as blocking malicious traffic and isolating infected nodes.

Description

Technical Field

[0001] The present invention relates to the technical field of function chain construction, and in particular to a system and method for constructing a virtual network security function chain. Background Art

[0002] At present, with the rapid development of information technology, network security issues are becoming increasingly severe. Virtual network security function chain technology integrates multiple security functions through virtualization technology to cope with complex and changing network threats. This technology can flexibly configure and deploy various security functions to achieve efficient security protection and real-time response.

[0003] However, the inventors have discovered that this technical solution still has at least the following defects:

[0004] First: The existing technology has the problem of insufficient flexibility and scalability in the construction of virtual network security function chain, which makes it difficult to quickly adapt to changing security needs. There is a lack of effective collaborative working mechanism between various security function modules, and the overall protection capability is limited.

[0005] Second: The existing system is inefficient when processing massive amounts of data and has difficulty achieving real-time response. At the same time, it lacks intelligent self-learning and optimization capabilities and is unable to dynamically adjust security strategies and functional chain structures, limiting the system's protection effectiveness and adaptability. Summary of the invention

[0006] Based on the above objectives, the present invention provides a system and method for constructing a virtual network security function chain.

[0007] A system for constructing a virtual network security function chain includes a function chain construction module, a data processing and analysis module, a real-time response module, a real-time response module, a collaborative work module and a system monitoring module, wherein:

[0008] The function chain building module is used to virtualize various security functions, including firewalls, intrusion detection systems, and anti-virus software, deploy these security functions in a virtualized form in the network, and arrange the virtualized security functions in order according to the preset security policies to build a virtual security function chain;

[0009] The data processing and analysis module is used to collect, process and analyze network data, identify security threats, and generate corresponding security incident reports;

[0010] When the real-time response module identifies a security threat, it responds quickly and takes corresponding protective measures, including blocking malicious traffic and isolating infected nodes;

[0011] The collaborative work module coordinates the work between various virtualization security functions, specifically including:

[0012] Communication interface: realizes data transmission and command communication between various virtualized security functions;

[0013] Task scheduler: dynamically allocates tasks for various security functions based on security policies and network status to optimize resource utilization;

[0014] The system monitoring module monitors the operating status of the virtual safety function chain in real time, detects system performance bottlenecks and potential failures, and performs maintenance and optimization.

[0015] Optionally, the function chain building module includes:

[0016] Security function virtualization: various security functions, including firewalls, intrusion detection systems, and anti-virus software, are converted into virtual instances through virtualization technology and deployed in a virtual environment in the network;

[0017] Virtual instance configuration: configure the parameters and operating environment of each virtualized security function instance;

[0018] Preset security policy definition: Develop preset security policies based on network security requirements and risk assessment;

[0019] Function chain arrangement: Arrange each virtualized security function instance in order according to the preset security policy to build one or more virtual security function chains;

[0020] Collaborative work configuration: configure collaborative work mechanisms for each safety function instance in the virtual safety function chain, including data transmission protocols and command communication interfaces;

[0021] Function chain deployment: deploy the configured virtual security function chain into the actual network environment;

[0022] Function chain testing and optimization: Test the deployed virtual security function chain to verify whether it can effectively respond to expected security threats. Based on the test results, make necessary optimization adjustments to improve the protection effect and operation efficiency of the virtual security function chain.

[0023] Optionally, the data processing and analysis module includes:

[0024] Data collection: real-time collection of network data from network traffic, log records, and user behavior;

[0025] Data preprocessing: Clean, filter and format the collected data to remove redundant and invalid data;

[0026] Data storage: Store the preprocessed data in a distributed database;

[0027] Data analysis: Use support vector machine algorithms to conduct in-depth analysis of stored data to identify potential security threats and abnormal behaviors;

[0028] Security incident generation: Generate corresponding security incident reports based on the results of data analysis, and record the type, source and time of threats in detail;

[0029] Event priority assessment: Priority assessment of generated security events, determine the urgency of handling, and provide it to system administrators for reference;

[0030] Report output: Security incident reports are displayed to system administrators in a visual form, allowing them to quickly understand and handle security threats.

[0031] Optionally, the data analysis includes:

[0032] Data preparation: extract preprocessed data from distributed databases and perform further cleaning and normalization;

[0033] Feature extraction: Through statistical analysis and signal processing methods, key feature variables are extracted from the raw data to reflect abnormal patterns of network traffic and user behavior;

[0034] Model training: Use the support vector machine algorithm and the linear kernel function to train the threat detection model based on historical data;

[0035] Model Validation: Use an independent dataset to validate the trained linear kernel support vector machine model and evaluate its accuracy and reliability in identifying security threats and abnormal behaviors;

[0036] Real-time analysis: Deploy the trained and verified linear kernel support vector machine model to the data analysis platform to analyze the real-time incoming data and identify potential security threats and abnormal behaviors.

[0037] Optionally, the real-time response module includes:

[0038] Threat detection: Identify and detect potential security threats through data processing and analysis modules;

[0039] Threat assessment: Rapidly evaluate detected security threats to determine the type, source, and severity of the threat;

[0040] Response strategy formulation: Based on the threat assessment results, formulate corresponding response strategies and determine the protective measures that need to be taken, including blocking malicious traffic and isolating infected nodes. Specifically, they include:

[0041] Block malicious traffic: Set blocking rules in the network to prevent malicious traffic from entering or leaving the network through firewalls or intrusion prevention systems;

[0042] Isolate infected nodes: Use network isolation technology to isolate infected nodes from the network to prevent them from posing further threats to other nodes.

[0043] Optionally, the communication interface includes:

[0044] Communication protocol selection: Select the appropriate communication protocol based on the requirements of virtualization security functions and the network environment;

[0045] Interface configuration: Configure the communication interface for each virtualization security function, including IP address, port number, and transmission protocol;

[0046] Data transmission: Data is transmitted between various virtualized security functions through configured communication interfaces;

[0047] Command communication: Send and receive control commands through the communication interface to remotely control and coordinate the operation of virtualized security functions.

[0048] Optionally, the task scheduler includes:

[0049] Security policy analysis: read and analyze the current security policy to determine the priority and task requirements of each security function;

[0050] Network status monitoring: real-time monitoring of network status, including network traffic, node load, and bandwidth utilization, and collection of current network operation parameters;

[0051] Task priority sorting: Dynamically adjust the task priority of each security function according to security policies and network status;

[0052] Resource assessment: Evaluate the available system resources, including computing resources, storage resources, and network resources, and determine the resource quota required for each security function;

[0053] Task allocation: Dynamically allocate tasks for various security functions based on task priority and resource evaluation results.

[0054] Optionally, the monitoring parameter configuration includes:

[0055] Define and configure system parameters that need to be monitored, including CPU usage, memory usage, network traffic, and response time;

[0056] Data collection: Monitoring agents or sensors collect operating data and system parameters of each virtual safety function in real time;

[0057] Performance indicator calculation: Calculate key performance indicators based on the collected data;

[0058] Bottleneck detection: Use data analysis techniques and preset thresholds to detect performance bottlenecks in system operation, including CPU overload, memory leaks, and network congestion;

[0059] Fault detection: Identify potential faults and abnormal behaviors in system operation and generate fault alerts;

[0060] Maintenance and optimization: Based on the alarm information, formulate a system maintenance plan, implement the optimization measures in the maintenance plan, and adjust the system configuration and resource allocation.

[0061] A system for constructing a virtual network security function chain, used to implement the above-mentioned method for constructing a virtual network security function chain, comprises the following steps:

[0062] S1, function chain construction: used to virtualize various security functions, including firewalls, intrusion detection systems and anti-virus software, deploy these security functions in the network in a virtualized form, and arrange the virtualized security functions in order according to the preset security policies to build a virtual security function chain;

[0063] S2, data processing and analysis: used to collect, process and analyze network data, identify security threats, and generate corresponding security incident reports;

[0064] S3, real-time response: When security threats are identified, respond quickly and take corresponding protective measures, including blocking malicious traffic and isolating infected nodes;

[0065] S4, Collaboration: Coordination between various virtualization security functions, including:

[0066] S41, communication interface: realizing data transmission and command communication between various virtualized security functions;

[0067] S42, task scheduler: dynamically allocate tasks for various security functions according to security policies and network status to optimize resource utilization;

[0068] S5, system monitoring: monitor the operating status of the virtual safety function chain in real time, detect system performance bottlenecks and potential failures, and perform maintenance and optimization.

[0069] Beneficial effects of the present invention:

[0070] The present invention improves the flexibility and scalability of the system: through virtualization technology, various security functions can be flexibly configured and deployed, and the structure of the virtual security function chain can be dynamically adjusted according to preset security policies to quickly respond to changing network security needs.

[0071] The present invention enhances collaborative work and real-time response capabilities: various virtualized security functions work together through effective communication interfaces and task scheduling mechanisms, ensuring that the system can respond quickly and take corresponding protective measures when security threats are identified, such as blocking malicious traffic and isolating infected nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0073] Figure 1 A schematic diagram of a system and method for constructing a virtual network security function chain according to an embodiment of the present invention. DETAILED DESCRIPTION

[0074] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0075] It should be noted that the references to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0076] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0077] like Figure 1 As shown, a system and method for constructing a virtual network security function chain includes a function chain construction module, a data processing and analysis module, a real-time response module, a real-time response module, a collaborative work module and a system monitoring module, wherein:

[0078] The function chain building module is used to virtualize various security functions, including firewalls, intrusion detection systems, and anti-virus software, deploy these security functions in the network in a virtualized form, and arrange the virtualized security functions in order according to the preset security policies to build a virtual security function chain;

[0079] The data processing and analysis module is used to collect, process and analyze network data, identify security threats, and generate corresponding security incident reports;

[0080] When a security threat is identified, the real-time response module responds quickly and takes appropriate protective measures, including blocking malicious traffic and isolating infected nodes;

[0081] The collaborative work module coordinates the work between various virtualization security functions, including:

[0082] Communication interface: realizes data transmission and command communication between various virtualized security functions;

[0083] Task scheduler: dynamically allocates tasks for various security functions based on security policies and network status to optimize resource utilization;

[0084] The system monitoring module monitors the operating status of the virtual safety function chain in real time, detects system performance bottlenecks and potential failures, and performs maintenance and optimization.

[0085] Function chain building blocks include:

[0086] Security function virtualization: various security functions, including firewalls, intrusion detection systems, and anti-virus software, are converted into virtual instances through virtualization technology and deployed in a virtual environment in the network;

[0087] Virtual instance configuration: configure the parameters and operating environment of each virtualized security function instance;

[0088] Preset security policy definition: Develop preset security policies based on network security requirements and risk assessment;

[0089] Function chain arrangement: Arrange each virtualized security function instance in order according to the preset security policy to build one or more virtual security function chains;

[0090] Collaborative work configuration: configure collaborative work mechanisms for each safety function instance in the virtual safety function chain, including data transmission protocols and command communication interfaces;

[0091] Function chain deployment: deploy the configured virtual security function chain into the actual network environment;

[0092] Function chain testing and optimization: Test the deployed virtual security function chain to verify whether it can effectively respond to expected security threats. Based on the test results, make necessary optimization adjustments to improve the protection effect and operation efficiency of the virtual security function chain.

[0093] Data processing and analysis modules include:

[0094] Data collection: real-time collection of network data from network traffic, log records, and user behavior;

[0095] Data preprocessing: Clean, filter and format the collected data to remove redundant and invalid data;

[0096] Data storage: Store the preprocessed data in a distributed database;

[0097] Data analysis: Use support vector machine algorithms to conduct in-depth analysis of stored data to identify potential security threats and abnormal behaviors;

[0098] Security incident generation: Generate corresponding security incident reports based on the results of data analysis, and record the type, source and time of threats in detail;

[0099] Event priority assessment: Priority assessment of generated security events, determine the urgency of handling, and provide it to system administrators for reference;

[0100] Report output: Security incident reports are displayed to system administrators in a visual form, allowing them to quickly understand and handle security threats.

[0101] Data analysis includes:

[0102] Data preparation: extract preprocessed data from distributed databases and perform further cleaning and normalization;

[0103] Feature extraction: Through statistical analysis and signal processing methods, key feature variables are extracted from the raw data to reflect abnormal patterns of network traffic and user behavior;

[0104] Model training: Use the support vector machine algorithm and the linear kernel function to train the threat detection model based on historical data;

[0105] Model Validation: Use an independent dataset to validate the trained linear kernel support vector machine model and evaluate its accuracy and reliability in identifying security threats and abnormal behaviors;

[0106] Real-time analysis: Deploy the trained and verified linear kernel support vector machine model to the data analysis platform to analyze the real-time incoming data and identify potential security threats and abnormal behaviors.

[0107] The real-time response module includes:

[0108] Threat detection: Identify and detect potential security threats through data processing and analysis modules;

[0109] Threat assessment: Rapidly evaluate detected security threats to determine the type, source, and severity of the threat;

[0110] Response strategy formulation: Based on the threat assessment results, formulate corresponding response strategies and determine the protective measures that need to be taken, including blocking malicious traffic and isolating infected nodes. Specifically, they include:

[0111] Block malicious traffic: Set blocking rules in the network to prevent malicious traffic from entering or leaving the network through firewalls or intrusion prevention systems;

[0112] Isolate infected nodes: Use network isolation technology to isolate infected nodes from the network to prevent them from posing further threats to other nodes.

[0113] The communication interface includes:

[0114] Communication protocol selection: Select the appropriate communication protocol based on the requirements of virtualization security functions and the network environment;

[0115] Interface configuration: Configure the communication interface for each virtualization security function, including IP address, port number, and transmission protocol;

[0116] Data transmission: Data is transmitted between various virtualized security functions through configured communication interfaces;

[0117] Command communication: Send and receive control commands through the communication interface to remotely control and coordinate the operation of virtualized security functions.

[0118] The task scheduler includes:

[0119] Security policy analysis: read and analyze the current security policy to determine the priority and task requirements of each security function;

[0120] Network status monitoring: real-time monitoring of network status, including network traffic, node load, and bandwidth utilization, and collection of current network operation parameters;

[0121] Task priority sorting: Dynamically adjust the task priority of each security function according to security policies and network status;

[0122] Resource assessment: Evaluate the available system resources, including computing resources, storage resources, and network resources, and determine the resource quota required for each security function;

[0123] Task allocation: Dynamically allocate tasks for various security functions based on task priority and resource evaluation results.

[0124] The system monitoring module includes:

[0125] Define and configure system parameters that need to be monitored, including CPU usage, memory usage, network traffic, and response time;

[0126] Data collection: Monitoring agents or sensors collect operating data and system parameters of each virtual safety function in real time;

[0127] Performance indicator calculation: Calculate key performance indicators based on the collected data;

[0128] Bottleneck detection: Use data analysis techniques and preset thresholds to detect performance bottlenecks in system operation, including CPU overload, memory leaks, and network congestion;

[0129] Fault detection: Identify potential faults and abnormal behaviors in system operation and generate fault alerts;

[0130] Maintenance and optimization: Based on the alarm information, formulate a system maintenance plan, implement the optimization measures in the maintenance plan, and adjust the system configuration and resource allocation.

[0131] A system for constructing a virtual network security function chain, used to implement the above-mentioned method for constructing a virtual network security function chain, comprises the following steps:

[0132] S1, function chain construction: used to virtualize various security functions, including firewalls, intrusion detection systems and anti-virus software, deploy these security functions in the network in a virtualized form, and arrange the virtualized security functions in order according to the preset security policies to build a virtual security function chain;

[0133] S2, data processing and analysis: used to collect, process and analyze network data, identify security threats, and generate corresponding security incident reports;

[0134] S3, real-time response: When security threats are identified, respond quickly and take corresponding protective measures, including blocking malicious traffic and isolating infected nodes;

[0135] S4, Collaboration: Coordination between various virtualization security functions, including:

[0136] S41, communication interface: realizing data transmission and command communication between various virtualized security functions;

[0137] S42, task scheduler: dynamically allocate tasks for various security functions according to security policies and network status to optimize resource utilization;

[0138] S5, system monitoring: monitor the operating status of the virtual safety function chain in real time, detect system performance bottlenecks and potential failures, and perform maintenance and optimization.

[0139] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0140] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A system for constructing a virtual network security function chain, characterized in that: It includes function chain building module, data processing and analysis module, real-time response module, collaborative work module and system monitoring module, among which: The function chain building module is used to virtualize various security functions, including firewalls, intrusion detection systems, and anti-virus software, deploy these security functions in a virtualized form in the network, and arrange the virtualized security functions in order according to the preset security policies to build a virtual security function chain; The data processing and analysis module is used to collect, process and analyze network data, identify security threats, and generate corresponding security incident reports; When the real-time response module identifies a security threat, it responds quickly and takes corresponding protective measures, including blocking malicious traffic and isolating infected nodes; The collaborative work module coordinates the work between various virtualization security functions, specifically including: Communication interface: realizes data transmission and command communication between various virtualized security functions; Task scheduler: dynamically allocates tasks for various security functions based on security policies and network status to optimize resource utilization; The system monitoring module monitors the operating status of the virtual safety function chain in real time, detects system performance bottlenecks and potential failures, and performs maintenance and optimization.

2. A system for constructing a virtual network security function chain according to claim 1, characterized in that: The functional chain building module includes: Security function virtualization: various security functions, including firewalls, intrusion detection systems, and anti-virus software, are converted into virtual instances through virtualization technology and deployed in a virtual environment in the network; Virtual instance configuration: configure the parameters and operating environment of each virtualized security function instance; Preset security policy definition: Develop preset security policies based on network security requirements and risk assessment; Function chain arrangement: Arrange each virtualized security function instance in order according to the preset security policy to build one or more virtual security function chains; Collaborative work configuration: configure collaborative work mechanisms for each safety function instance in the virtual safety function chain, including data transmission protocols and command communication interfaces; Function chain deployment: deploy the configured virtual security function chain into the actual network environment; Function chain testing and optimization: Test the deployed virtual security function chain to verify whether it can effectively respond to expected security threats. Based on the test results, make necessary optimization adjustments to improve the protection effect and operation efficiency of the virtual security function chain.

3. A system for constructing a virtual network security function chain according to claim 1, characterized in that: The data processing and analysis module includes: Data collection: real-time collection of network data from network traffic, log records, and user behavior; Data preprocessing: Clean, filter and format the collected data to remove redundant and invalid data; Data storage: Store the preprocessed data in a distributed database; Data analysis: Use support vector machine algorithms to conduct in-depth analysis of stored data to identify potential security threats and abnormal behaviors; Security incident generation: Generate corresponding security incident reports based on the results of data analysis, and record the type, source and time of threats in detail; Event priority assessment: Priority assessment of generated security events, determine the urgency of handling, and provide it to system administrators for reference; Report output: Security incident reports are displayed to system administrators in a visual form, allowing them to quickly understand and handle security threats.

4. A system for constructing a virtual network security function chain according to claim 3, characterized in that: The data analysis includes: Data preparation: extract preprocessed data from distributed databases and perform further cleaning and normalization; Feature extraction: Through statistical analysis and signal processing methods, key feature variables are extracted from the raw data to reflect abnormal patterns of network traffic and user behavior; Model training: Use the support vector machine algorithm and the linear kernel function to train the threat detection model based on historical data; Model Validation: Use an independent dataset to validate the trained linear kernel support vector machine model and evaluate its accuracy and reliability in identifying security threats and abnormal behaviors; Real-time analysis: Deploy the trained and verified linear kernel support vector machine model to the data analysis platform to analyze the real-time incoming data and identify potential security threats and abnormal behaviors.

5. A system for constructing a virtual network security function chain according to claim 1, characterized in that: The real-time response module includes: Threat detection: Identify and detect potential security threats through data processing and analysis modules; Threat assessment: Rapidly evaluate detected security threats to determine the type, source, and severity of the threat; Response strategy formulation: Based on the threat assessment results, formulate corresponding response strategies and determine the protective measures that need to be taken, including blocking malicious traffic and isolating infected nodes. Specifically, they include: Block malicious traffic: Set blocking rules in the network to prevent malicious traffic from entering or leaving the network through firewalls or intrusion prevention systems; Isolate infected nodes: Use network isolation technology to isolate infected nodes from the network to prevent them from posing further threats to other nodes.

6. A system for constructing a virtual network security function chain according to claim 1, characterized in that: The communication interface includes: Communication protocol selection: Select the appropriate communication protocol based on the requirements of virtualization security functions and the network environment; Interface configuration: Configure the communication interface for each virtualization security function, including IP address, port number, and transmission protocol; Data transmission: Data is transmitted between various virtualized security functions through configured communication interfaces; Command communication: Send and receive control commands through the communication interface to remotely control and coordinate the operation of virtualized security functions.

7. A system for constructing a virtual network security function chain according to claim 1, characterized in that: The task scheduler comprises: Security policy analysis: read and analyze the current security policy to determine the priority and task requirements of each security function; Network status monitoring: real-time monitoring of network status, including network traffic, node load, and bandwidth utilization, and collection of current network operation parameters; Task priority sorting: Dynamically adjust the task priority of each security function according to security policies and network status; Resource assessment: Evaluate the available system resources, including computing resources, storage resources, and network resources, and determine the resource quota required for each security function; Task allocation: Dynamically allocate tasks for various security functions based on task priority and resource evaluation results.

8. A system for constructing a virtual network security function chain according to claim 1, characterized in that: The system monitoring module includes: Define and configure system parameters that need to be monitored, including CPU usage, memory usage, network traffic, and response time; Data collection: Monitoring agents or sensors collect operating data and system parameters of each virtual safety function in real time; Performance indicator calculation: Calculate key performance indicators based on the collected data; Bottleneck detection: Use data analysis techniques and preset thresholds to detect performance bottlenecks in system operation, including CPU overload, memory leaks, and network congestion; Fault detection: Identify potential faults and abnormal behaviors in system operation and generate fault alerts; Maintenance and optimization: Based on the alarm information, formulate a system maintenance plan, implement the optimization measures in the maintenance plan, and adjust the system configuration and resource allocation.

9. A method for constructing a virtual network security function chain, implemented by the above-mentioned system for constructing a virtual network security function chain, comprising the following steps: S1, function chain construction: used to virtualize various security functions, including firewalls, intrusion detection systems and anti-virus software, deploy these security functions in the network in a virtualized form, and arrange the virtualized security functions in order according to the preset security policies to build a virtual security function chain; S2, data processing and analysis: used to collect, process and analyze network data, identify security threats, and generate corresponding security incident reports; S3, real-time response: When security threats are identified, respond quickly and take corresponding protective measures, including blocking malicious traffic and isolating infected nodes; S4, Collaboration: Coordination between various virtualization security functions, including: S41, communication interface: realizing data transmission and command communication between various virtualized security functions; S42, task scheduler: dynamically allocate tasks for various security functions according to security policies and network status to optimize resource utilization; S5, system monitoring: monitor the operating status of the virtual safety function chain in real time, detect system performance bottlenecks and potential failures, and perform maintenance and optimization.

Images